The regulator's powers, inspection procedure, inspection checklist.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
The Ministry of Artificial Intelligence and Digital Development; within it, the Information Security Committee handles this area. It drafts rules, keeps the registers of operators and breaches, considers complaints, carries out inspections and imposes penalties. Local executive bodies (akimats) have their own powers, and the prosecutor's office supervises legality overall.
Businesses are inspected only on an unscheduled basis — following a substantiated complaint, a prosecutor's demand, a state body's request or an investigator's instruction; an anonymous complaint is not a ground. Only the subject of the complaint is checked, against the inspection checklist (consent, purposes, ID copies, storage in Kazakhstan, transfers abroad, the list of data, the responsible person, protection measures). The 2024 checklist has not yet been updated for the 2026 amendments.
The regulator is not required to publish guidance, and no systematic collection of its guidance has been found — individual letters are known only from lawyers' accounts. Useful starting points are the Information Security Committee's page on gov.kz and the materials in this library.
Note
Who oversees compliance with personal data law: the regulator (the Ministry of Artificial Intelligence and Digital Development), local executive bodies and the prosecutor's office. How businesses are inspected — unscheduled inspections only, against a 33-item checklist — and how state bodies are inspected.
Note
What counts as a personal data breach and who notifies whom, and how fast: the operator reports to the regulator within one working day, cybersecurity centres within three hours, and data subjects are notified not by the operator but through e-government. Compared with the GDPR's 72 hours.
Note
What rights data subjects have under the Personal Data Law and the Digital Code, how quickly the operator must respond (from one to fifteen working days), how a request is made and where to complain. A summary table of deadlines and a comparison with the GDPR, noting the absence of data portability and a general right to object.
Note
Administrative liability under Art. 79 of the Code of Administrative Offences — fines from 30 to 2,000 MCI (in 2026, from KZT 129,750 to 8.65 million), how cases are opened and the one-year limitation period for legal entities. Criminal liability under Art. 147 of the Criminal Code and civil liability for damages. A comparison with turnover-based GDPR fines.
Note
Since 25 August 2026 large owners and operators must notify the regulator before starting and before stopping personal data processing. Who counts as large, what the notification contains, how the register works and what the law does not yet say — on a transition period, how to file and liability.
Procedure for inspecting businesses. Personal data compliance of private businesses is checked only through unscheduled inspections (Art. 27-2 of the Law) on the grounds in Art. 144(5), such as a substantiated complaint or a prosecutor's demand; anonymous complaints do not count.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceRegulator and state supervision
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
The 33-item list used in inspections; handy as a ready-made compliance checklist (consent, purposes, localisation, transfers, DPO, logs, encryption). Wording predates the 2026 amendments.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceData localisationRegulator and state supervisionSecurity measures