Since 2020, protection of personal data (PD) in Kazakhstan has seen significant strengthening at the legislative level, mainly by adapting provisions of the EU’s General Data Protection Regulation (GDPR), which we informed you about earlier¹. Overall, the amendments to Kazakhstan’s Personal Data Law and relevant by-laws have the aim of improving protections of individuals’ PD.

One key change resulting from this was the appointing of an authorized body for personal data concerns—the Ministry of Digital Development, Innovation and Aerospace Industry of Kazakhstan (the Ministry).

Among other things, The Ministry has become responsible for taking measures to hold accountable violators of personal data legislation.

Along with this, court practice regarding noncompliance of personal data protection measures has also begun to develop. As such, in 2021 a major bank was fined, and in 2022, a telecom operator. Those are the first cases since the effectiveness of PD protection legislation where companies were fined for violating requirements after coming under the Ministry’s scrutiny.

In particular, the Ministry found the following violations:

1. Companies failed to appoint a data protection officer (DPO), i.e. the person responsible for organizing the collection and processing of PD.
2. Companies failed to notify the Ministry about information security incidents that were associated with unauthorized access to PD of limited access (data breach notification).
3. Companies failed to use measures of identification and authentication for users who work with PD of limited access.

Although the amount of the fines in both cases was not large (100 monthly calculated indexes, i.e. approximately US$630), such decisions are demonstrative that the Ministry will take real steps to ensure the protection of PD. Thus, companies should approach the processing of PD protection very seriously to avoid legal and reputational risks.

Our team has prepared a package of services for clients that are aimed at ensuring protection of PD within an organization. The services provided by Dentons’ Kazakhstan office can help to mitigate the risks related to personal data processing. We start by reviewing how a business processes its PD. We can then assist in preparing the necessary documents, as well as to prepare a tailored list of recommendations to achieve full compliance of your company’s activities with the law.

We are carefully monitoring all changes in the legislation, as well as in court practice, and will inform you of all changes in a timely manner. Feel free to contact us if you have any questions about this alert.

1. Please see our previous alerts: Amendments on Personal Data Protection Issues in Kazakhstan and Kazakhstan strengthens personal data protection by gradually moving toward GDPR standards.