Issue 3
Digest for 26 October — 1 November 2026
From 31 October, personal data may be copied from critical digital objects only with the regulator's approval, may not be stored abroad and must be destroyed within 30 days. Insurers selling via marketplaces may not pass customer data from state databases to the partner. Rules on the Digital Family Card were approved (from 1 January 2027).
- Act now adopted rules and deadlines within 90 days
- Worth noting drafts, guidance, practice
- On the horizon plans and initiatives
Summary
- Period26 October — 1 November 2026
- found4 acts adopted (all adopted before the period, published 19–22 October), 1 new draft, no explanations or decisions
- next deadline3 November 2026 — end of consultation on the bank “data mart” rules
The main development of the week: on 31 October, the rules on copying (exporting) personal data from critical digital objects took effect. Banks, telecom operators, medical and state organisations may now export data to flash drives and other media only with the Ministry’s approval and must destroy the copies within 30 days.
- From the same day, insurers selling policies through marketplaces and partner apps must keep customer data away from the partner: when application data is checked against state databases via the partner’s resource, the partner receives only a “correct” or “incorrect” answer.
- The Ministry of Labour approved the rules on the Digital Family Card: from 1 January 2027 it will receive data from the digital systems of state bodies, credit bureaus and banks, including citizens’ payments and transfers and chronic diseases.
- The rules on the special state allowance link it, from 2027, to consent to data processing, including bank secrecy.
- The Ministry of AI and Digital Development published the second version of draft rules on cybersecurity audits of digital objects (consultation until 16 November).
Adopted and in force
Exporting data from critical systems: only with approval and for no more than 30 days
Since 31 October 2026, the rules required by Art. 23 of the Personal Data Law as amended in 2026 have been in force: data moves between systems through integration, while copying from critical digital objects to media follows a procedure approved by the Ministry in agreement with the National Security Committee. The rules prohibit such exports except in cases approved by the competent authority and in intelligence, counter-intelligence, operational search and protection activities (para 3 of the Rules). The request is sent by official letter signed by the head of the state body or by the owner or head of the object. It states the legal basis, the specific purpose, why integration is not possible, the categories and volume of data, the retention period, the protection measures, and the transferring and receiving persons (paras 5–6). The Ministry responds within 15 working days; after a refusal, the request may be resubmitted (para 7). Only necessary data may be exported, and it must be de-identified, masked or hashed (paras 8–9). Copies may not be placed in databases outside Kazakhstan or passed to third parties, may be kept for no more than 30 calendar days and must then be destroyed with a record (paras 11–13). Each transfer is documented by a handover record with a checksum (hash), and actions are logged. Media are wiped so that the data cannot be recovered; if wiping cannot be confirmed, the medium is physically destroyed (paras 14–16).
- Who is affected
- owners and operators of critical digital objects — banking, telecom, healthcare, transport, energy and utilities, e-government, law enforcement — and contractors who receive exports.
- What to do
- prohibit exports to media without approval; prepare templates for the request and for handover and destruction records; check where existing exports are kept and whether they are older than 30 days.
Insurance via marketplaces: the partner must not see customer data
The financial regulator (ARDFM) amended the rules on the exchange of digital resources between insurers, policyholders and the insurance database (item 17 of the List annexed to Resolution No. 140). Compulsory insurance in digital form is concluded only on the insurer’s website. Third-party apps, terminals and marketplaces are allowed if they belong to a bank or a payment organisation. Voluntary insurance may also be arranged through a partner’s website. Where a customer reaches the insurer through a third-party app or marketplace, the insurer must protect personal data and insurance secrecy and prevent access by third parties, including the app owner. A partner that breaches the requirements must be disconnected. Checking the customer’s application against state databases and the unified insurance database via the partner’s resource is done only over a secure channel and only as verification: the partner receives a “correct” or “incorrect” answer. Passing it data from state databases, auto-filling fields and returning customer data are prohibited. Access keys to the insurance database are not given to the partner. Pre-ticked consent to paid add-on products is also prohibited. The same resolution adds to the rules on simplified settlement of road accidents the identification of both participants by photo, IIN and phone number with their consent. How far these requirements differ from the previous version of the rules was not checked on Adilet.
- Who is affected
- insurers, marketplaces, banks and fintech apps selling policies, and their customers.
- What to do
- insurers should review partner integrations — what the partner receives from the check and whether it can access the insurer’s pages; partners should remove auto-filling from state databases.
