💡 律咖编者按：
本文由律咖网社群读者 susan 投稿分享。
为了方便大家阅读，律咖网编辑 JingJing（微信：lvga2015）对原文进行了细致的逻辑润色与合规性整理。希望能给正在 吉尔吉斯斯坦 创业路上的你带来真实的参考。

I didn’t come to Jolpont-Ata for cybersecurity.
I came because the sandstorms in Osh were eating through my packaging. The coastal humidity in Guangdong had already ruined three batches of abrasives — the kind we grind down for nail techs in Indonesia and Vietnam. So I moved the warehouse. Not to Bishkek. Not to Batken. But to Jolpont-Ata. A quiet town by Lake Issyk-Kul. Quiet, but not simple.

I needed to register a legal entity — a branch of my Guangdong-based company — to handle local logistics, customs clearance, and compliance. The goal: reduce shipping time from 28 days to under 14. Simple in theory. In practice? The paperwork felt like assembling a clock with missing gears.

One question kept coming up:
Does your Information Security Management System (ISMS) require a notarized power of attorney (PoA) to be valid under Kyrgyzstan’s local data handling regulations?

I had no idea.

I’d read the ISO/IEC 27001:2022 guidelines. I knew how to map controls. I had the risk assessment matrix. But Kyrgyzstan doesn’t have a public, searchable database of local interpretations. No official portal. No FAQ in English. Just whispers in Telegram groups and vague responses from local accountants who say, “It depends.”

I called a lawyer in Bishkek. He said, “If you’re storing customer data — even just names and phone numbers — you’re under the Law on Personal Data Protection. That law says you must have a local representative. But whether that representative needs a PoA for ISMS compliance? I don’t know. I’ve never seen a case where someone was audited for this.”

That’s the information asymmetry I lived with for six weeks.

I had the system. I had the processes. But I didn’t have the context. And in Jolpont-Ata, context is everything. The local tax office doesn’t have an email address. The Ministry of Digital Development doesn’t reply to inquiries. I sent a letter via registered post — three weeks later, it came back stamped “Returned. Addressee Not Found.”

I spent two days at the regional registration office in Jolpont-Ata, watching a clerk manually stamp forms. He didn’t have a computer. He used a rubber stamp with a date that was three days behind. I asked about ISMS. He shrugged and said, “We don’t check that. Only if you’re a bank.”

So I asked again: “But if I’m handling payment data from my customers — even just to ship their orders — do I need a PoA to appoint someone locally to manage access logs?”

He looked at me like I was asking whether the lake was salty. “You can do whatever you want,” he said. “No one will stop you. But if someone complains? Then you’ll have to explain. And no one here knows what ISMS is.”

That’s when I realized:
I was optimizing for a system that didn’t yet exist here.

My time wasn’t being spent on compliance. It was being spent on translation — translating ISO standards into a place where the concept of “data controller” is still foreign. And every hour I spent on this was an hour I wasn’t shipping product.

I thought I was building infrastructure.
I was actually building a bridge with no map.

📌 FAQ

Q1: Does Kyrgyzstan legally require a Power of Attorney (PoA) for a foreign company to implement an Information Security Management System (ISMS) in Jolpont-Ata?

Steps & Pathway:

  1. Confirm your entity is registered with the State Registration Service (Государственная служба регистрации) in Jolpont-Ata.
  2. Determine whether your operations involve processing personal data — even minimally (e.g., customer names, phone numbers, delivery addresses).
  3. Consult the Law on Personal Data Protection (No. 120, 2017), which requires a local representative if data is processed within Kyrgyzstan.
  4. While the law does not explicitly mention ISMS or PoA for ISMS, local practice suggests a PoA may be requested by auditors or regulators if you are handling sensitive data.
  5. Key points:
    • No public checklist exists.
    • PoA is typically required for legal representation, not technical compliance.
    • ISMS documentation alone is not sufficient to satisfy local expectations — you must show local accountability.
    • If you have no local staff, a PoA to a trusted accountant or legal agent is often used as a formality.

Q2: Can I use my existing ISO 27001 certification to satisfy local requirements?

