The Ministry of Artificial Intelligence and Digital Development told BAQ.KZ which violations occur most frequently, what to do if personal data is found publicly available, and how data protection works after the relevant guarantee was enshrined in the Constitution.
What changed after the adoption of the new Constitution
In accordance with Article 21 of the Constitution of the Republic of Kazakhstan, adopted at the republican referendum on March 15, 2026, the right to privacy, personal and family confidentiality, as well as protection of personal data from unlawful collection, processing, storage and use, including through digital technologies, has been enshrined.
As explained by the Ministry, the protection of personal data and the confidentiality of communications is now not only a requirement of sector-specific legislation, but also a constitutional guarantee.
“This increases the level of responsibility of government bodies and organizations working with personal data and requires the right to privacy to be taken into account when developing legislation, government information systems and digital services,” the Ministry said.
At the same time, the constitutional provision does not replace special mechanisms for personal data protection, but increases the level of their legal guarantee.
Constitutional protection also extends to the digital environment – mobile applications, websites, social networks, marketplaces and other online services.
More than two thousand requests since the beginning of the year
According to the Ministry of Artificial Intelligence and Digital Development, in 2026, the Department of State Control in the Field of Personal Data Protection of the Information Security Committee received more than two thousand appeals from citizens.
Kazakhstanis most often report possible unlawful dissemination of personal data, as well as its collection and processing without an appropriate legal basis or the citizen’s consent in cases where such consent is required.
In addition, since the beginning of the year, the authorized body has received information about possible cases of personal data leaks and unlawful dissemination.
Specialists establish the source of the information, the circumstances of its dissemination, the volume of affected data and whether there are signs of a violation of legislation.
“Not every report of an alleged data leak is confirmed following an inspection. In some cases, the information may be outdated, duplicated from previously published sources, or have no confirmed connection with a specific information system,” the Ministry explained.
For confirmed cases, response measures are taken, while owners and operators are issued appropriate orders to eliminate violations and strengthen protection.
What is considered personal data
Personal data includes information that makes it possible to identify a person. This may include surname, first name and patronymic, Individual Identification Number (IIN), date of birth, residential address, telephone number and other information.
The collection, storage, use and dissemination of such data are considered unlawful if carried out without the citizen’s consent or another legal basis provided for by legislation.
“At the same time, personal data must be used only for the purposes for which it was collected and may not be transferred to third parties or made publicly available without legal grounds,” the Ministry noted.
The Ministry also added that owners and operators must determine the list of personal data that is actually necessary to perform their tasks.
“Excessive collection of data should not become standard practice,” the Ministry emphasized.
What to do if you find your IIN or phone number online
If a Kazakhstan citizen finds their personal data publicly available, the Ministry first recommends documenting the violation.
It is necessary to take screenshots of the page or message, save the link to the Internet resource, as well as the date and time when the information was discovered. If the citizen has already contacted the website owner or organization, it is advisable to save that correspondence as well.
After that, one can contact the owner of the Internet resource, the owner or operator of the personal data and demand that the unlawfully posted information be deleted.
If the data was collected or published in violation of the law, a citizen may also submit an appeal through eOtinish to the Information Security Committee of the Ministry of Artificial Intelligence and Digital Development, attaching the available evidence.
A citizen has the right to demand the deletion or destruction of their personal data if it was collected unlawfully or if there are no grounds for its further storage and processing.
It is also possible to withdraw previously provided consent to data processing.
“At the same time, an organization may continue to store the data if such an obligation is provided for by law or if there are other legal grounds for processing it,” the Ministry explained.
Who will notify about a data leak
When a personal data security breach is detected, the owner or operator is required to notify the authorized body within one business day and report on the measures taken to eliminate the violation.
After that, the authorized body sends citizens a corresponding notification through their personal account on the eGov portal or via the eGov Mobile application.
The organization responsible for the incident must simultaneously stop unauthorized access to or dissemination of the data, establish the causes and scope of the incident, eliminate the violation and minimize its possible consequences for citizens.
What are the penalties for unlawful use of data
Violation of personal data legislation may result in both administrative and criminal liability.
Administrative liability is established by Article 79 of the Code of Administrative Offenses.
If the actions contain signs of a criminal offense, liability may arise under Article 147 of the Criminal Code.
In particular, criminal liability is provided for certain cases of unlawful collection or processing of personal data, unlawful dissemination of information about private life, as well as other violations where the conditions and consequences provided for by law are present.
The specific liability is determined taking into account the nature of the violation, its consequences and circumstances.
Personal data protection to be strengthened
Following the enshrinement of the relevant guarantee at the constitutional level, a number of changes were also introduced into personal data legislation.
“In particular, the categorization of personal data owners and operators depending on the volume of information processed into small, medium and large entities, the establishment of a register of large operators, notification by large operators to the authorized body about the commencement and termination of personal data processing, as well as improvement of the procedure for notifying citizens about data security breaches are provided for,” the Ministry said.
Additional requirements for data masking and hashing, as well as restrictions on uncontrolled copying of data, have also been introduced.
Source: https://rus.baq.kz/bolee-2-tysyach-obrascheniy-s-nachala-goda-kak-v-kazahstane-zaschischayut-personalnye-dannye-320042502/