The Senate approved in the first reading the draft law, "On amendments and additions to certain legislative acts of the Republic of Kazakhstan on issues of information security, informatization, and digital assets." Please note that the draft law will now go to its second reading in the Senate and may undergo further changes and additions.

The draft law also concerns the Personal Data Law¹. Below, we present a brief overview of the most significant, in our opinion, innovations related to the protection of personal data:

1. A new concept of personal data security breach is introduced.
2. The collection and processing of paper copies of identity documents is prohibited (with some exceptions).
3. A new obligation has been imposed on owners/operators of personal data and DPOs. The moment they discover a breach of personal data security, such persons have one working day to notify the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan about the breach, indicating the contact details of the DPO (if available).
4. The draft law sets out a detailed procedure for conducting state inspections for compliance with personal data laws (in the form of periodic and unscheduled checks). The plan for periodic inspections will be available on the Ministry’s website no later than December 20 of the year preceding the year of inspections. Please note that unscheduled inspections may also be carried out in cases of complaints from data subjects that their rights have been violated. 

We are actively monitoring the status of this initiative and will keep you updated. If you have any questions, please contact us.

1. Law of the Republic of Kazakhstan dated May 21, 2013, No. 94-V "On Personal Data and their Protection"↩