Legal, organisational and technical safeguards; requirements for restricted-access data.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
All operators protect data against unauthorised access, detect breaches in time and limit their consequences, and the specific set of measures depends on the operator's category. Restricted-access data have their own mandatory set — defined processing purposes, a blocking procedure, event and user activity logs, integrity control, encryption in storage and transfer, authentication, and processing through systems in Kazakhstan.
Restricted-access data are stored and transferred using certified cryptographic protection of at least level 3 under the Kazakhstan standard (except for cross-border transfer). For such data, database event logs and user activity logs are kept; databases of more than 100,000 records require user identification and authentication, including biometric.
Small operators (up to 10,000 people) — a list of data and purposes, a list of people with access, a responsible person, internal documents, access control, logging, backups, anti-malware protection and secure channels. Medium (up to 500,000) — plus an inventory of systems, role-based access, multi-factor authentication, an incident response procedure, staff training, vulnerability analysis and internal control. Large — plus security assessment, independent audit, monitoring, control of privileged users, penetration testing and recovery after breaches.
Note
What counts as a personal data breach and who notifies whom, and how fast: the operator reports to the regulator within one working day, cybersecurity centres within three hours, and data subjects are notified not by the operator but through e-government. Compared with the GDPR's 72 hours.
Note
Kazakhstan law splits data not into "ordinary" and "special" as the GDPR does, but into publicly available and restricted-access. There is no list of restricted-access data: it has to be assembled from other laws on medical secrecy, fingerprint and genomic registration and access to information. The answer drives security measures, place of processing and the operator's category.
Note
Administrative liability under Art. 79 of the Code of Administrative Offences — fines from 30 to 2,000 MCI (in 2026, from KZT 129,750 to 8.65 million), how cases are opened and the one-year limitation period for legal entities. Criminal liability under Art. 147 of the Criminal Code and civil liability for damages. A comparison with turnover-based GDPR fines.
Note
Since 25 August 2026 large owners and operators must notify the regulator before starting and before stopping personal data processing. Who counts as large, what the notification contains, how the register works and what the law does not yet say — on a transition period, how to file and liability.
Note
Who must appoint a person responsible for organising personal data processing, what that person does and how the role differs from a GDPR DPO. Which internal documents an operator needs depending on its category — small, medium or large — under the 2026 version of the Protection Rules.
Note
The special regime for personal medical data under the Health Code: medical confidentiality and when it may be lifted, the electronic health passport, who may access patient data and when, and Ministry of Health rules on consent, patient notification and storage in Kazakhstan.
Note
What security measures the Law requires and how, from September 2026, they depend on the operator's category (small, medium or large by number of data subjects), plus separate rules for restricted-access data. Compared with the GDPR's risk-based approach.
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
The former Informatisation Law. Relevant here: cybersecurity centres must alert the data protection regulator within three hours of a personal data breach (Arts 7-4, 7-5 etc.), subjects are informed via eGov (Art. 7-1), and personal data resources must be protected (Art. 56).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsSecurity measures
The main secondary act on protection measures, restated in September 2026: notification, operator size categories and tiered measures, restricted-access data (incl. cryptography), local collection and storage in a server room or data centre in Kazakhstan, the responsible person, and breach notification within one working day.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsTypes of personal dataData localisationNotification and register of operatorsResponsible person and internal policiesSecurity measures
The 33-item list used in inspections; handy as a ready-made compliance checklist (consent, purposes, localisation, transfers, DPO, logs, encryption). Wording predates the 2026 amendments.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceData localisationRegulator and state supervisionSecurity measures