Issue 1
Digest for 12–18 October 2026
The Ministry of AI and Digital Development has been tasked with approving masking and hashing rules and keeping the registers of operators and breaches. A standard on AI in schools bans automated grading and requires anonymisation. After a Yandex outage, MPs asked for checks on cross-border transfers; the Credit Bureau Law changes on 21 October.
- Act now adopted rules and deadlines within 90 days
- Worth noting drafts, guidance, practice
- On the horizon plans and initiatives
Summary
- Period12–18 October 2026
- found3 acts adopted, 1 draft, 2 practice developments
- next deadline21 October 2026 — amendments to the Credit Bureau Law (No. 352-VIII)
The main development: the regulator has been given powers for which new rules are now being prepared — masking and hashing of personal data, exporting data from critical systems, a register of operators and a register of breaches. Three days after the period, on 21 October, amendments to the Credit Bureau Law take effect; they are mostly terminological.
- A standard on the use of AI in schools has been approved: decisions on grades and discipline may not be automated, and materials must be anonymised before being uploaded to external AI services.
- After an outage of Yandex services on 11 October, an MPs’ inquiry asked for checks on whether Kazakhstanis’ data was transferred abroad and on how schools publish data about staff and children.
- The Ministry is checking reports of a possible leak of customer data from Kinopark, Lucem Medical Clinic and inDrive.
- The Ministry of Labour closed consultation on a draft on consent to collecting data, including bank secrecy, for means-tested social support from 2027.
Adopted and in force
The regulator will approve masking and hashing rules and keep the registers of operators and breaches
A Government resolution added to the regulations of the Ministry of Artificial Intelligence and Digital Development the powers needed to apply the 2026 amendments to the Personal Data Law. The Ministry now approves rules on applying masking and hashing methods, and rules on copying (exporting) personal data from critical digital objects to storage media, in agreement with the National Security Committee. It keeps the register of persons collecting and processing personal data and the register of personal data security breaches. It forwards information about breaches that put people’s rights at risk to the “e-government” operator, which notifies the people affected. The Ministry may require an owner, operator or third party to correct, block, destroy or delete inaccurate or unlawfully obtained data. The masking and export rules themselves do not exist yet: the resolution only establishes who will approve them.
- Who is affected
- operators that publish data in open sources (masking), owners of critical digital objects (export), large operators (register).
- What to do
- for now, watch for draft rules on the Open Legal Acts portal.
AI in schools: no automated grading, only anonymised data
An order of the acting Minister of Education approved a standard on the use of artificial intelligence for all secondary schools. Decisions on grading, educational and disciplinary measures and other decisions directly affecting a pupil’s rights may not be made automatically: a member of school staff makes them (para 4). Teachers may use AI to analyse work and prepare feedback, but they give the final grade themselves (para 11). Learning materials are anonymised before being passed to external AI tools, unless the law provides for processing of personal data by that tool (para 5). Pupils’ accounts are created taking into account the service’s age limits; the consent of a legal representative is required where the law so provides (para 6). A pupil may not be required to hand over their full history of AI prompts unless it is relevant to the purpose of the task (para 8), and an AI detector result alone does not prove a breach (para 14). The standard sets no retention periods or deletion rules: the general rules of the Personal Data Law apply.
- Who is affected
- schools and colleges, developers of educational AI services.
- What to do
- schools should check what pupil data goes to external services and remove automated grading; developers should support anonymised materials and teacher involvement in decisions.
CIS protocol: information on transport crime to be exchanged subject to data protection laws
The Government approved signing a protocol amending the 2004 Agreement of CIS member states on cooperation in combating transport crime. Under the new wording, the parties exchange information on transport crime and the persons involved subject to national personal data protection legislation.
- Who is affected
- law enforcement; no direct obligations for business.
- What to do
- nothing.
Coming into force soon
21 October: amendments to the Credit Bureau Law, mostly terminological
Law No. 352-VIII on improving and digitalising the financial market makes mostly terminological amendments to the Law on Credit Bureaus and Credit Histories. “Information systems” become “digital systems” in the definitions of the credit history database and the applicant, in the principles, the requirements for bureaus and the regulator’s powers (Arts 1, 3, 8, 10, 17, 19). Information security requirements are specified as information security requirements in the financial sector, including cybersecurity (Arts 5, 17, 19, 27). The rules on the data subject’s consent to passing information to the bureau (Art. 25) and on the subject’s rights — to receive their own report, dispute and correct information (Art. 22) — do not change. In the Digital Code, the same law restates Art. 95(2) (the digital development index methodology) and deletes Art. 95(3); this does not concern personal data.
- Who is affected
- credit bureaus, banks and microfinance organisations as information providers and report recipients.
- What to do
- update the terminology in internal documents; the substance of the obligations does not change.
In preparation
Consent to collecting data, including bank secrecy, for means-tested social support
The Ministry of Labour and Social Protection has prepared a draft order on the timing and procedure of consent to the collection, processing, verification, updating and transfer of personal data. Consent will be given by individuals (families), family members and households applying for, receiving or re-applying for social protection measures. It covers information constituting bank and other legally protected secrecy, as well as data from the state-owned credit bureau on loan debt, monthly payments, overdue and outstanding loan balances. The aim is to grant social protection on a means-tested basis from 1 January 2027; the draft implements Art. 10 of the Social Code. Only a summary has been published on the portal, not the text of the order.
- Who is affected
- applicants for and recipients of social support; banks and the credit bureau as sources of information.
- What to do
- watch for the adoption of the order and its final text.
No other drafts on personal data published or under consultation during the period were found on the Open Legal Acts portal.
