Notification of the regulator and the register of operators

In short

Before starting and before stopping personal data processing, the owner, operator and third party notify the regulator (Art. 10-1(1)). Small and medium operators may process data without notification (Art. 10-1(2)), so in practice the duty applies only to large ones — 500,000 unique data subjects or more (Art. 25-1). Within 30 working days the information from the notification is entered in the register of persons collecting and processing personal data (Art. 10-1(4)). The rule was introduced by Law No. 326-VIII and has applied since 25 August 2026.

Who must notify

Category	Unique data subjects	Notification
Small	Up to 10,000	Not required
Medium	10,000 to 500,000	Not required
Large	500,000 or more	Mandatory

The category depends on the total number of unique data subjects in one or more digital objects, regardless of legal form or type of activity. Processing restricted-access data moves the operator up one category (Art. 25-1; Protection Rules, paras 8–10).

Interpretation. Because of the category step-up, a medium operator (10,000 subjects or more) processing restricted-access data, such as medical or biometric data, becomes large and must notify. For many clinics, banks, insurers and HR services the 500,000 threshold therefore does not really apply.

What the notification contains

The notification is submitted on paper, digitally or on another tangible medium and signed by an authorised person (Art. 10-1(3); Protection Rules, para 5). Mandatory information:

1. name and BIN (IIN) of the owner, operator or third party;
2. protection measures applied;
3. date processing starts;
4. whether data are transferred to third parties;
5. whether there is cross-border transfer;
6. whether data are disseminated in public sources;
7. list of data collected;
8. location of the database or digital object;
9. other information at the notifier’s discretion.

Interpretation. Almost all items match what should already be in the list of personal data and in consent forms (Art. 8(4)). If the list and internal documents are well maintained, the notification can be assembled from them.

The register

The regulator keeps the register of persons collecting and processing personal data (Art. 27-1(2-4); Art. 1(5-1)):

• information from a notification of the start of processing, and the date it was sent, is entered in the register within 30 working days (Art. 10-1(4));
• on a notification of the end of processing, the information is removed from the register within the same period (Art. 10-1(5)).

The Protection Rules repeat these provisions (paras 3–7). Para 6 of the Rules refers to entering “the information specified in paragraph 6 of these Rules”, so the paragraph refers to itself; the intended reference is presumably to para 5.

Liability

The Code of Administrative Offences has no separate offence for failing to notify. Art. 79 penalises unlawful collection and processing and failure to apply personal data protection measures (Code of Administrative Offences, Art. 79).

Interpretation. Notification is set out in the Protection Rules, in the chapter on how protection measures are implemented. Failure to notify is therefore likely to be classified as failure to apply protection measures (Art. 79(3)). More on fines in the note “Liability for breaches of personal data law”.

Comparison with the GDPR

Question	Kazakhstan	GDPR
General notification of the regulator	Yes, for large operators (Art. 10-1)	No: the former duty under Directive 95/46/EC was abolished
What replaced it	—	The controller’s own records of processing (Art. 30); prior consultation for high-risk processing (Art. 36)
Public register	Kept by the regulator	No general register; DPO contact details are communicated to the regulator (Art. 37(7))
Criterion	Number of unique data subjects	Risk of processing, not scale

Open questions

Open question: transition. Law No. 326-VIII sets no transition period. What should large operators that were processing data before 25 August 2026 do, given that notification is due “before processing starts” and processing is already under way?

Open question: how to file. Through which channel is the notification submitted: the e-government portal, a letter to the regulator, a dedicated service? Is the register public?

Open question: counting data subjects. Who counts: only customers, or also employees, contractors’ contact persons and website visitors? How are data subjects counted in data held by a processor?

Open question: changes. Is a new notification needed when the information changes, for example when cross-border transfer begins?

Still to research

• Regulator guidance on how to file notifications.
• Whether a public register has appeared and what it shows.
• Whether the inspection checklist will be updated to cover notification and categories.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.