Steps & Pathway:

  1. ISO 27001 is not recognized as a legal compliance standard by Kyrgyz authorities.
  2. Submit your ISMS documentation (policies, risk register, access logs) to the local tax inspectorate in Russian as part of your annual reporting.
  3. Include a signed declaration: “We maintain an ISMS per ISO/IEC 27001:2022 for internal control purposes.”
  4. Key points:
    • Do not claim “compliance” with Kyrgyz law — say “internal practice.”
    • Translation must be certified by a local notary.
    • Some inspectors have asked for a PoA to be shown alongside ISMS documents — not because it’s required, but because they want to know who is responsible locally.

Q3: Where can I find official guidance on ISMS and data handling in Kyrgyzstan?

Steps & Pathway:

  1. Visit the official website of the Ministry of Digital Development (https://www.mdd.gov.kg) — but expect it to be mostly in Kyrgyz and outdated.
  2. Contact the State Commission for Information Security (Госкоминформбезопасность) via email: info@mdd.gov.kg. Responses may take 4–8 weeks.
  3. Request a copy of the “Guidelines on Personal Data Processing for SMEs” (2023 draft), which circulates internally but is not published.
  4. Key points:
    • No official English version exists.
    • The draft suggests “the legal representative must be physically present in Kyrgyzstan” — which implies PoA is practical, even if not codified.
    • Local law firms in Bishkek (e.g., “Lex Kyrgyzstan”) have copies of internal draft interpretations — but they won’t share them without a client engagement.

I used to think efficiency was about logistics.
Now I know it’s about visibility.

I spent $1,200 on a notarized PoA for my local accountant — not because I was told to, but because I needed someone to stand in front of the tax office when they asked, “Who’s responsible for this?”

I didn’t need the document to comply with ISO.
I needed it to comply with human doubt.

I’m not proud of it.
I wish I’d known this earlier.
I wish I’d talked to someone who’d been here before.

Instead, I read a Reuters article about a former security chief being charged with a coup plot — and realized: in a country where power shifts quietly, the real compliance isn’t in the policy.
It’s in who you know, and who you’re willing to let speak for you.

✅ Actionable Steps (Non-Guaranteed)

  1. Register your entity locally — even if you’re only storing minimal data. A branch office gives you legitimacy, even if you’re not physically present.
  2. Appoint a local contact — even if just an accountant. Their name on a PoA reduces friction.
  3. Translate your ISMS documents into Russian — and keep them in a physical binder. No one will audit them, but if asked, you’ll look prepared.
  4. Never say “we comply with Kyrgyz law” — say “we maintain internal controls aligned with international standards.”

I’m not here to sell you a solution.
I’m here to say: if you’re in Jolpont-Ata, or anywhere in Kyrgyzstan trying to make sense of ISMS, data, or paperwork — you’re not alone.

I reached out to JingJing a few weeks ago. We talked for 47 minutes. She didn’t fix my problem.
But she pointed me to a forum where a German entrepreneur in Osh had asked the same question.
And that’s how I found the local accountant who eventually stamped the PoA.

Sometimes, the most valuable thing you get from a platform like this isn’t an answer.
It’s knowing someone else has stood in the same silence.

If you’re working through something similar — whether it’s data, visas, or shipping delays —
you can find me in the Lvga.com Cross-Border Entrepreneur Group.
We don’t promise results.
We just share what we’ve learned — slowly, honestly, without hype.

And if you want to talk about Kyrgyzstan, Jolpont-Ata, or whether you need a PoA for an ISMS —
JingJing is on WeChat: lvga2015.
She doesn’t offer services.
She just listens.

🔸 延伸阅读

🔹 Kyrgyzstan charges ousted ex-security boss with coup plot, lawyer says 🗞️ 来源: thestar_my – 📅 2026-05-13
🔗 阅读原文

🔹 Kyrgyzstan Charges Ousted Ex-Security Boss With Coup Plot, Lawyer Says 🗞️ 来源: usnews – 📅 2026-05-12
🔗 阅读原文

🔹 From diplomacy to investment, Kyrgyzstan broadens its UAE ties 🗞️ 来源: gulfnews – 📅 2026-05-12
🔗 阅读原文

📌 免责声明：
请知悉：律咖网（Lvga.com）是跨境创业公开信息与内容分享平台，不提供法律、税务、会计或合规服务。
本文内容基于公开资料，并由人工编辑与 AI 工具协助整理，仅供信息参考之用，不构成任何法律、投资、移民或商业决策建议。
政策可能随时间变化，请以官方渠道与当地持牌专业人士意见为准。
如内容有需要修订之处，欢迎随时与我联系。