Duties after a personal data breach; deadlines for notifying the regulator and data subjects.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
Within one working day of discovery — in writing, as an electronic document or by another secure method. The report covers what happened, the measures taken, the responsible person's contact details and the affected people's data so they can be notified. There is no "if there is a risk" threshold — every breach must be reported.
The company usually does not notify the people itself — the state does. The regulator passes the information to the e-government operator, and people receive a message in their eGov account, the mobile app or by SMS.
It is a list of personal data whose security has been breached. The regulator keeps it on the basis of publicly available information and information from cybersecurity centres.
Note
What counts as a personal data breach and who notifies whom, and how fast: the operator reports to the regulator within one working day, cybersecurity centres within three hours, and data subjects are notified not by the operator but through e-government. Compared with the GDPR's 72 hours.
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
The 2026 amending package. Changes to the Personal Data Law are in Art. 1(37): "digital object" in the localisation rule, new Arts 10-1, 23-2 and 25-1, erasure and anonymisation. In force 60 days after publication (computed: 25 August 2026).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsDeletion and anonymisationData localisationNotification and register of operators
The former Informatisation Law. Relevant here: cybersecurity centres must alert the data protection regulator within three hours of a personal data breach (Arts 7-4, 7-5 etc.), subjects are informed via eGov (Art. 7-1), and personal data resources must be protected (Art. 56).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsSecurity measures
The main secondary act on protection measures, restated in September 2026: notification, operator size categories and tiered measures, restricted-access data (incl. cryptography), local collection and storage in a server room or data centre in Kazakhstan, the responsible person, and breach notification within one working day.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsTypes of personal dataData localisationNotification and register of operatorsResponsible person and internal policiesSecurity measures
How breach notification works: the owner or operator reports to the regulator within one working day (para 4), cybersecurity centres within three hours (para 5); the regulator passes the data to the e-government operator, which notifies data subjects via eGov or SMS (paras 6–7).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
Guidance on Arts 33–34 GDPR: when to notify the supervisory authority (72 hours, where there is a risk) and data subjects (high risk). Useful for contrast with Kazakhstan's one-working-day rule without a risk threshold.
Open:edpb.europa.eu (opens in a new tab)
Not checked against the sourceBreaches and notificationsKazakhstan and the GDPR