APAC Coverage Directory

Not assessed. No market or regulatory research done, by instruction.

Not researched: see the open questions below before any enquiry.

Bangladesh Bank's ICT Security Guideline v4.0 asks regulated financial organisations for internal/external penetration testing at least annually and independent vulnerability scans of critical systems each year, which fits remote VAPT. The 2026 cyber security and data protection Acts add annual CII audits, security-measure duties and independent data audits that support assessment and privacy readiness work.

Where the services fit: Banks and NBFIs; Mobile financial service and payment service providers; Organisations declared critical information infrastructure; Data fiduciaries and processors under the PDP Act 2026; Software exporters and BPO firms serving overseas clients.

• Cyber Security Act, 2026 (Act No. 81 of 2026)

  National Cyber Security Agency (Director General) and National Cyber Security Council

  Repeals and re-enacts the Cyber Security Ordinance 2025. Section 16: the Director General may monitor and inspect critical information infrastructure (CII). Each declared CII must audit its internal and external infrastructure every year, in the manner set by rules, and submit the audit report to the Council. Cyber security experts must carry out the monitoring, inspection and audit work.

  Passed 10 April 2026; s.1(2) deems it in force from 21 May 2025. Rules setting the audit method were not checked. A Cyber Security (Amendment) Act, 2026 (Act No. 99 of 2026) exists and was not reviewed.. Primary source, checked 2026-11-12.

• Personal Data Protection Act, 2026 (Act No. 63 of 2026)

  Authority under the National Data Management Act, 2026 (authority name and status unverified)

  Covers processing in Bangladesh, and processing abroad linked to offering goods or services to, or monitoring, people in Bangladesh. Section 17: data fiduciaries (controllers) and processors must take appropriate technical and organisational security measures, including pseudonymisation, encryption, resilience and periodic risk assessment. Section 20: breaches likely to cause significant harm must be notified to the Authority, in the form and time set by regulation. Section 21: data fiduciaries in classes set by regulation must have their processing audited by an independent data auditor empowered by the Authority.

  Dated 10 April 2026; deemed in force from 6 November 2025, except section 23 and sections 31-35 (including the Chief Data Officer, administrative fine and compensation provisions). Those start on a date the government notifies after 18 months from issue. Regulations (breach timeline, audit classes) not checked.. Primary source, checked 2026-11-12.

• Bangladesh Bank Guideline on ICT Security, Version 4.0 (2023)

  Bangladesh Bank

  Applies to banks, NBFIs, mobile financial service providers, payment service providers, payment system operators, white-label ATM operators, merchant acquirers and other financial service providers regulated by Bangladesh Bank. Section 6.2: internal vulnerability scans at least half-yearly; vulnerability scans of critical systems and applications once a year by an independent party; internal and external penetration testing at least annually and after any significant infrastructure or application change, using an industry-accepted method (for example NIST SP 800-115).

  Version 4.0, 2023 (file name dated June 2023); compliance deadline not confirmed.. Primary source, checked 2026-11-12.

BICMA's cybersecurity code of practice requires covered telecom and ICT providers to run a penetration test at least every 12 months and to use third-party testers with recognised certifications, which fits remote VAPT. The market is small.

Where the services fit: Telecom and ICT service providers with critical information infrastructure; Banks and financial institutions (regulator expectations not verified).

• Cybersecurity Code of Practice for ICT/Telecommunications Service Providers

  Bhutan InfoComm and Media Authority (BICMA)

  Issued under s.58 of the Information, Communications and Media Act of Bhutan 2018. Applies to telecom service providers and other ICT service providers that have critical information infrastructure. Section 11.6: penetration test of ICT facilities at least once every 12 months and after major system changes; third-party testing firms must hold industry-recognised accreditation and their testers industry-recognised penetration testing certifications.

  In force 10 October 2024.. Primary source, checked 2026-11-12.

