Personal data security measures

In short

Personal data may be collected and processed only if they are protected (Art. 20(2)). The Law sets the purposes and general duties (Arts 21–22). The specific measures are in the Protection Rules, restated with effect from 21 September 2026. The main novelty: the mandatory measures depend on the operator’s category — small, medium or large — by the number of unique data subjects (Rules, paras 8–14).

What the Law says

• Purposes of protection — privacy, integrity and safety of the data, confidentiality, the right of access, prevention of unlawful processing (Art. 21).
• Duties of the owner, operator and third party — prevent unauthorised access, detect it in time, minimise its consequences, give the state technical service access to examine the protection of restricted-access data, and record actions with the data (Art. 22(1)). The duties apply from collection until destruction, deletion, anonymisation or de-identification (Art. 22(2)).
• Digital objects are protected under the Personal Data Law and digital legislation. Masking and hashing are used for protection. Copying data from critical digital objects follows a procedure agreed with the National Security Committee (Art. 23).
• Internal documents — a list of the data processed and a processing and protection policy (Art. 25(2)(1)–(2)).
• Operator categories — small (up to 10,000 unique data subjects), medium (10,000 to 500,000), large (500,000 or more). Processing restricted-access data moves an operator up one category (Art. 25-1).
• Voluntary cyber insurance is allowed; its terms are agreed by the parties (Art. 23-1).

The Cybersecurity Law repeats the duty to protect digital resources containing personal data (Art. 56) and empowers the state technical service to examine their protection (Art. 14).

Measures by category

The Rules as restated by Order No. 534/NK build the requirements as a ladder: each category does everything required of the previous one and adds its own.

Category	What is added	Where
All	Measures appropriate to the category	para 11
Small	List of data and purposes; list of persons with access; responsible person; internal documents; access rights; identification and authentication; logging of actions with data; backups; anti-malware and updates; secure transmission channels	para 12
Medium	Inventory of digital systems and processing; role-based access; multi-factor authentication for access to restricted-access data; recording cybersecurity events; incident response procedure; staff training; vulnerability analysis; internal compliance control	para 13
Large	Security assessment of systems; independent audit of protection measures; monitoring of cybersecurity events; control of privileged users and data operations; penetration testing; data recovery after breaches	para 14

Restricted-access data require a separate set of measures regardless of category (para 15): purposes of processing, a blocking procedure, alerting the regulator about incidents, information security tools, database and user activity logs, integrity control, secure transmission, cryptography of at least security level 3 under ST RK 1073-2007, identification and authentication, including biometric authentication for databases with more than 100,000 records. Such data may be collected and processed only through digital objects in Kazakhstan (para 16) and stored in a server room or data centre in Kazakhstan (para 18).

The Rules also require a responsible person where the operator is a legal entity (paras 19–20), repeat the general duties of Article 22 of the Law (para 21), and require integration with the state access control service when working with state digital objects (para 22).

Interpretation. Categories are counted by unique data subjects, and the step-up for restricted-access data can move even a small company into the “medium” category. That makes the question of which data are restricted-access a practical one: the answer determines whether multi-factor authentication, vulnerability analysis and staff training are required.

Supervision and liability

Compliance is checked against the inspection checklist. The checklist was approved in 2024 and does not reflect the categories. Failure to take protection measures is fined up to 600 MCI, and up to 2,000 MCI if it led to loss or unlawful collection or processing of data (Code on Administrative Offences, Art. 79).

Comparison with the GDPR

Question	Kazakhstan	GDPR
Approach	Prescriptive: closed lists of measures by category	Risk-based: measures “appropriate to the risk” (Art. 32)
Operator size	The category by number of data subjects changes the mandatory measures	Size is reflected through risk; certain exemptions for small organisations (Art. 30(5))
Audit	Independent audit mandatory for large operators	Not expressly required; impact assessment for high-risk processing (Art. 35)
Cryptography	Certified tools under a national standard for restricted-access data	Encryption is one example of a measure, not tied to a standard

Interpretation. A prescriptive approach is easier to check: there is a list to go through. But it does not reflect the specifics of a given processing operation, so ticking every item in the Rules does not by itself mean the risks are covered.

Open questions

Open question: which data are restricted-access? The Law defines them as data “access to which is restricted by legislation” (Art. 6). There is no separate list. Whether, for example, the IIN, medical information or salary data qualify has to be derived from other laws.

Open question: what is an “independent audit”? The Rules do not say who may perform it, to which standard or how often.

Open question: transition period. Order No. 534/NK brings the new Rules into force ten calendar days after publication and sets no separate implementation period (para 4 of the Order). How the regulator will assess compliance in the first months is unclear.

Still to research

• Whether the regulator will update the inspection checklist for the operator categories.
• The list of certified cryptographic tools and the requirements of ST RK 1073-2007.
• The rules on examination of restricted-access data protection by the state technical service.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.