Digital Family Card: data on payments, illnesses and property brought together in one system
The Ministry of Labour approved the rules under which state bodies feed data into the Digital Family Card. This analytical tool ranks families by level of social well-being on the basis of state data received through the Smart Data Ukimet analytical system (paras 2–4 of the Rules). The rules list eight indicators and their data sources. For “income, expenses and credit obligations”, the system receives pension contributions, debts from credit bureaus, securities, and data on spending transactions, transfers, deposits and payments of individuals from banks (para 8). For healthcare: registration with a clinic, participation in health insurance, dispensary registration and chronic diseases (para 16). Vehicles and farm machinery, employment, children and disability, housing, land and livestock are also counted. State bodies transmit updates within one working day; errors are corrected by the source body within five working days. The Ministry of Labour does not change the data itself (paras 5, 27–28). The rules require compliance with the law on personal data, tax and bank secrecy, but do not say whether citizens can see their card and challenge their category.
- Who is affected
- all families applying for benefits; banks and credit bureaus as data sources; state bodies owning the systems.
- What to do
- monitor for now; banks should find out how customer transaction data will be transmitted (the rules refer to “the procedure provided by law”).
A related change: the rules on the special state allowance now state that applicants, recipients and their family members consent to the collection, processing, verification and transfer of personal data, including bank secrecy. Without consent, payment of the allowance is suspended, and proactive award stops if consent from all adult family members is not received within three working days of an SMS. Most of the changes apply from 01.01.2027 (Order of the Minister of Labour No. 404 of 14.10.2026). Which of these provisions are new and which were carried over from the previous version was not checked.
The other Adilet candidates are public service standards and rules with the standard clause on refusal where consent to access personal data is missing, consent forms in contracts and applications, regulations on prosecutors’ offices (access to digital systems “subject to personal data protection requirements”), rules on state support for business (consent obtained by a second-level digital system) and on medical and social assessment. Nothing new for personal data processing was found in them.
The changes of 21.10.2026 to the Digital Code, the Entrepreneurial Code and the laws on banks, credit bureaus and payments were made by Law No. 352-VIII and are covered in the issue for 12–18 October.
Coming into force soon
No new personal data rules taking effect in the next 45 days (until 16.12.2026) were found. From 1 January 2027 (in 61 days):
- a new ground for processing without consent — detecting conflicts of interest and maintaining the digital HR system (Art. 9, Law No. 311-VIII). State institutions and the quasi-public sector should tell employees what data about them and their relatives is entered into the system. Law No. 311-VIII;
- the Digital Family Card and the new rules on the special state allowance (see above).
In preparation
Cybersecurity audits of digital objects: second version of the rules
The Ministry of AI and Digital Development published the second version of draft rules on cybersecurity audits of digital objects. According to the draft’s summary, the rules set out how an audit is organised, conducted, documented and issued and how its results are followed up. The basis is a new function in the Ministry’s Regulations (sub-para 353-3 of para 15). The summary does not say for which objects an audit is mandatory, who may conduct it or how often. The draft text is attached as a file and was not opened for this issue, so these details are not confirmed. The first version was posted on 20.10.2026 and was not covered in the previous issue.
- Who is affected
- owners and holders of digital objects, including those with personal data databases, and cybersecurity auditors.
- What to do
- submit comments by 16 November; follow the final text.
Consultations on drafts covered in the previous issue continue:
News and practice
Nothing found for the period. No new regulator reports on inspections, fines or leaks, court decisions or explanations for 26.10–01.11.2026 were found in open sources. Results of the inspections of Kinopark, Lucem Medical Clinic and inDrive and replies to the parliamentary inquiry after the Yandex outage were not found either.
What it means
- Exporting to media is now an exception, not a working tool. The rules require an explanation of why integration is not possible, so routine exports from critical systems for contractors, analytics and testing are no longer allowed without approval. A contractor receiving an export may not pass it on or store it abroad either. Interpretation. See the notes “Personal data protection measures” and “Localisation”.
- Test environments deserve a separate check. The requirement to de-identify, mask or hash data before export and the 30-day limit make it hard to use real customer data for development in line with the rules. Synthetic or de-identified datasets are safer. Interpretation. See the note “Deletion and de-identification”.