SecureRoot is based in India, and the site covers Indian requirements in depth: DPDP Act compliance, the DPDP Consent Manager deadline, VAPT for banks, NBFCs and fintechs (RBI and SEBI), who can sign your security report (CERT-In empanelment and others).

Not assessed. No market or regulatory research done, by instruction.

Not researched: see the open questions below before any enquiry.

Maldives Monetary Authority circulars are reported to ask banks for a board-approved cyber security policy covering continuous vulnerability assessment and penetration testing, plus annual phishing simulations. None of this could be confirmed on the regulator's own site.

Where the services fit: Banks; Payment and fintech providers; Tourism and resort groups handling guest data (market observation, not a legal requirement).

No framework verified at an official source yet.

3 further items are awaiting verification at the official source and are not shown.

Nepal Rastra Bank's Cyber Resilience Guidelines 2023 expect licensed institutions to run penetration tests regularly and after major system changes, alongside vulnerability assessments and red-team tests, which fits remote VAPT.

Where the services fit: Class A-D banks and financial institutions; Payment system operators and payment service providers (wallets, PSPs); Organisations handling personal information under the Privacy Act.

• Cyber Resilience Guidelines 2023

  Nepal Rastra Bank (Payment Systems Department)

  Applies to A, B, C and D class BFIs, payment system operators and payment service providers licensed by NRB's Payment Systems Department. Paragraphs 155-157: penetration tests should simulate real attacks on systems, networks, applications, people and processes, and should be run regularly and whenever there are major updates or new deployments. The testing section also covers vulnerability assessments, scenario-based tests and red-team tests. The guideline uses 'should' wording.

  Issued August 2023 (PDF in NRB's 2023/08 uploads); exact issue and compliance dates not confirmed.. Primary source, checked 2026-11-12.

1 further item is awaiting verification at the official source and is not shown.

The State Bank of Pakistan and SECP have issued technology-risk and cybersecurity frameworks that are reported to include security testing. Both regulators' sites blocked automated access, so no testing requirement is confirmed here.

Where the services fit: Banks, DFIs and microfinance banks; Payment system operators and EMIs; Insurers and securities market entities; IT and BPO exporters serving overseas clients.

No framework verified at an official source yet.

3 further items are awaiting verification at the official source and are not shown.

CBSL Banking Act Direction No. 16 of 2021 requires licensed banks to commission penetration tests from independent external experts (critical systems at least annually, other qualifying systems every two years) and to run quarterly vulnerability assessments, which fits remote VAPT directly. The PDPA adds controller security and readiness work.

Where the services fit: Licensed commercial and specialised banks; Controllers and processors under the PDPA, including BPO and IT exporters; Finance companies (separate CBSL direction, not reviewed).

• Banking Act Directions No. 16 of 2021: Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks

  Central Bank of Sri Lanka

  Section 5.8.2: vulnerability assessments on production at least quarterly. Section 5.8.3: penetration tests by independent external experts on critical systems, on systems exposed to customer data, and on customer-data repositories (including those at agents and third-party providers). Critical systems are tested at least annually and the others at least every two years. Tests run on live systems, with non-production allowed at first under the transitional arrangements; both black-box and grey-box testing; scope documented.

  Dated 9 December 2021; compliance follows the transitional timelines in section 10 of the framework. Amended by Direction No. 05 of 2023, which was not verified and is reported to extend some penetration-testing timelines to 2028.. Primary source, checked 2026-11-12.

• Personal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025

  Data Protection Authority of Sri Lanka

  General personal data law for controllers and processors. The 2025 amendment lets the Minister bring provisions into force by gazette order. It also gives controllers one month to answer data subject requests, extendable to three months.

  Amendment certified 30 October 2025. Reported but unverified: Extraordinary Gazette No. 2498/16 of 22 July 2026 sets 1 January 2027 for ss.2-3 and Parts I and III (including DPO, breach notification, DPIA and cross-border transfer); data subject rights (Part II) are not included.. Primary source, checked 2026-11-12.

