Administrative and other liability for violating personal data legislation.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
The main article of the Code of Administrative Offences — on breaches of personal data law — covers unlawful collection and processing, the same done by abusing an official position, failure to apply protection measures, and such failure resulting in a leak or unlawful processing. Fines range from 30 to 2,000 MCI depending on the offence and the size of the business (from KZT 129,750 to KZT 8.65 million in 2026).
More in the note «Liability for breaches of personal data law»
Yes. The Criminal Code punishes failure to apply protection measures causing substantial harm, and unlawful collection and dissemination of personal data and information about private life — with up to 7 years' imprisonment.
More in the note «Liability for breaches of personal data law»
No public statistics have been found. Some procedural features are known — cases of unlawful processing are opened only on the victim's complaint and closed if the parties reconcile, and a legal entity can be held liable no later than one year after the offence and two months after it is discovered.
More in the note «Liability for breaches of personal data law»
Note
Who oversees compliance with personal data law: the regulator (the Ministry of Artificial Intelligence and Digital Development), local executive bodies and the prosecutor's office. How businesses are inspected — unscheduled inspections only, against a 33-item checklist — and how state bodies are inspected.
Note
What rights data subjects have under the Personal Data Law and the Digital Code, how quickly the operator must respond (from one to fifteen working days), how a request is made and where to complain. A summary table of deadlines and a comparison with the GDPR, noting the absence of data portability and a general right to object.
Note
Administrative liability under Art. 79 of the Code of Administrative Offences — fines from 30 to 2,000 MCI (in 2026, from KZT 129,750 to 8.65 million), how cases are opened and the one-year limitation period for legal entities. Criminal liability under Art. 147 of the Criminal Code and civil liability for damages. A comparison with turnover-based GDPR fines.
Note
Who must appoint a person responsible for organising personal data processing, what that person does and how the role differs from a GDPR DPO. Which internal documents an operator needs depending on its category — small, medium or large — under the 2026 version of the Protection Rules.
Article 79 sets administrative fines for personal data violations: unlawful collection or processing, abuse of position, failure to take protection measures, and such failure resulting in loss or unlawful processing. Fines range from 30 to 2,000 MCI.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
Art. 147: criminal liability for failure to apply protection measures causing substantial harm, for unlawful collection, processing and dissemination of personal data causing substantial harm, and for violating privacy. Penalties range from fines to up to seven years' imprisonment.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures