Changes in personal data protection in kazakhstan in 2025

1. Key legislative updates

• Amendments to the Law on Personal Data came into effect, increasing oversight of data collection, processing, and storage.
• Data of Kazakhstani citizens must be stored and initially processed on servers located within Kazakhstan.
• Appointing a Data Protection Officer (DPO) is now mandatory and must be recorded in official registries.

2. Increased responsibility and oversight

• Operators must notify the Personal Data Protection Committee and affected individuals within 72 hours of a breach.
• Both scheduled and surprise inspections are now possible.
• Administrative fines have increased 2–3 times (up to 30 MCI for individuals, up to 200 MCI for large businesses).
• Criminal liability has been expanded for unauthorized data collection, processing, and disclosure.

3. Citizens’ rights

• The right to request deletion, correction, or blocking of personal data;
• The right to know who processes their data and for what purpose;
• The right to withdraw consent at any time;
• The right to judicial protection and appeal to the Personal Data Protection Committee.