Issue 2
Digest for 19–25 October 2026
Drafts on a pilot of AI-based biometric authentication of passengers at Astana airport and on bank "data marts" accessible to the financial regulator are open for comment. The Interior Ministry explained how to claim compensation for a leak. From 1 January 2027, data may be processed without consent to detect conflicts of interest.
- Act now adopted rules and deadlines within 90 days
- Worth noting drafts, guidance, practice
- On the horizon plans and initiatives
Summary
- Period19–25 October 2026
- found1 act adopted (published before the period), 4 drafts, 1 official explanation
- next deadline3 November 2026 — end of consultation on the bank “data mart” rules
The main development of the week: consultation opened on two drafts that expand the processing of personal data. The Ministry of Transport proposes a pilot of AI-based biometric authentication of passengers at Astana airport (consultation until 4 November). The financial regulator (ARDFM) is preparing rules on “data marts” in banks with supervisory access for the regulator (consultation until 3 November).
- The Interior Ministry explained that compensation for a leak can be claimed in court, but the person affected must prove the circumstances of the leak and the harm.
- The Ministry of Health has restated the rules of the professional register of healthcare staff: what is recorded, who enters it and when, and what it is used for.
- On 21 October, the amendments made by Law No. 352-VIII to the Credit Bureau Law and the Digital Code took effect (covered in the previous issue).
- Confirmed on Adilet: from 1 January 2027, the Personal Data Law gains a new ground for processing without consent (Law No. 311-VIII).
Adopted and in force
Healthcare staff: the professional register rules have been restated
An order of the Minister of Health restated the rules on recording healthcare human resources and added rules on maintaining and securing the professional register. The register covers students of medical universities and colleges (enrolment, transfers, expulsion, job placement and mandatory service) and practising specialists: qualifications, performance assessment, professional liability, continuing education, employment history, pay level and staff migration (para 4 of the Recording Rules). A medical organisation’s HR service enters changes about an employee within three working days of the grounds arising; data also flows in automatically from state and other digital systems (para 21). The rules list 13 purposes for using the data, from workforce planning and state training orders to blocking the accounts of staff with expired certificates and scientific research (para 24). Register data is classified as restricted information. Access is tiered: an organisation sees only its own employees and students, a specialist sees their own record and can report inaccuracies, and the actions of technical administrators are logged. The act was not covered in the previous issue.
- Who is affected
- medical organisations, medical universities and colleges, private doctors and pharmacists, healthcare workers and students.
- What to do
- HR services should set up updates within the three-day deadline; specialists may wish to check their own record in the register.
No other acts changing the processing of personal data were found on Adilet for the period. The remaining 19 candidates are public service standards and rules with the standard clause on refusal where consent to access personal data is missing, and consent forms in contracts and applications (professional liability insurance of medical workers, voluntary resettlement, extended producer responsibility).
On 21 October, Law No. 352-VIII took effect: the amendments to the Credit Bureau Law are mostly terminological, and Art. 95 of the Digital Code (digital development index) has been changed. Details are in the issue for 12–18 October.
Coming into force soon
No new personal data rules taking effect in the next 45 days (until 9 December 2026) were found. Below is a rule that takes effect later but has now been confirmed against the official text for the first time.
From 1 January 2027: processing without consent to detect conflicts of interest and for the digital HR system
Law No. 311-VIII on anti-corruption policy adds subparagraph 9-6 to Art. 9 of the Personal Data Law (cases of processing without consent): detecting conflicts of interest under anti-corruption legislation and maintaining the digital HR system. The same law introduced the digital HR system into the Labour Code (Chapter 12-1). State institutions and quasi-public sector entities run their HR processes in it, and the data entered about an employee includes the individual identification numbers of their spouse and close relatives. The Labour Code chapter is mostly already in force; the amendment to the Personal Data Law takes effect on 1 January 2027, separately from the rest of the law.
- Who is affected
- state institutions, national companies and other quasi-public sector entities, their employees and employees’ relatives.
- What to do
- from 2027, do not ask for consent for these purposes, but tell employees what data about them and their relatives is entered into the system and why.