The FSA cybersecurity guideline expects regular vulnerability assessments and penetration tests (including web, platform and mobile app assessments) and recommends threat-led penetration testing, which maps to manual VAPT, mobile and API testing. APPI's security-control duty is general and does not itself name testing.

Where the services fit: Banks, insurers, securities firms and other FSA-supervised financial institutions; Payment, e-money and crypto-asset exchange service providers; SaaS and API businesses handling personal data; Firms with outsourced development that need code review.

• Act on the Protection of Personal Information (APPI), as amended

  Personal Information Protection Commission (PPC)

  Businesses must take necessary and appropriate measures to keep personal data secure (Art. 23); report qualifying leaks, loss or damage to the PPC and notify affected individuals (Art. 26); and generally obtain consent or rely on an equivalent-protection route before providing personal data to a third party in another country (Art. 28). The law does not name penetration testing.

  Official consolidated English translation is stated as of 1 April 2023, with all amended Acts in full force. Only the Japanese text has legal effect. Any later amendment review was not checked.. Primary source, checked 2026-11-12.

• Guidelines on Cybersecurity for the Financial Sector

  Financial Services Agency (FSA)

  Applies to financial institutions under the FSA's comprehensive supervisory guidelines. As a 'fundamental' measure, they should regularly conduct vulnerability assessments and penetration tests based on risk, covering platform and web application assessments for public websites and APIs and assessments of mobile apps, and report significant findings to senior management (s.2.2.4(1)). As a 'recommended' measure, they should regularly conduct threat-led penetration testing (TLPT) using vendors with the necessary experience and skills (s.2.2.4(b)). There is also a third-party risk management section (s.2.6).

  Dated 4 October 2024 (English provisional translation). The FSA policy page reportedly lists a 20 October 2025 publication, which may be a revised edition (unverified).. Primary source, checked 2026-11-12.

Readiness and gap work against PIPA safeguards and the ISMS / personal information certification schemes fit SecureRoot's regulatory-readiness and VAPT services. Certification itself is granted under the Korean schemes, not by SecureRoot.

Where the services fit: Information and communications service providers above the ISMS thresholds; Large personal information controllers (mandatory certification from July 2027); Fintech and e-commerce platforms; Korean firms with Indian development centres.

• Personal Information Protection Act (PIPA), Act No. 21445

  Personal Information Protection Commission (PIPC)

  Controllers must take technical, managerial and physical safeguards, including an internal management plan and access records (Art. 29). They must notify data subjects and report qualifying leaks to the PIPC or a designated institution without delay; details are set by Presidential Decree (Art. 34). Cross-border transfers need one of the listed bases, such as separate consent, contract necessity with disclosure, recognised certification, or an adequacy-type recognition (Art. 28-8). The PIPC may certify compliance for three years, and controllers meeting revenue and scale criteria must obtain certification (Art. 32-2).

  Amendment promulgated 10 March 2026; enters into force six months after promulgation (Addenda Art. 1). The mandatory-certification proviso of Art. 32-2(1) applies from 1 July 2027. English translation has no legal effect.. Primary source, checked 2026-11-12.

• Information Security Management System (ISMS) certification under the Network Act

  Ministry of Science and ICT (scheme operated with KISA, unverified)

  Telecommunications business operators, integrated information and communication facility operators, and providers above Presidential Decree thresholds (for example sales, ICT revenue or average daily users) must obtain ISMS certification, valid for three years (Network Act Art. 47).

  Version checked: Act No. 21066, 1 October 2025.. Primary source, checked 2026-11-12.

1 further item is awaiting verification at the official source and is not shown.

Possible fit for VAPT and readiness work, but the 2021 laws' obligations could not be read from the official text, so no specific testing requirement is stated.

Where the services fit: Banks and fintechs; Mining and telecom operators; Organisations designated as critical information infrastructure.

• Law on Cyber Security (adopted 17 December 2021)

  unverified

  A 2026 study commissioned by the State Great Khural (Parliament) Secretariat describes the law as in force and as covering duties of critical information infrastructure organisations and legal entities, incident response, audit and risk assessment. The law's own text was not opened, so the specific obligations are not stated.

