Kazakhstan is considering tightening legal responsibility for violations related to personal data protection. The Ministry of Artificial Intelligence and Digital Development has proposed introducing criminal liability for mass leaks of citizens’ personal data, along with a significant increase in administrative fines for failing to comply with information security requirements.
The proposal was announced by Rostislav Konyashkin, First Deputy Minister of Artificial Intelligence and Digital Development, during a government meeting.
According to Konyashkin, Kazakhstan is adopting a “zero tolerance” policy regarding the mishandling of personal digital data.
“In implementing the constitutional rights of citizens to privacy and the protection of personal information, we are moving to a zero-tolerance policy in this area. Digital transformation should not undermine the security of citizens, and any irresponsible handling of personal data should be punished in accordance with the law,” he said.
In addition to criminal penalties for mass data breaches, the ministry is proposing to significantly increase administrative liability for officials violating information security standards.
The current maximum fine is approximately $17,000. The proposed new ceiling would be about $42,500.
The initiative would apply to government agencies, the quasi-public sector, financial institutions, and private companies that handle large volumes of personal data.
The day prior to the government meeting, President Kassym-Jomart Tokayev addressed the issue of digital security at the National Kurultai (Assembly).
He emphasized that the right to personal data protection should be enshrined in the country’s.
“Our Constitution must keep pace with the times. In the 21st century, digitalization is developing at a rapid pace and has a direct impact on human rights and freedoms. Therefore, the Basic Law must clearly stipulate that the personal digital data of citizens is protected by law,” Tokayev said.
The push for stricter regulation follows a series of large-scale data breaches.
In spring 2024, the State Technical Service of the National Security Committee identified a leak affecting over 2 million clients of the microfinance organization zaimer.kz.
In summer 2025, the government confirmed the largest data breach in Kazakhstan’s history, compromising the personal information of over 16 million people, more than three-quarters of the country’s population of just over 20 million.
Experts say the proposed legal reforms mark Kazakhstan’s shift toward a stricter regulatory framework, aligning with standards seen in the European Union and some Asian jurisdictions, where personal data breaches carry both administrative and criminal consequences.
