The regulator and state oversight

In short

The Government develops state policy on personal data (Art. 26). The regulator is the central executive body in charge of the field (Art. 1(11-1)); currently this is the Ministry of Artificial Intelligence and Digital Development. Private businesses are checked only through unscheduled inspections under the Entrepreneurial Code (Art. 27-2). The prosecutor’s office exercises the highest supervision over legality (Art. 28).

Who does what

Body	Role	Provision
Government	Main directions of state policy	Art. 26
Regulator (Ministry of AI and Digital Development)	Policy, rules, oversight, registers, complaints, liability	Art. 27-1
Local executive bodies of regions, cities of national significance and the capital	Data subjects’ complaints, oversight of private businesses in their territory, liability	Art. 27(2)
Other state bodies	Regulations, complaints and liability within their remit	Art. 27(1)
Prosecutor’s office	Highest supervision over legality	Art. 28

Within the Ministry, personal data functions are performed by the Information Security Committee, which includes a department for developing personal data protection (according to the Committee’s page on gov.kz).

The regulator’s powers

The main powers (Art. 27-1(1)):

• rule-making: rules on collection and processing, the procedure for protection measures, rules on determining the list of data, rules on the state service and integration with it;
• oversight: state control over compliance with the legislation;
• registers: the register of persons collecting and processing data (see the note “Notification of the regulator and the register of operators”) and the register of security breaches (Art. 23-2);
• data subject rights: considering complaints about whether data and processing methods match the purposes; demanding rectification, blocking, destruction or deletion of inaccurate or unlawfully obtained data;
• liability: measures to hold violators liable. Cases under Art. 79 of the Code of Administrative Offences are heard by the authorised body for cybersecurity (Code of Administrative Offences, Art. 692-2);
• other: approving integration of non-state digital objects with state ones, an advisory council.

To implement the 2026 amendments, the Ministry’s regulations were extended with new functions (Government Resolution No. 853 of 28.09.2026). The Ministry approves rules on applying masking and hashing methods, and rules on copying (exporting) personal data from critical digital objects to storage media, in agreement with the National Security Committee. It keeps the register of persons collecting and processing personal data and the register of personal data security breaches. It forwards information about security breaches that put data subjects’ rights and legitimate interests at risk to the “e-government” operator.

Inspections of businesses

Private businesses are checked through unscheduled inspections under the Entrepreneurial Code (Art. 27-2). There are no scheduled inspections in this field. Grounds for an unscheduled inspection (Entrepreneurial Code, Art. 144(5)) include, in particular:

• complaints from individuals and legal entities about violations, where there are convincing grounds and supporting evidence;
• a prosecutor’s demand;
• complaints from state bodies about specific instances of harm;
• an instruction from a criminal prosecution body;
• checking that previously identified violations have been remedied.

Anonymous complaints are not a ground (Art. 144(6)). Only the facts that gave rise to the inspection are checked (Art. 144(7)).

The requirements checked are listed in a 33-item inspection checklist (a 2024 joint order adopted under Art. 143 of the Entrepreneurial Code). They include:

• consent and purposes of processing;
• the ban on paper copies of identity documents;
• localisation;
• cross-border transfer;
• the list of data and the policy;
• the responsible person;
• protection measures for restricted-access data.

Interpretation. The checklist was adopted in March 2024 and has not been changed since. It does not reflect the 2026 amendments: operator categories, notification, the new Protection Rules 534/NK. It is unclear how inspectors will assess compliance with duties not on the list.

Inspections of state bodies

For state bodies the procedure is set by the Law itself (Art. 27-3):

• periodic inspections: no more than once a year under a plan approved by 1 December and published by 20 December of the preceding year;
• unscheduled inspections: on confirmed complaints, a prosecutor’s demand, complaints from state bodies, an instruction from a criminal prosecution body, or to check that an inspection report has been acted on;
• inspectors’ powers: access to premises, documents and databases, audio, photo and video recording, involving specialists and experts.

Regulator guidance

The Law does not require the regulator to publish guidance. Citizens’ complaints are handled under the Administrative Procedure Code; see the note “Data subject rights”.

Comparison with the GDPR

Question	Kazakhstan	GDPR
Regulator’s status	A ministry (central executive body)	Independent supervisory authority (Art. 52)
Inspections of businesses	Unscheduled only, on Entrepreneurial Code grounds and against a checklist	Investigations, audits, access to premises and data (Art. 58(1))
Sanctions	Fines under the Code of Administrative Offences	Administrative fines imposed by the regulator itself (Art. 83)
Guidance	Not an obligation	EDPB guidelines, consultations (Art. 57, Art. 70)

Open questions

Open question: the Ministry and akimats. How is oversight of private businesses divided between the regulator and local executive bodies?

Open question: two “authorised bodies”. The Personal Data Law refers to the authorised body for personal data protection, while the Code of Administrative Offences assigns Art. 79 cases to the authorised body for cybersecurity. Are they the same agency in practice?

Open question: moratorium. Do Government decisions suspending inspections of small businesses (Art. 144(12) of the Entrepreneurial Code) apply to inspections in this field?

Still to research

• The regulations of the Information Security Committee and its personal data functions.
• Published regulator guidance and responses (including the Committee’s letter of 6 May 2024 on localisation).
• Reports on inspections and their results.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.