  Adopted 17 December 2021 (per parliamentary study); entry-into-force date unverified. A new 'Cyber Resilience Law' is under study/draft in 2026 (status unverified).. Primary source, checked 2026-11-12.

1 further item is awaiting verification at the official source and is not shown.

Not a target market. Listed for completeness of the UN M49 Eastern Asia definition only.

Not researched: see the open questions below before any enquiry.

The law expects MLPS compliance, annual testing and assessment by critical information infrastructure operators (by themselves or a cybersecurity service institution), and regular PIPL compliance audits. Whether a firm outside China can perform this work is unresolved (see restrictions).

Where the services fit: Network operators subject to the multi-level protection scheme (MLPS); Critical information infrastructure operators; Important-data processors; Multinationals with China operations.

• Cybersecurity Law (as amended 28 October 2025)

  Cyberspace Administration of China (CAC) with relevant departments; public security for MLPS

  Network operators must meet the multi-level protection scheme (MLPS) duties, including security policies, technical controls, logs kept at least six months, and data classification, backup and encryption (Art. 23). Cybersecurity certification, testing and risk-assessment activities must follow state regulations (Art. 28). Critical information infrastructure (CII) operators must store personal information and important data collected in China in China, with a security assessment for exports (Art. 39). They must also test and assess their network security and risks at least once a year, by themselves or through a cybersecurity service institution, and report the results (Art. 40).

  Original law in force 1 June 2017; amending decision in force 1 January 2026 (articles renumbered).. Primary source, checked 2026-11-12.

• Personal Information Protection Law (PIPL)

  CAC and departments with PI-protection duties

  Cross-border provision of personal information needs a CAC security assessment, certification or the standard contract (Art. 38). Handlers must regularly audit their compliance (Art. 54), carry out impact assessments for listed processing including overseas transfers (Art. 55), and take remedial action and notify the authority and individuals of leaks (Art. 57).

  1 November 2021. Primary source, checked 2026-11-12.

• Data Security Law (DSL)

  Relevant competent departments; CAC coordinates

  Data processors must have full-lifecycle data security management, building on MLPS for online processing (Art. 27). They must remediate vulnerabilities and report incidents (Art. 29). Important-data processors must run periodic risk assessments and file reports (Art. 30). Data stored in China must not be provided to foreign judicial or law-enforcement bodies without approval (Art. 36).

  1 September 2021. Primary source, checked 2026-11-12.

• Network Data Security Management Regulations (State Council Order No. 790)

  CAC and relevant departments

  Important-data processors must name a responsible person and unit that runs regular risk monitoring, risk assessments and drills (Art. 30), and must assess risk before providing or entrusting important data (Art. 31).

  1 January 2025. Primary source, checked 2026-11-12.

• Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16)

  CAC

  Sets thresholds. A CAC security assessment is needed for CII operators exporting personal information or important data, and for other processors exporting important data or personal information on 1 million+ people (or sensitive personal information on 10,000+) in a year (Art. 7). Lower volumes need the standard contract or certification (Art. 8). Listed exemptions apply.

  22 March 2024 (on publication). Primary source, checked 2026-11-12.

• Provisions on the Management of Network Product Security Vulnerabilities

  MIIT, CAC, Ministry of Public Security

  Undisclosed network-product vulnerability information must not be provided to overseas organisations or individuals other than the product provider (Art. 9(7)). Vulnerability collection platforms must file with MIIT (Art. 10).

  1 September 2021. Primary source, checked 2026-11-12.

The HKMA sectoral Code of Practice under Cap. 653 expects the risk assessment to include a vulnerability assessment (scanning, source code review, configuration review) and a penetration test by suitably qualified people. This maps directly to manual VAPT, secure code review and configuration review. iCAST under C-RAF is a separate, qualification-gated simulation test.

