Responsible person and internal policies

In short

An owner or operator that is a legal entity must appoint a person responsible for organising personal data processing (Art. 25(2)(10)). That person has three duties: internal control, informing employees and overseeing data subjects’ requests (Art. 25(3)). The Law sets no requirements on qualifications, independence or registration. The set of mandatory internal documents depends on the operator’s category by number of data subjects (Art. 25-1; Protection Rules, paras 12–14).

Who appoints

• Legal entities that are owners or operators (Art. 25(2)(10)). The Protection Rules also mention third parties (para 19).
• Exception: processing of personal data in the work of the courts (Art. 25(2)).
• Sole traders and individuals: no direct obligation, since the provision refers to legal entities.

Interpretation. The wording of para 19 of the Rules (“the owner and/or operator, as well as a third party, appoint… where the owner and/or operator are legal entities”) is unclear as regards third parties, such as a processor working under a contract with the operator. It is safer to assume that a processor that is a legal entity should also appoint a responsible person.

The Protection Rules include appointing a person responsible “for organising processing and protection” of personal data in the minimum set of measures even for small operators (para 12(4)).

Duties of the responsible person

The Law and the Rules set the same list (Art. 25(3); Protection Rules, para 20):

1. internal control over compliance with personal data legislation by the owner or operator and its employees, including protection requirements;
2. informing employees of the legislation and the protection requirements;
3. overseeing the receipt and handling of requests from data subjects and their representatives.

In addition, the responsible person’s contact details are given in the notification of a security breach to the regulator (Art. 25(2)(8)).

Interpretation. The Law does not say who the responsible person must be: an employee, a manager or an external consultant. Combining the role with other positions is not prohibited either. But since the person exercises “internal” control, it makes sense to appoint an employee by order and set out the duties in the job description.

Internal documents

Mandatory for all owners and operators under the Law:

• a list of personal data necessary and sufficient for the tasks (Art. 25(2)(1); see the note “Principles of personal data processing”);
• documents setting out the policy on collection, processing and protection (Art. 25(2)(1-1)).

The rest depends on the category. Since 2026 operators are divided into small (up to 10,000 unique data subjects), medium (10,000 to 500,000) and large (500,000 or more). Processing restricted-access data moves the operator up one category (Art. 25-1).

Category	Documents and organisational measures
Small	List of data and purposes; list of persons with access; appointment of the responsible person; internal documents on collection, processing and protection (para 12)
Medium	Everything for small operators, plus an inventory of digital systems and processing operations; an incident response procedure; regular staff training; internal compliance control (para 13)
Large	Everything for medium operators, plus security assessment of systems; independent audit of protection measures (para 14)

Technical measures for each category are covered in the note “Personal data security measures”.

At the regulator’s request, when it is considering complaints, the operator must provide information on the methods and procedures it uses to comply with the Law (Art. 25(2)(3-1)).

Interpretation. Internal documents are the answer to such a request. A missing order appointing the responsible person or an unapproved policy is probably the easiest violation for an inspector to find, and it may be classified as failure to apply protection measures (Code of Administrative Offences, Art. 79(3)).

Comparison with the GDPR

Question	Kazakhstan	GDPR
Who must appoint	All legal entities that are owners or operators	Public authorities; large-scale systematic monitoring or special categories of data (Art. 37(1))
Qualifications	Not set	Professional qualities and expert knowledge (Art. 37(5))
Independence	Not set	Receives no instructions, cannot be dismissed for performing tasks, reports to the highest management (Art. 38(3))
External specialist	Not regulated	Allowed under a service contract (Art. 37(6))
Contact details	Given in breach notifications	Published and communicated to the supervisory authority (Art. 37(7))
Tasks	Internal control, informing staff, data subjects’ requests	Informing and advising, monitoring, advice on DPIAs, cooperation with the regulator (Art. 39)
Documents	List of data, policy, documents by category	Records of processing activities (Art. 30), policies (Art. 24(2))

Open questions

Open question: groups of companies. Can one person be responsible for several legal entities in a group, as the GDPR allows for a DPO?

Open question: personal liability. Is the responsible person personally liable, for example as an official under Art. 79 of the Code of Administrative Offences, if a violation occurs within their area of control?

Open question: form of the policy. There are no requirements on the content of the “documents setting out the policy”. Must the policy be published for data subjects, as is common in practice?

Still to research

• Inspection practice: which documents the regulator requests.
• Model forms of a policy and an appointment order, if the regulator has published any.
• How an operator’s category is confirmed and who determines it.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.