The person responsible for organising processing, the processing policy and other internal documents.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
All legal entities that own or operate personal data, except courts, must appoint a responsible person. This person monitors compliance within the organisation, informs staff of the requirements and oversees how people's requests are handled. Their contact details are given in a breach notification.
Everyone needs an approved list of personal data and policy documents on processing and protection. Beyond that, by category — small operators need a list of people with access and internal procedures, medium ones also an inventory of systems, an incident response procedure, staff training and internal control, and large ones also a security assessment and an independent audit.
A European DPO is mandatory only in certain cases and must be independent and have expert knowledge. In Kazakhstan a responsible person is mandatory for all legal entities, but the law sets no requirements on qualifications or independence — the role can be combined with other work.
Note
Who must appoint a person responsible for organising personal data processing, what that person does and how the role differs from a GDPR DPO. Which internal documents an operator needs depending on its category — small, medium or large — under the 2026 version of the Protection Rules.
Note
What security measures the Law requires and how, from September 2026, they depend on the operator's category (small, medium or large by number of data subjects), plus separate rules for restricted-access data. Compared with the GDPR's risk-based approach.
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
The main secondary act on protection measures, restated in September 2026: notification, operator size categories and tiered measures, restricted-access data (incl. cryptography), local collection and storage in a server room or data centre in Kazakhstan, the responsible person, and breach notification within one working day.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsTypes of personal dataData localisationNotification and register of operatorsResponsible person and internal policiesSecurity measures