Kazakhstan strengthens personal data regulation

Automated processing

The Law establishes a separate regime for the automated processing of personal data where such processing results in the creation, modification or termination of the rights or legitimate interests of the data subject.

Such processing is permitted with the consent of the data subject or in cases expressly provided for by law. At the same time, the data subject is entitled to obtain information on the processing procedure and its possible consequences and to object to such processing. The owner, operator or third party must consider the objection within the prescribed period.

Use of data from publicly accessible sources

The placement of personal data by the data subject in a publicly accessible source does not in itself constitute unconditional consent to its subsequent collection, dissemination or other processing.

The Law also requires owners, operators and third parties to mask information whose dissemination is restricted by law. At the same time, any subsequent use of information from publicly accessible sources must comply with the statutory requirements governing the lawfulness of processing.

Thus, the public availability of information does not exclude it from the personal data protection regime.

New state registers

The amendments provide for two separate registers.

1. The Register of Personal Data Security Breaches is maintained by the authorised body on the basis of information from publicly accessible sources and from entities of the state cybersecurity system.
2. The Register of Persons Collecting and/or Processing Personal Data is maintained on the basis of notifications. For registration purposes, owners, operators and third parties are classified according to the volume of data processed.

The category is determined based on the number of unique data subjects:

• fewer than 10,000 – small;
• from 10,000 to fewer than 500,000 – medium;
• 500,000 or more – large.

The Law establishes separate requirements for notifying the authorised body, taking into account the assigned category and the exceptions provided for by law.

Important caveat: where restricted-access personal data are processed — in particular, biometric data and health information — the category is increased by one level. A database covering 8,000 data subjects formally falls within the small category; however, if it contains biometric data, the operator moves into the medium category.

Both the notification obligation and the scope of data protection requirements established by the authorised body depend on the category.

New requirements for data processing and protection

From 25 August, the Law has been supplemented with definitions including automated processing, anonymisation, masking, hashing and personal data security breach. This creates a more detailed regulatory framework for governing the personal data lifecycle and responding to security incidents.

Stricter liability

The amendments also increase administrative liability for violations in the field of personal data and cybersecurity. Depending on the nature of the offence and the status of the offender, the fine for certain violations of personal data legislation may reach 2,000 MCI, while violations of cybersecurity requirements may result in fines of up to 1,000 MCI.

Changes that entered into force earlier

Certain elements of the reform took effect before 25 August 2026. In particular, from 11 July 2026, an updated definition of personal data based on the use of identifiers has applied. These include full name, IIN, facial image, facial biometric vector and its derivatives.

Taken together, the July and August amendments significantly expand the regulation of personal data processing in Kazakhstan, establishing more detailed rules for automated processing, the use of publicly available information, state oversight and personal data security.