Amendments to the Personal Data Law: the new concepts of “deletion” and “anonymisation”, a register of breaches and the classification of operators

On 24 June 2026, the President of the Republic of Kazakhstan signed the Law of the Republic of Kazakhstan “On Amendments and Additions to Certain Legislative Acts of the Republic of Kazakhstan on Matters of Digitalisation, Personal Data Protection, Road Traffic and Regulation of Advanced Technologies in Transport” No. 326-VIII (the “Law”), which introduced amendments and additions, inter alia, to the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” dated 21 May 2013 No. 94-V (the “PD Law”).

The amendments to the PD Law introduced by paragraph 37 of Article 1 of the Law come into force on 25 August 2026.

This overview covers exclusively those provisions of the PD Law that are new or have been amended as a result of the adoption of the Law, as compared with the previously effective wording of the PD Law.

I. The new concepts of “deletion” and “anonymisation” of personal data

Article 1 of the PD Law has been supplemented with a number of new definitions, including:

• deletion of personal data – actions aimed at excluding personal data from a digital object, as a result of which the personal data cannot be restored;
• anonymisation – actions aimed at the irreversible transformation of personal data identifiers, as a result of which it becomes impossible to determine that the personal data belong to a personal data subject;
• masking – the process of protecting information by replacing part of the actual personal data with invalid and (or) depersonalised data;
• hashing – the process of converting digital data of any size into a fixed-length string for the purpose of protecting them;
• personal data security breach – a breach of protection that has resulted in unlawful dissemination, alteration, destruction or deletion, unauthorised access, etc.;
• dissemination of personal data in publicly available sources - actions as a result of which access to personal data is granted to an indefinite range of persons.

Separately, we would like to note the introduction of the concept of a “personal data identifier” (hereinafter the “PDI”) – information enabling the identification of a personal data subject or the linking of separate data sets relating to such subject into a body of information enabling the identification of that subject. In turn, Article 6 of the PD Law provides that PDIs are used to identify a subject in respect of publicly available personal data (hereinafter “PAPD”) and restricted-access personal data (hereinafter “RAPD”). The Article has also been supplemented with an exhaustive list of personal data identifiers:

–    surname, first name and patronymic (where indicated in the identity document) taken together;

–    individual identification number (IIN);

–    image of the subject’s face;

–    biometric vector of the subject’s face or derivatives thereof that may be restored to their original value.

II. The new obligation to notify the authorised body of the commencement and termination of personal data processing

The key innovation is new Article 10-1, which introduces an obligation for the owner, the operator and a third party to notify the authorised body of their intention to commence the processing of personal data and of the termination thereof. 

The notification is submitted on a paper, digital or other medium, signed by an authorised person, and must contain, in particular:

–    the name (full name), BIN (IIN) of the owner/operator/third party;

–    the personal data protection measures applied;

–    the commencement date of processing; the list of data collected;

–    information on whether the data may be transferred to third parties and on the presence or absence of cross-border transfer of PD in the course of their processing;

–    information on the dissemination of data in publicly available sources;

–    the list of PD collected in relation to the subject

–    the location of the database and (or) the digital object containing personal data

–    Other information determined by the owner and (or) the operator, as well as the third party.

The authorised body shall, within 30 business days, enter the said information into the register of persons collecting and (or) processing personal data (or exclude such information — where notification of the termination of processing is given).

Exception: owners and (or) operators, as well as third parties, classified as small and medium owners and (or) operators, as well as third parties, collecting and processing PD are exempt from this obligation (see Section III below).

III. The new classification of owners and (or) operators by the volume of data processed

New Article 25-1 introduces a classification of owners/operators and third parties into small, medium and large depending on the number of unique personal data subjects whose data are processed. The classification applies irrespective of the legal form, the form of ownership and the type of activity.

At the same time, the concept of a “unique personal data subject” is absent from the legislation. In our understanding, the legislator proceeded from the concept of an individual natural person whose data are processed, excluding the repeated counting of the same natural person where several sets of his or her personal data are processed and (or) his or her personal data are processed in several digital objects.

In the absence of a statutory definition and an approved counting methodology, we have submitted a corresponding request to the authorised state body.

Important: where personal data of restricted access are collected and processed, the category of the owner/operator is raised by one level. The data protection measures for each category are determined by the authorised body in the field of personal data protection – the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan.

IV. Expansion of the list of methods for protecting digital objects containing personal data

Article 23 of the PD Law has been restated under the title “Protection of digital objects containing personal data”.

• For the purposes of protecting personal data, the methods of masking and hashing are applied in digital objects; the procedure for applying these methods is determined by the authorised body.
• The transfer of personal data by way of the integration of digital objects is permitted.
• The copying (uploading) of personal data from critically important digital objects onto digital media is carried out in the procedure determined by the authorised body in agreement with the National Security Committee of the Republic of Kazakhstan.

Previously, Article 23 of the PD Law contained only a general referential provision to the effect that the protection of digital resources containing personal data is carried out in accordance with the digital legislation of the Republic of Kazakhstan, without listing any specific protection methods.

V. The new concept – the register of personal data security breaches

Article 23-2 introduces a new concept – the register of personal data security breaches, which is maintained by the authorised body on the basis of information obtained from publicly available sources and from cybersecurity centres. The authorised body processes personal data in this register on the basis of the facts of unauthorised access thereto by third parties without obtaining the consent of the subject or his or her legal representative.

At the same time, at the current stage the legislation does not set out the procedure for maintaining the said register, the scope of the information subject to inclusion therein, or the regime of access of citizens and businesses to such information. Accordingly, both the content of the register and the possible legal consequences of the inclusion therein of information on a personal data security breach remain uncertain. However, given the nature of the relations regulated, it may be expected that the relevant matters will be settled by the adoption of corresponding rules for maintaining such register.

VI. Expansion of the rights of the personal data subject

Article 24 of the PD Law has been supplemented as regards the rights of the personal data subject:

• the subject is entitled to demand that the owner and (or) the operator, as well as a third party, block and (or) anonymise his or her personal data where there is information on a breach of the conditions for their collection and processing (previously — blocking only);
• the subject is entitled to demand the destruction or deletion of his or her personal data that have been collected and processed in breach of the legislation of the Republic of Kazakhstan (previously — destruction only).

The obligations of the owner and (or) the operator have been supplemented in a similar manner (Article 25 of the PD Law) — in particular, to take measures for the destruction and (or) deletion of personal data upon achievement of the purpose of their collection and processing and, within one business day, to destroy or delete personal data where the fact of their unlawful collection or processing is confirmed.

At the same time, it has been established that a demand for the deletion of personal data is not subject to fulfilment in the cases specified in paragraph 4 of Article 41 of the Digital Code of the Republic of Kazakhstan (in particular, where the data must be retained for the purposes of judicial acts, the performance of obligations under law or contract, statistical purposes, etc.).

VII. Dissemination of data in publicly available sources

Article 7 has been supplemented with paragraph 3-1: where the subject (or his or her legal representative) has personally disseminated his or her data in publicly available sources without providing consent, the obligation to confirm the lawfulness of the subsequent collection and processing of such data rests with each person that has collected, disseminated or otherwise processed them.

In addition, owners/operators are obliged to mask data not subject to dissemination when posting information in publicly available sources, and the subject is granted access to such data following authorisation and identification.

VIII. Practical steps for businesses

In light of the amendments to the PD Law, companies are advised to consider taking the following steps:

Note:

If you require expert assistance in the field of personal data protection, including an audit of processing activities and ensuring compliance with the updated requirements of the PD Law, we are ready to provide qualified support and legal advisory services.