Recent changes related to personal data protection show that Kazakhstan strives to be a part of jurisdictions that recognize the importance of the development of the legal framework for the protection of personal data and that are actively adopting the basic principles set out in the EU’s GDPR.

Throughout 2020, Dentons’ Kazakhstan team regularly informed its clients about changes and amendments that were adopted to enhance the legislation on personal data. The analysis of these changes clearly indicates that Kazakhstan’s aim is to strengthen personal data legislation by gradually moving towards GDPR standards.

In this digest, we summarize the most important changes¹ Kazakhstan has made.

• Data Protection Authority. Kazakhstan has officially appointed the Ministry of Digital Development, Innovations and Aerospace Industry as the DPA. The ministry is now authorized to examine data subjects’ appeals and inspect organizations for compliance with the Data Protection Law.
• Data protection officers. Now companies are obliged to appoint a DPO who should ensure internal compliance with the Data Protection Law.
• Data breach notification. Similar to the GDPR, Kazakhstani companies have to notify the DPA about incidents of information security associated with illegal (unauthorized) access to personal data.
• Data protection impact assessment. The law now requires companies to conduct an analysis on the purposes of data collection and processing prior to such activities. The list of purposes should be composed based on this analysis, and it is prohibited to collect or process data that is not included in the list.
• Strengthening of data subjects’ rights. All changes prioritize the further empowerment of data subjects. Individuals are now entitled to demand the destruction of false personal data or the amendment of imprecise data. In addition, they are given effective measures to protect their rights without going to court: the ability to appeal to the DPA on issues of companies’ compliance with the established procedures of data collection and processing.

The GDPR is having an influence on personal data protection in Kazakhstan. We believe that the legislators will continue to implement the GDPR principles in the future.

1. Please refer to the hyperlinks in the text of this digest to review our recent alerts.