In January 2021, the following changes in personal data rules were adopted.

1. Now, companies are obliged to notify the Ministry of Digital Development, Innovations and Aerospace Industry about any incidents of information security related to illegal access to personal data¹. The General Data Protection Regulation (GDPR) has an identical requirement.
2. The “localization rule” is clarified: Storage of personal data in electronic databases should be carried out in a server room on the territory of Kazakhstan².
3. A new function of the National Security Committee’s State Technical Service: inspection of personal data security. Companies are required to provide access to the Service for conducting an inspection.

Kazakhstan is undertaking a number of measures to strengthen the protection of personal data. We see that there is a gradual movement toward GDPR. As a reminder, the changes and additions of 2020 were based on the GDPR model. For example, companies starting from July 2020 need to appoint a person responsible for organizing personal data processing³. This is analogous to the “Data Protection Officer” (DPO) position that was introduced in 2018 in the European Union.

We closely monitor all changes in legislation on personal data protection. If you have any questions about this alert, please contact us.

1. The Resolution of the Government of the Republic of Kazakhstan No. 12 dated 18 January 2021 “On Introducing Amendments to Certain Resolution of the Government of the Republic of Kazakhstan” (came into force on 29 January 2021).
2. The Law of the Republic of Kazakhstan No. 399-VI dated 2 January 2021 “On Introducing Amendments to Certain Legislative Acts of the Republic of Kazakhstan on Economic Growth Restoration) (came into force on 16 January 2021).
3. Ibid.