Who is affected
All owners and operators of databases containing personal data, as well as third parties carrying out processing, including branches and representative offices of foreign legal entities. Specifically affects companies with databases exceeding one hundred thousand records, employers, medical organizations, banks, insurance companies, retail chains, and any business maintaining client databases.
What changes
The Rules for implementing personal data protection measures are restated in a new edition. The amendments are substantive rather than editorial, introducing a one-day notification period for data security breaches, detailing technical requirements for the processing of restricted access data, and establishing the obligation to integrate with the state access control service. Concurrently, a new edition of certain provisions of the Law on Personal Data became effective on July 12, 2026.
List of changes
- The Rules are restated in a new edition
- Personal data is divided by accessibility into publicly available data and restricted access data
- The owner, operator, and third party shall identify business processes containing personal data and determine the list of persons performing collection and processing or having access thereto
- Legal entities shall appoint a person responsible for organizing the processing of personal data, with duties regarding internal control, informing employees, and supervising the handling of requests from data subjects
- Notification of the authorized body regarding a personal data security breach shall be sent within one business day from the moment of detection
- When interacting with state digital objects, integration of own digital objects with the state personal data access control service is required
- For restricted access data, a database management system event log, a user action log, integrity control tools, and transmission via secure communication channels are mandatory
- Storage and transmission of restricted access data shall be carried out using cryptographic protection tools with parameters no lower than the third security level according to ST RK 1073-2007, except for cases of cross-border transfer
- For databases containing more than one hundred thousand records, user identification or authentication tools shall be used, including biometric authentication
- Collection and processing of restricted access data shall be conducted via digital objects located on the territory of the Republic of Kazakhstan, and storage shall be in a server room or data processing center on the territory of the republic
- The State Technical Service shall be granted access to digital objects to inspect the security of storage, processing, and dissemination processes of restricted access data
Effective date
Effective from July 12, 2026
Details and status
For further details and to check the status, please contact us. This material is for information only and does not constitute legal advice.