Personal data breaches and notification

In short

A personal data breach is a breach of protection that leads to unlawful dissemination, alteration, destruction or deletion of data, or to unauthorised access to them (Art. 1(15-2)). The owner or operator must notify the authorised body within one working day of detection (Art. 25(2)(8)). Data subjects are notified not by the operator but by the e-government operator — through the eGov personal account, the mobile app or SMS (Breach Notification Rules, para 7).

Who notifies whom, and when

The procedure is set out in the Rules on notifying data subjects of personal data breaches, in the version introduced by Order No. 232/NK with effect from 12 July 2026.

Step	Who	To whom	Deadline	What is reported
1	Owner and/or operator	Authorised body	1 working day from detection	Contact details of the responsible person; measures taken; data needed to notify subjects: full name, IIN, phone number (para 4)
1a	Cybersecurity centres (state operations centre, sector centres, response services)	Authorised body	3 hours from detection	Data needed to notify subjects; necessary protection measures (para 5; Cybersecurity Law, Art. 7-4, Art. 7-5 and others)
2	Authorised body	E-government operator	1 working day from receipt	Risks for subjects; recommended measures; data for notification; contact details of the responsible person (para 6)
3	E-government operator	Data subjects	No deadline set	Notice in the eGov personal account, mobile app and/or SMS (para 7)

The notification is sent in writing, as an electronic document or by another secure method (para 3). The Protection Rules repeat the one-day duty (para 23). For restricted-access data there is also a duty to alert the regulator about cybersecurity incidents involving unlawful access (para 15(3)).

The breach register

The authorised body keeps a register of personal data breaches. Its sources are publicly available information and reports from cybersecurity centres (Art. 23-2; Art. 27-1(5-1)). The regulator informs the e-government operator about breaches that put data subjects at risk (Art. 27-1(6-2)). Under the Cybersecurity Law, the authorised body processes breached data in order to inform data subjects through the eGov personal account (Art. 7-1).

Interpretation. The model is centralised: the operator does not have to write to the people affected, but it hands their names, IINs and phone numbers to the regulator, and the state then notifies them through its own channels. This simplifies communication for the company, but it also means the regulator learns about the breach and its scale straight away, and informing data subjects is out of the company’s hands.

Comparison with the GDPR

Question	Kazakhstan	GDPR
Deadline to notify the authority	1 working day	Without undue delay and, where feasible, within 72 hours (Art. 33)
Threshold	Any breach	Not required where the breach is unlikely to result in a risk to rights and freedoms (Art. 33(1))
Notifying data subjects	Done by e-government on the basis of data from the regulator	Done by the controller where the risk is high (Art. 34)
Internal breach records	No separate breach log; medium and large operators record cybersecurity events (Protection Rules, paras 13–14); the regulator keeps the breach register	The controller documents all breaches (Art. 33(5))
Guidance	Breach Notification Rules	EDPB Guidelines 9/2022

Interpretation. The Kazakhstan deadline is shorter than the European one and has no risk threshold. Companies with European incident response processes should adapt them to one working day and report every breach, not only risky ones.

Liability

The Code on Administrative Offences has no specific offence for failing to notify a breach. It may be classified as failure to take protection measures — up to 600 MCI, or up to 2,000 MCI if it led to loss or unlawful processing of data (Code on Administrative Offences, Art. 79). How this works in practice remains to be researched.

Open questions

Open question: when is a breach “detected”? The deadline runs from detection, but the Law does not say whether that is the first alert from a monitoring system or a confirmed finding of an investigation.

Open question: must the operator also notify data subjects itself? The Law and the Rules assign this to e-government. Whether the operator has its own duty, for example under a contract or general civil law, is an open question.

Open question: foreign data subjects. Notification goes through eGov by IIN or phone number. The Rules do not say how people without an IIN or a Kazakhstan phone number will be notified.

Open question: incomplete information. Within one working day the operator may not manage to identify everyone affected. The Rules do not expressly say whether the notification can be supplemented later.

Still to research

• Whether the regulator publishes information from the breach register.
• Enforcement practice for late notification.
• The Cybersecurity Law’s rules on incidents not involving personal data and how they overlap with these Rules.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.