In preparation
AI-based biometric authentication of passengers: a pilot at Astana airport
The Ministry of Transport has published for consultation a draft order on a pilot project of biometric authentication of passengers using artificial intelligence at Astana airport. According to the draft’s summary, the aim is to shorten passenger handling time, simplify pre-flight procedures and improve security at the airport. The stated legal bases are a Government resolution on the work of “digital deputies” of state bodies and Art. 48 of the Digital Code on biometric authentication. The portal shows only the draft’s summary; the text of the order is attached as a file and was not opened for this issue. So the following is not confirmed: what data is collected, whether participation is voluntary, who the operator is, retention periods, and whether there is an alternative for those who do not want biometric checks.
- Who is affected
- passengers, Astana airport, airlines and biometric solution providers.
- What to do
- submit comments on the portal by 4 November; solution developers should watch for the final text.
Bank “data marts”: the regulator will get direct access to transaction data
The ARDFM has drafted rules on creating, maintaining and updating a “data mart” on the infrastructure of a bank or a branch of a non-resident bank, and on the regulator’s access to it. The legal basis is the Law on Banks and Banking. According to media reports on the draft, the data mart is maintained automatically and manual uploads are prohibited. The ARDFM connects to it through a central platform operated by the National Bank’s Digital Development Centre. The platform does not store banks’ primary data, only aggregated query results. Access rights are checked on every request, and the access log is kept for at least three years and cannot be altered. The same reports say that under the law the data marts cover the loan portfolio, large deposits, large payments, transfers and cash withdrawals; thresholds for “large” transactions and the full list of fields are not set by the draft. The draft text was not opened at source, so the scope of data and the timing (1 January 2027, according to the media) are not confirmed.
- Who is affected
- banks and branches of non-resident banks, and their customers.
- What to do
- banks should assess which customer personal data will go into the data mart and prepare comments by 3 November.
Two more drafts are editorial, according to their summaries on the portal:
- The Ministry of AI and Digital Development is clarifying the term “service information about subscribers” in the rules on its collection and storage by telecom operators, and aligning the rules with the Digital Code and the laws on communications and cybersecurity. Consultation until 05.11.2026. Draft.
- The Interior Ministry and the Ministry of Justice are aligning the rules on the national registers of identification numbers with Law No. 326-VIII and the Digital Code (“digital system”, “foreigners”). Consultation until 28.10.2026. Draft.
News and practice
Interior Ministry: compensation for a leak is awarded by a court, and the person affected must prove the harm
On 21 October, at a briefing at the Central Communications Service, an official of the Interior Ministry’s Department for Combating Cybercrime explained how people affected by a leak can obtain compensation. According to the official, the right to compensation for non-pecuniary damage is set out in Art. 24 of the Personal Data Law, and the court decides the amount in each case. The claimant must show where and in what circumstances the leak occurred and what harm was caused. The official added that there is no separate procedure for recovering material damage for the disclosure of data. If a bank is to blame for the leak, people are advised to contact the bank, the police and the Information Security Committee of the Ministry of AI and Digital Development at the same time. The law itself gives the data subject the right to protection, including compensation for both non-pecuniary and pecuniary damage (Art. 24(1)(7)).
- Who is affected
- people whose data has leaked; operators who may face claims.
- What to do
- operators should keep the records of incident investigations: they will be needed both in an inspection and in court.
- No results of the checks of Kinopark, Lucem Medical Clinic and inDrive, and no replies to the MPs’ inquiry after the Yandex outage (see the previous issue), were found in open sources for the period.
What it means
- Not only non-pecuniary damage is compensated. The law expressly gives a right to compensation for both non-pecuniary and pecuniary damage (Art. 24(1)(7)). The absence of a “separate procedure” means that material damage is recovered under general civil procedure, not that it cannot be recovered. Interpretation. See the notes “Data subject rights” and “Liability for breaches of personal data law”.
- Airport biometrics needs a basis in law or must be voluntary. The Digital Code allows mandatory processing of biometric data and mandatory biometric authentication only in cases established by law (Art. 48(3)). A ministerial order on a pilot does not create such a basis itself, so the final text should be checked for voluntariness and an alternative way to complete the procedures. Interpretation. See the note “Types of personal data”.