Where the services fit: Authorized institutions (banks) supervised by the HKMA; Stored value facility licensees; Designated critical infrastructure operators under Cap. 653; Fintechs and SaaS vendors to Hong Kong banks.

• Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)

  Commissioner of Critical Infrastructure (Computer-system Security); designated authorities including the HKMA for designated banks

  Designated operators must keep an office in Hong Kong, set up a computer-system security management unit, notify material changes, submit and implement a security management plan, conduct computer-system security risk assessments, and arrange security audits. Ordinance sections are cited in the HKMA Code. In the HKMA's sectoral Code, the risk assessment should include a vulnerability assessment and a penetration test by suitably qualified people (Code s.6.3.4 to 6.3.6). The audit is run by an appointed assessor (Code s.6.4). The Code is not subsidiary legislation.

  Ordinance gazetted 28 March 2025; in operation 1 January 2026 (Secretary for Security notice). HKMA sectoral Code G4/58C dated 2 June 2026.. Primary source, checked 2026-11-12.

• Cybersecurity Fortification Initiative 2.0: Cyber Resilience Assessment Framework (C-RAF 2.0) and iCAST

  Hong Kong Monetary Authority (HKMA)

  Applies to all authorized institutions. C-RAF 2.0 is the HKMA's cyber resilience risk assessment, with updated control principles and blue-team requirements for iCAST (intelligence-led Cyber Attack Simulation Testing). The HKMA lists accepted qualifications for C-RAF assessors and iCAST roles, such as CREST certifications or listed equivalents (for example OSCP, GPEN, OSWE, GWAPT, HKIB CCASP).

  1 January 2021, phased implementation. Primary source, checked 2026-11-12.

1 further item is awaiting verification at the official source and is not shown.

Possible VAPT and readiness fit for critical infrastructure operators, but the official texts could not be opened, so no requirement is stated.

Where the services fit: Gaming and integrated resort operators (reported as critical infrastructure, unverified); Telecom operators; Banks.

No framework verified at an official source yet.

2 further items are awaiting verification at the official source and are not shown.

The amended Cyber Security Management Act and its subordinate regulations (audits, responsibility levels, incident notification) are the main assurance driver. The specific testing duties per responsibility level could not be verified from the official text.

Where the services fit: Government agencies and specific non-government agencies under the Cyber Security Management Act; Semiconductor and electronics supply chain; Financial institutions and fintechs.

• Cyber Security Management Act (as amended 2025)

  Ministry of Digital Affairs (MODA), Administration for Cyber Security

  The amendment was promulgated 24 September 2025. Seven subordinate regulations were scheduled, covering enforcement rules, classification of cyber security responsibility levels, audits of maintenance-plan implementation, incident notification and response, and review of products endangering national cyber security. Specific testing obligations were not verified.

  Amendment in effect 1 December 2025; subordinate regulations tentatively 1 January 2026; product-review regulations issued 19 December 2025, applying from 1 December 2025.. Primary source, checked 2026-11-12.

1 further item is awaiting verification at the official source and is not shown.

ARDFM rules require banks to run penetration tests of their digital infrastructure by independent external experts, vulnerability scanning at least every six months, and static code and component analysis for remote-service software, which map to SecureRoot's VAPT and secure code review services. Personal-data localisation and the licensing/accreditation rules for cybersecurity audit and conformity testing limit what a foreign remote provider can deliver, and these limits are unresolved.

Where the services fit: Second-tier banks and organisations performing certain banking operations; Credit bureaus; Fintech and remote (online/mobile) financial service providers; Owners of critically important digital objects (energy, telecoms, healthcare, transport); SaaS and digital platforms processing Kazakh personal data.

• Law on Personal Data and their Protection No. 94-V (21 May 2013)

  Authorised body in the field of personal data protection (central executive body; ministry not named in the text checked)

  Personal data must be stored in a database or digital storage facility located in Kazakhstan (Art. 12(2)). Cross-border transfer is allowed to countries that protect personal data, otherwise only on listed grounds such as the data subject's consent (Art. 16). Owners and operators must prevent and detect unauthorised access (Art. 22) and notify the authorised body of a personal-data security breach from the moment it is detected (Art. 25).