- A marketplace selling a policy does not become a recipient of state database data. A “correct / incorrect” answer instead of the data is an example of minimisation that the financial regulator has spelled out directly. Partners that currently auto-fill customer applications will have to change the process. Interpretation. See the note “Personal data in the financial sector”.
- The Digital Family Card is a large combination of data without consent. Account transaction data and chronic diseases will end up in one analytical system. The rules do not describe a citizen’s right to see their card and correct errors: the general rights of the data subject under the law remain. Interpretation. See the note “Rights of the data subject”.
Calendar
| Date | Event | Status |
|---|---|---|
| 21.10.2026 | Amendments to the Credit Bureau Law and the Digital Code (Law No. 352-VIII) | in force |
| 28.10.2026 | End of consultation on the draft on national registers of identification numbers | consultation closed |
| 31.10.2026 | Rules on copying (exporting) personal data from critical digital objects (Order No. 613/NK) | in force (by calculation) |
| 31.10.2026 | Requirements for online insurance via marketplaces and partners (ARDFM Resolution No. 140) | in force (by calculation) |
| 03.11.2026 | End of consultation on the bank “data mart” rules (ARDFM) | in 2 days |
| 04.11.2026 | End of consultation on the pilot of biometric authentication of passengers at Astana airport | in 3 days |
| 05.11.2026 | End of consultation on amendments on service information about telecom subscribers | in 4 days |
| 16.11.2026 | End of consultation on the rules on cybersecurity audits of digital objects | in 15 days |
| 01.01.2027 | New ground for processing without consent: conflicts of interest and the digital HR system (item 9-6 of Art. 9 of the Personal Data Law, Law No. 311-VIII) | in 61 days |
| 01.01.2027 | Rules on the Digital Family Card (Ministry of Labour Order No. 407) | in 61 days |
| 01.01.2027 | New rules on the special state allowance: consent to data processing, including bank secrecy (Ministry of Labour Order No. 404) | in 61 days |
| 01.01.2027 | Rules on bank “data marts” (according to the media; draft) | draft |
| to be confirmed | Rules on applying masking and hashing methods (approved by the Ministry) | planned |
Sources
- Order of the Minister of AI and Digital Development No. 613/NK of 13.10.2026 (Adilet)
- Resolution of the ARDFM Board No. 140 of 12.10.2026 (Adilet)
- Order of the Minister of Labour and Social Protection No. 407 of 15.10.2026 (Adilet)
- Order of the Minister of Labour and Social Protection No. 404 of 14.10.2026 (Adilet)
- Law on Personal Data and Their Protection (Adilet)
- Law No. 311-VIII of 12.06.2026 (Adilet)
- Law No. 352-VIII of 23.07.2026 (Adilet)
- Draft rules on cybersecurity audits of digital objects (Open NLA)
- Draft rules on bank “data marts”, draft pilot of biometrics at Astana airport, draft on service information about subscribers (Open NLA)
- Kursiv, 30.10.2026: rules on exporting personal data
Resources checked
| Resource | Status | What was found |
|---|---|---|
| adilet.zan.kz (raw data by script, 03.11) | ✅ opened | 21 acts with a notable personal data theme, 20 with single mentions, 5 changes to library acts; none adopted within the period itself (publication delay). Selected: Order No. 613/NK, ARDFM Resolution No. 140, Ministry of Labour Orders No. 407 and No. 404 |
| adilet.zan.kz (act texts, 03.11) | ✅ opened | 9 candidates opened, plus API cards for 5 acts |
| legalacts.egov.kz | ✅ opened | 200 latest drafts reviewed (created 15.10–02.11) and 6 search result pages; one new relevant draft — rules on cybersecurity audits; the drafts from the previous issue are still open for comment |
| gov.kz, Ministry of AI and Digital Development | ✅ opened | news feed for the period — no personal data items |
| gov.kz, ARDFM documents | ✅ opened | 10 items for 21.10–02.11; relevant — only a draft on banking (fraud risk management; data not mentioned in the summary) |
| nationalbank.kz (National Bank) | ❌ unavailable | drafts page — HTTP 404; nothing found by search for the period |
| minjust.gov.kz | — | not opened; drafts checked via legalacts.egov.kz |
| Mazhilis / Kurultai | ⚠️ via search | no personal data bills found for the period |
| Media: kursiv.media, zakon.kz, kapital.kz, tengrinews.kz | ⚠️ via search | Kursiv article on the export rules; no other news for the period |
All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.