Kazakhstan Weighs Criminal Charges for Large-Scale Personal Data Leaks
Kazakhstan is poised to enhance its legal framework concerning personal data protection. Plans are underway to introduce criminal charges for large-scale data breaches.
Kazakhstan’s Proposed Legal Reforms for Personal Data Protection
The Ministry of Artificial Intelligence and Digital Development has recommended severe penalties for violations related to personal data security. This move comes as the nation adopts a more stringent approach to safeguarding citizens’ information.
Criminal Liability for Data Breaches
First Deputy Minister Rostislav Konyashkin announced the initiative during a government session. The ministry aims to implement a “zero tolerance” policy against mishandling personal data.
- Criminal charges for mass data breaches.
- Increased administrative fines for non-compliance.
Konyashkin emphasized the importance of balancing digital transformation with individual rights. He stated, “Irresponsible handling of personal data must be punished according to the law.”
Increased Fines and Broader Applicability
The proposed changes involve raising the maximum administrative fine from approximately $17,000 to about $42,500. This new policy would impact:
- Government agencies
- Quasi-public sectors
- Financial institutions
- Private companies handling large volumes of personal data
Presidential Support for Data Protection
Prior to the announcement, President Kassym-Jomart Tokayev addressed digital security at the National Kurultai. He stressed the necessity of enshrining personal data protection in Kazakhstan’s Constitution.
“Our Constitution must keep pace with the times,” Tokayev stated. He noted that ongoing digitalization significantly impacts human rights. Thus, it is essential for the Basic Law to explicitly protect citizens’ digital data.
Context of Recent Data Breaches
This push for reform follows several high-profile data leaks. Notably, in spring 2024, a data breach affected over 2 million clients of the microfinance organization zaimer.kz. The government also acknowledged a significant breach in summer 2025, with personal information of over 16 million individuals compromised.
These incidents accounted for more than three-quarters of Kazakhstan’s population, which is just over 20 million. Experts believe that these legal reforms will align Kazakhstan’s data protection laws with those seen in the European Union and select Asian countries, where breaches entail both administrative and criminal repercussions.