  In force since 2013 (six months after publication); Art. 12 last amended by Law No. 326-VIII of 24.06.2026 (effective 60 calendar days after publication). Primary source, checked 2026-11-12.

• Law On Cybersecurity No. 418-V (24 November 2015; formerly 'On Informatization', retitled by Law No. 256-VIII of 09.01.2026)

  Authorised body in the field of cybersecurity; National Cybersecurity Coordination Centre

  Owners of critically important digital objects must run or buy a cybersecurity centre, report incidents and send backups to a national platform (Art. 18). Mandatory cybersecurity-compliance testing of listed objects, including critically important digital objects, is done by accredited testing laboratories (Art. 49). Owners of critically important objects, or of objects processing legally protected secrets, must have a cybersecurity audit at least once a year, done internally or bought from legal entities licensed in the field of cybersecurity, with results sent to the authorised body (Art. 50).

  Law in force since 2016; Arts. 18, 49, 50 in the wording of Law No. 256-VIII of 09.01.2026, effective six months after its first official publication (exact date not verified). Primary source, checked 2026-11-12.

• ARDFM Board Resolution No. 53 of 3 April 2026: Requirements for information security in the financial sector, including cybersecurity of banks

  Agency of the Republic of Kazakhstan for Regulation and Development of Financial Market (ARDFM)

  Banks must have penetration testing of their digital infrastructure done by independent external experts at a frequency the bank sets, including load and denial-of-service simulation (para. 89); scan information assets for vulnerabilities at least every six months (para. 124); and run static source-code analysis and component/third-party library analysis for remote-service software, fixing critical vulnerabilities before release (paras. 148-151). Information placed in cloud services must be stored encrypted with the key held by the bank.

  Effective ten calendar days after first official publication (registered with the Ministry of Justice 6 April 2026, No. 38336); amended by ARDFM Resolution No. 153 of 30.10.2026. Replaced NBK Resolution No. 48 of 27.03.2018.. Primary source, checked 2026-11-12.

• NBK Resolution No. 288 of 06.11.2018 (ICT and information security requirements for credit bureaus)

  ARDFM

  Credit bureaus must security-test remote service software, at minimum by static source-code analysis and analysis of components and third-party libraries, and fix critical vulnerabilities before commissioning (paras. 81-7 to 81-10).

  In force; heading and para. 1 amended by ARDFM Resolution No. 59 of 16.08.2024. Primary source, checked 2026-11-12.

Central Bank rules require banks to scan for vulnerabilities, check systems for vulnerabilities before launch, and use data centres that run penetration tests at least once a year, and they allow banks to use external organisations for security audit or expertise, which fits SecureRoot's VAPT. A Central Bank rule limiting staff remote access to within Uzbekistan and the personal-data storage rules are unresolved for remote delivery.

Where the services fit: Commercial banks; Data-centre operators hosting bank systems; Fintech and remote financial service providers; Operators of critical information infrastructure; Telecom operators and digital platforms processing Uzbek personal data.

• Law on Personal Data No. ZRU-547 (2 July 2019)

  State Personalization Center under the Cabinet of Ministers (authorised state body)

  Since 27 March 2026 (Law ZRU-1125), biometric data, genetic data, and data of users of telecom operators working in Uzbekistan must be stored in Uzbekistan; other personal data may be stored and processed abroad if the country is recognised as giving equal protection, or the operator adopts standard contractual clauses or binding corporate rules meeting requirements approved by the authorised body, or follows international standards on a list approved by that body (Art. 27-1). Cross-border transfer is governed by Art. 15. Personal databases must be registered (Art. 20).

  Law in force 01.10.2019; Art. 27-1 in the wording of Law ZRU-1125 of 26.03.2026, in force 27.03.2026. Primary source, checked 2026-11-12.

