Data Protection Compliance in Kazakhstan

DPO appointment requirement

A legal entity that owns or operates personal data must appoint a person responsible for organising data processing (Law No. 94-V, Art. 25(2)(10)), often called a Data Protection Officer (DPO). That person must carry out internal control of compliance, inform staff of the rules, and oversee the handling of data subject requests (Art. 25(3)). Many organisations add consent management, breach response and contact with the Ministry of Artificial Intelligence and Digital Development to the role. Bond Stone advises on DPO appointment, role definition and reporting lines.

Breach notification — one working day

Effective 1 July 2024, organisations must notify the Ministry of Artificial Intelligence and Digital Development of Kazakhstan within one working day of discovering a personal data security breach (Law No. 94-V, Art. 25(2)(8)). The Law requires the notice to give the contact details of the person responsible for organising data processing, if there is one. A good notice also identifies the organisation and describes the breach, the data subjects affected, the likely consequences and the measures taken. Bond Stone advises on establishing breach detection processes and notification procedures to meet the one-working-day deadline.

Paper copies of identity documents

Law No. 94-V, Art. 7(10), introduced by Law No. 44-VIII (effective 11 February 2024), prohibits collecting and processing paper copies of identity documents. The exceptions are where there is no integration with state digital systems, where the person cannot be identified by technological means, and other cases set by law. Organisations that previously collected paper copies — including in HR onboarding, KYC processes, and customer registration — must update their data collection procedures. Bond Stone advises on transitioning document collection and verification processes to compliant alternatives.

Unscheduled inspections — defence

The Ministry of Artificial Intelligence and Digital Development is authorised to conduct unscheduled inspections of entities based on specific facts and circumstances — including data subject complaints, breach reports, and media reports. Inspections are registered with the General Prosecutor's Office Legal Statistics Committee. Bond Stone advises entities subject to inspection on: preparing documentation demonstrating compliance; managing document production during inspection; responding to inspector queries; and challenging unlawful inspection actions.

Internal compliance programme

A complete data protection compliance programme under Law No. 94-V includes: (1) data mapping — identifying all personal data processing activities; (2) lawful basis analysis — consent and the exceptions in Article 9; (3) privacy notices — employee and customer data processing notices; (4) consent management — collection, recording, and withdrawal mechanisms; (5) data processing agreements with third-party processors; (6) data subject rights procedures; (7) breach response plan; and (8) DPO function and governance. Bond Stone advises on building and implementing compliance programmes for foreign-invested entities.