Liability for breaches of personal data law

In short

The Personal Data Law refers to liability “in accordance with the laws” (Art. 29). The main offence is Art. 79 of the Code of Administrative Offences: four parts, with fines from 30 to 2,000 MCI. Criminal liability arises under Art. 147 of the Criminal Code where substantial harm is caused. The data subject may claim compensation for non-pecuniary and pecuniary damage (Art. 24(1)(7)).

Administrative liability: Art. 79 of the Code of Administrative Offences

Fines were increased by Law No. 155-VIII of 10 January 2025. Amounts in tenge use the 2026 monthly calculation index (MCI) of KZT 4,325.

Part	Offence	Individuals	Officials, small business, NPOs	Medium business	Large business
1	Unlawful collection and/or processing	30 MCI (KZT 129,750)	60 MCI (KZT 259,500)	100 MCI (KZT 432,500)	200 MCI (KZT 865,000)
2	The same, abusing one’s official position	100 MCI (KZT 432,500)	200 MCI (KZT 865,000)	300 MCI (KZT 1,297,500)	600 MCI (KZT 2,595,000)
3	Failure to apply protection measures	150 MCI (KZT 648,750)	300 MCI (KZT 1,297,500)	450 MCI (KZT 1,946,250)	600 MCI (KZT 2,595,000)
4	Failure to apply protection measures resulting in loss, unlawful collection or processing	200 MCI (KZT 865,000)	750 MCI (KZT 3,243,750)	1,000 MCI (KZT 4,325,000)	2,000 MCI (KZT 8,650,000)

All parts apply only where the act does not constitute a criminal offence.

Interpretation. “Small, medium and large business” in Art. 79 are business categories under the Entrepreneurial Code (by headcount and income). They do not match the operator categories based on the number of data subjects (Art. 25-1 of the Law). A company may be a small business for fine purposes and a large operator for notification and protection measures.

Key features

• Part 1 only on the victim’s complaint. Cases under Part 1 are opened only on the victim’s complaint and are closed if the parties reconcile (Code of Administrative Offences, Art. 64(1)).
• Limitation period. A legal entity (or sole trader) cannot be held liable after one year from the offence, and in any case no later than two months after it is discovered (Code of Administrative Offences, Art. 62(2)). For individuals the general two-month period applies (Art. 62(1)).
• Who decides. The authorised body for cybersecurity (Code of Administrative Offences, Art. 692-2).

Interpretation. Part 3 (“failure to apply protection measures”) is the broadest. It probably covers not only technical measures but also the organisational requirements of the Protection Rules: the list of data, the responsible person, internal documents, breach notification and notification of the start of processing.

Criminal liability: Art. 147 of the Criminal Code

Part	Act	Maximum penalty
1	Failure to apply protection measures by a person obliged to do so, causing substantial harm	Fine of up to 3,000 MCI or imprisonment of up to 2 years
2	Unlawful gathering of information on private life (personal or family secrets), or substantial harm from unlawful collection and processing of other personal data	Fine of up to 5,000 MCI or imprisonment of up to 3 years
3	Acts under Part 2 committed by abusing an official position, using special equipment, through unlawful access to information systems, or for gain	Imprisonment of up to 5 years
4	Dissemination of information on private life, or substantial harm from unlawful dissemination of other personal data	Imprisonment of 3 to 6 years
5	Acts under Part 4 committed publicly, in the media, telecommunications networks or online platforms	Imprisonment of 3 to 7 years

Source: Criminal Code, Art. 147.

Interpretation. The line between Art. 79 of the Code of Administrative Offences and Art. 147 of the Criminal Code is “substantial harm to rights and legitimate interests”. The law does not define it, so it is decided case by case. A breach affecting many people may lead to a criminal case against the official responsible for protection measures.

Other consequences

• Compensation. The data subject may claim compensation for non-pecuniary and pecuniary damage (Art. 24(1)(7)); disputes are resolved in the manner established by law (Art. 30).
• Regulator’s demands. The regulator may demand rectification, blocking, destruction or deletion of inaccurate or unlawfully obtained data (Art. 27-1(5)).
• Deletion. Data collected without consent and without a legal ground must be destroyed or deleted (Art. 18(3-1)).

Comparison with the GDPR

Question	Kazakhstan	GDPR
Maximum fine	2,000 MCI (KZT 8.65 million)	EUR 20 million or 4% of worldwide turnover (Art. 83(5))
Link to company size	Fixed amounts by business category	Percentage of turnover
Who imposes	The authorised body, under the Code of Administrative Offences	Supervisory authority (Art. 58(2)(i))
Criminal liability	Yes, Art. 147 of the Criminal Code	Left to Member States (Art. 84)
Compensation to the data subject	Non-pecuniary and pecuniary damage (Art. 24)	Material and non-material damage (Art. 82)

Interpretation. Even the maximum fine in Kazakhstan is orders of magnitude below the GDPR maximum. For large businesses the main risks are therefore not administrative fines but criminal liability of officials, claims by data subjects and reputational damage.

Open questions

Open question: practice. How many Art. 79 cases are heard each year, and under which parts? No public statistics could be found.

Open question: “substantial harm”. How do courts assess substantial harm under Art. 147 of the Criminal Code in data breach cases?

Open question: multiple offences. Is a single fine imposed for a breach affecting millions of data subjects, or can separate offences be charged for each episode?

Still to research

• Case law under Art. 79 of the Code of Administrative Offences and Art. 147 of the Criminal Code.
• Statistics of the Committee on Legal Statistics and Special Records.
• Practice on awarding non-pecuniary damages for personal data violations.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.