• Law on Cybersecurity No. ZRU-764 (15 April 2022)

  State Security Service of the Republic of Uzbekistan (authorised state body for cybersecurity)

  Information resources and systems of state bodies and systems classed as critical information infrastructure must undergo mandatory expertise for compliance with cybersecurity requirements, under a procedure set by the State Security Service (Art. 18). The law also provides for attestation (Art. 20) and assessment of the level of cybersecurity (Art. 21), and requires incidents to be reported to the authorised body.

  In force 17.07.2022. Primary source, checked 2026-11-12.

• Central Bank Regulation on minimum information security and cybersecurity requirements for commercial banks (Board resolution No. 19/1 of 1 August 2025; MoJ reg. No. 3669 of 18.08.2025)

  Central Bank of the Republic of Uzbekistan

  Banks must regularly scan assets for vulnerabilities using CVE and CVSS and patch (para. 156), check systems for vulnerabilities before launch (para. 164), and use data centres that, among other things, run vulnerability analysis and penetration tests at least once a year (para. 168). Banks may use external organisations for audit or expertise and must govern sharing confidential data with them by contract (paras. 174-175). Staff remote access to bank systems is to be ensured only within Uzbekistan (para. 40).

  In force 20.11.2025 (per lex.uz). Primary source, checked 2026-11-12.

The Digital Code sets risk-management, incident-notification and cross-border transfer duties that buyers may want assessed; SecureRoot's VAPT and privacy readiness work fits as general assurance, not as a named legal requirement. No in-force National Bank testing rule was verified.

Where the services fit: Commercial banks and payment providers; Digital service providers and SaaS processing Kyrgyz personal data; Holders of personal-data arrays; Operators of critical information infrastructure.

• Digital Code of the Kyrgyz Republic No. 178 (31 July 2025)

  Sectoral regulator for personal data (the State Agency for Personal Data Protection under the Cabinet of Ministers publishes the Code text)

  Record owners must place digital records on media located in Kyrgyzstan only in cases the Code provides (Art. 31(3)); no specific personal-data case was identified in the text checked. Cross-border transfer goes to countries on the regulator's adequacy list, or otherwise on listed grounds such as consent, contract performance or adequate contractual terms (Art. 89). Incidents affecting digital resilience or rights must be notified to the sectoral regulator within 72 hours; processors must tell the record owner within 48 hours (Art. 63). Owners run a risk-management system (Art. 64).

  Enacted by Law No. 179 of 31.07.2025, in force six months after official publication of that law; replaced the 2008 Law on personal information (5 February 2026 reported by secondary sources, not verified on the official gazette). Primary source, checked 2026-11-12.

General VAPT and privacy readiness could serve banks and telecoms, but no local legal requirement could be verified from an official source, so nothing country-specific can be claimed.

Where the services fit: Banks and microfinance organisations; Telecom operators; Organisations processing Tajik personal data.

Not researched: see the open questions below before any enquiry.

1 further item is awaiting verification at the official source and is not shown.

Limited fit: the personal-data law requires storage in Turkmenistan and a cybersecurity law exists but could not be read, so no testing expectation can be stated. Remote delivery feasibility is unknown.

Where the services fit: State-owned banks and financial institutions; Energy and telecom operators; Organisations processing Turkmen personal data.

• Law on Information about Personal Life and its Protection No. 519-V (20 March 2017)

  Prosecutor General of Turkmenistan supervises compliance (Art. 30); the Cabinet of Ministers may create an authorised body (Art. 28)

  Personal data is stored by the operator or a third party in a database located in Turkmenistan (Art. 12(2)). Cross-border transfer applies to data held in a database in Turkmenistan and is allowed only to states that protect personal data, otherwise on listed grounds such as written consent (Art. 17).

  In force 1 July 2017 (as-enacted text; later amendments not verified). Primary source, checked 2026-11-13.

1 further item is awaiting verification at the official source and is not shown.