News and practice
After a Yandex outage, MPs ask for checks on cross-border data transfers
On 14 October, an MP’s inquiry from the Adilet party group was sent to the Prosecutor General and the Minister of Artificial Intelligence and Digital Development. It was prompted by an outage of Yandex services on 11 October, which the company attributed to problems with its infrastructure abroad. The inquiry proposes checking the lawfulness of cross-border transfers of Kazakhstanis’ personal data, data collection by social institutions and their contractors, and compliance with the masking requirements. According to the inquiry, the Ministry said that the servers holding Kazakhstani users’ personal data are located in the country, but some components of the taxi and delivery services are hosted abroad. The inquiry also cites cases of data being published: seven schools in Shieli district posted data on 529 employees on the public procurement portal, and data on 344 minors was published in Semey. The outage alone does not prove a leak; there were no replies from the prosecutor’s office or the Ministry at the time of the issue.
- Who is affected
- operators of services that rely on infrastructure abroad; schools and other organisations publishing documents containing personal data.
- What to do
- check what data is transferred where when the service runs, and whether personal data ends up in published documents.
- 15 October. According to zakon.kz, a Telegram channel received materials about a possible leak of customer data from the Kinopark cinema chain, Lucem Medical Clinic and the inDrive service. The Ministry of Artificial Intelligence and Digital Development has taken the information under review and is checking these organisations; no conclusions had been reached at the time of the issue. The leak has not been officially confirmed.
On the horizon
- On 19 October, after the period, a draft order on a pilot project for biometric authentication of passengers using AI at Astana airport was published on the Open Legal Acts portal; consultation runs until 04.11.2026. Details in the next issue.
What it means
- Servers in the country are not the whole of localisation. The law requires personal data to be stored in a database located in Kazakhstan and allows transfers abroad only under the conditions of Art. 16. If part of a service runs on infrastructure abroad, it is worth knowing whether personal data passes through it: that is already a question of cross-border transfer. Interpretation. See the notes “Personal data localisation in Kazakhstan” and “Cross-border transfers of personal data”.
- Masking is becoming a verifiable requirement. The masking and hashing rules have not been approved yet, but MPs are already asking for checks on compliance. Organisations that publish documents (procurement, reports, school websites) should remove unnecessary personal data from them in advance. Interpretation. See the note “Deletion, destruction, de-identification and anonymisation”.
- The school standard is stricter than the general rule. The Law prohibits automated processing that changes a person’s rights without consent or an express legal provision (Art. 19-1), while the standard always requires a member of school staff to take grading decisions, with no consent exception. Interpretation. See the note “Automated processing and artificial intelligence”.
- Checks following leak reports are a reason to make sure you can notify the regulator within one working day of discovering a breach. See the note “Personal data breaches and notification”.
Calendar
| Date | Event | Status |
|---|---|---|
| 21.10.2026 | Amendments to the Credit Bureau Law (Law No. 352-VIII) | in 3 days |
| 04.11.2026 | End of consultation on the draft biometric passenger authentication pilot at Astana airport | in 17 days |
| 01.01.2027 | Means-tested social support with consent to data collection, including bank secrecy (draft Ministry of Labour order) | draft |
| to be confirmed | Part of the amendments made by Law No. 311-VIII (anti-corruption) to the Personal Data Law; per prg.kz from 01.01.2027, not checked against Adilet | date to be confirmed |
| to be confirmed | Rules on applying masking and hashing methods (approved by the Ministry) | planned |
| to be confirmed | Rules on exporting personal data from critical digital objects (agreed with the National Security Committee) | planned |
Sources
- Government Resolution No. 853 of 28.09.2026 — Adilet
- Government Resolution No. 904 of 15.10.2026 — Adilet
- Order of the acting Minister of Education No. 283-NK of 28.09.2026 approving the Standard on the use of artificial intelligence in secondary education — Adilet
- Law No. 352-VIII of 23.07.2026 — Adilet
- Law on Credit Bureaus and Credit Histories — Adilet
- Draft Ministry of Labour order on consent to data collection for social protection — Open Legal Acts portal
- Kursiv, 14.10.2026: MP’s inquiry after the Yandex outage
- Liter.kz, 14.10.2026
- Tengrinews: MP’s inquiry to the Prosecutor General
- zakon.kz, 15.10.2026: checks of three organisations
Resources checked
| Resource | Status | What was found |
|---|---|---|
| adilet.zan.kz (script run, 24.10) | ✅ opened | 25 acts where personal data is a notable topic; selected: No. 853, No. 904, the AI standard for schools; the rest are public service standards with a standard consent clause |
| adilet.zan.kz (25–26.10) | ⚠️ unavailable on 25.10, opened on 26.10 | on 26.10 the AI standard for schools (No. 283-NK) and Law No. 352-VIII were checked |
| zakon.uchet.kz (Adilet mirror) | ❌ unavailable | server error |
| legalacts.egov.kz | ✅ opened | 194 drafts across 4 queries; for the period — the Ministry of Labour draft; 19.10 — the airport biometrics pilot draft |
| gov.kz, Ministry of AI and Digital Development | ⚠️ via search | news feed did not open; information from the media |
| finreg.kz (Financial Market Regulation Agency) | ❌ unavailable | site did not open; search found no personal data acts for the period |
| nationalbank.kz (National Bank) | ⚠️ via search | drafts page did not open; search found nothing for the period |
| minjust.gov.kz | ❌ unavailable | site did not open |
| Media: zakon.kz, Kursiv, Liter.kz, Tengrinews | ✅ opened | MP’s inquiry, checks of three organisations, AI standard for schools |
All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.