- Supervisory access to data marts is a new processing of bank customers’ data. If payment and transfer data of individuals goes into the data marts, banks should reflect this in their description of processing and in their security measures, and the regulator’s access log will help show that the transfer was lawful. Interpretation. See the note “Personal data in the financial sector”.
- Digital HR systems are growing. The healthcare staff register and the digital HR system of the quasi-public sector show how employee data moves from the HR department into state systems. Employers should keep track of what data they pass on under the law and tell employees about it. Interpretation. See the note “Personal data of employees and job applicants”.
Calendar
| Date | Event | Status |
|---|---|---|
| 21.10.2026 | Amendments to the Credit Bureau Law and the Digital Code (Law No. 352-VIII) | in force |
| 28.10.2026 | End of consultation on the draft on national registers of identification numbers | in 3 days |
| 03.11.2026 | End of consultation on the bank “data mart” rules (ARDFM) | in 9 days |
| 04.11.2026 | End of consultation on the pilot of biometric authentication of passengers at Astana airport | in 10 days |
| 05.11.2026 | End of consultation on the amendments on service information about telecom subscribers | in 11 days |
| 01.01.2027 | New ground for processing without consent: conflicts of interest and the digital HR system (Art. 9(9-6) of the Personal Data Law, Law No. 311-VIII) | in 68 days |
| 01.01.2027 | Bank “data mart” rules (according to the media; draft) | draft |
| 01.01.2027 | Means-tested social support with consent to collecting data, including bank secrecy (Ministry of Labour draft order) | draft |
| to be confirmed | Rules on applying masking and hashing methods (to be approved by the Ministry) | planned |
| to be confirmed | Rules on exporting personal data from critical digital objects (in agreement with the National Security Committee) | planned |
Sources
- Order of the Minister of Health No. 123 of 29.09.2026 (Adilet)
- Law No. 311-VIII of 12.06.2026 (Adilet)
- Law No. 352-VIII of 23.07.2026 (Adilet)
- Law on Personal Data and Their Protection (Adilet)
- Digital Code (Adilet)
- Draft pilot of biometric authentication of passengers at Astana airport (Open Legal Acts)
- Draft bank “data mart” rules (Open Legal Acts); draft page on the ARDFM website
- Draft amendments on service information about subscribers (Open Legal Acts)
- Draft amendments to the rules on national registers of identification numbers (Open Legal Acts)
- zakon.kz, 21.10.2026: how to obtain compensation for a leak
- Finratings, 16.10.2026: bank data marts
- bes.media, 16.10.2026: the ARDFM will receive bank data automatically
- New Times: passenger biometrics to be introduced at Astana airport
Which resources were checked
| Resource | Status | What was found |
|---|---|---|
| adilet.zan.kz (raw list by script, 27.10) | ✅ opened | 20 acts with a notable topic, 29 with single mentions; none adopted within the period itself (publication lag). Selected: Ministry of Health Order No. 123; the rest are public service standards and consent forms |
| adilet.zan.kz (texts of acts, 27.10) | ✅ opened | 8 candidates, the Digital Code, the Credit Bureau Law and Law No. 311-VIII opened |
| legalacts.egov.kz | ✅ opened | 344 drafts reviewed (created since 12.10 and others in the results); found the airport biometrics pilot, bank data marts, subscriber service information, identification number registers |
| gov.kz, Ministry of AI and Digital Development | ⚠️ via search | news feed returns HTTP 404; no new reports of inspections found for the period |
| gov.kz, ARDFM page | ✅ opened | summary of the data mart draft |
| finreg.kz (ARDFM) | ❌ unavailable | site did not open (ENOTFOUND); the draft was found on gov.kz and Open Legal Acts |
| nationalbank.kz (National Bank) | ⚠️ via search | document and draft pages return HTTP 404; nothing found for the period |
| minjust.gov.kz | ❌ unavailable | site did not open; drafts checked via legalacts.egov.kz |
| Mazhilis / Kurultai | ⚠️ via search | no personal data bills found for the period |
| Media: zakon.kz, finratings.kz, bes.media, newtimes.kz | ✅ opened | Interior Ministry explanation, bank data marts, biometrics pilot |
All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.