--- title: "Kazakhstan Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/kazakhstan/ source_html: /jurisdictions/kazakhstan/index.html description: "Kazakhstan data protection and privacy regulation: 10 categories, 90 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: d4fd6160484add7e4717ae9b5637fd5628a728a59f8ca2974e603ec2b615f0fc generator: "fe-fleet/md-twin@1.0" --- # Kazakhstan Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Kazakhstan Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) Last updated 2026-11-04 · 10 categories · 90 claims · 37 sources in the cumulative register Download report (PDF) Expand all Kazakhstan's 2026 amendment wave to Law No. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (6 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=KAZAKHSTAN)[Build Report](/reports/?j=KAZAKHSTAN)[Compare](/compare/?j=KAZAKHSTAN) Framework posture Regulated (omnibus) 8 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Information Security Committee under the Ministry of Artificial Intelligence and Digi Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 8 / 10 modules assessed 0 Confirmed · 8 Probable · 0 Uncertain · 2 Not yet assessed 10 Categories 3 Red categories 57 Sub-modules 90 Claims 0 Tier-1 sources Traffic-light mix 5 amber 3 red 2 n/a (sums to 10 rendered categories; click to filter) 3 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 1,249 Full executive summary 422 ###### Latest update · 25 October 2026 #### Lead Signal Kazakhstan's data-protection regime is tightening materially through Law No. 326-VIII, signed 24 June 2026, which amends the foundational Law No. 94-V 'On Personal Data and Their Protection.' Most of the law's provisions enter into force on 25 August 2026. The amendment introduces a risk-based, three-tier classification of controllers and databases, and this tiering has direct practical consequence: a database that would otherwise qualify as 'small' under the subject-count threshold of fewer than ten thousand unique subjects is reclassified upward to 'medium' if it contains biometric data, regardless of how few subjects that database covers. This means the compliance burden a controller faces is no longer purely a function of scale; the sensitivity of the data held now independently drives tier escalation. #### Other Developments A new implementing instrument , a revised version of the Rules for the Implementation of Personal Data Protection Measures, entered into force on 12 July 2026, introducing updated organisational and technical security measures that controllers and processors must apply. A mandatory notification duty created by Law No. 326-VIII requires data owners, operators and third parties to notify the authorised body of the commencement and termination of personal-data processing, though this duty is confined to 'large' owners and operators, defined as those processing data on five hundred thousand or more unique subjects; smaller controllers fall outside this specific filing obligation. A new breach-related register is also established by Law No. 326-VIII, to be maintained by the authorised state body, though the specific deadline and recipient test that would govern individual breach notification to affected data subjects has not been located in the material available. Kazakhstan's artificial-intelligence framework , Law No. 230-VIII ZPK 'On Artificial Intelligence,' signed 17 November 2025 and in force since 18 January 2026, establishes a risk-tiered legal structure for AI systems operating in the country, stating transparency, safety, accountability and data-privacy among its objectives; whether this law imposes any data-protection-specific transparency duty beyond these general objectives has not been independently verified. #### Cross-Monitor Connections The risk-tiered AI governance structure under Law No. 230-VIII intersects with financial-integrity and crypto monitoring of Kazakhstan's parallel AIFC/national digital-asset perimeter, where similar dual-track regulatory structures are tracked separately; the data-protection reading here concerns the AI law's stated data-privacy objective rather than the digital-asset licensing question itself. No direct cross-reference to world-payments developments was identified in the material available. #### Outlook The principal date to track is 25 August 2026, when most of Law No. 326-VIII's provisions, including the large-controller notification duty and the breach register, take legal effect. Separately unresolved is whether the national controller-registry process has begun operating in practice and what notification form it requires, and whether the AIFC's own Data Protection Regulations have been amended to align with these national changes; neither has been verified. The specific deadline and threshold test governing individual breach notification to data subjects, as distinct from the state breach register, also remains to be confirmed. 3 earlier updates not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Kazakhstan's 2026 amendment wave to Law No. 94-V represents the most significant restructuring of the country's personal-data regime since the 2013 base law, with the definition of personal data itself amended effective 11 July 2026. Personal data is now redefined to mean information supplemented by a personal data identifier, a formulation that decouples the statutory definition from physical medium and from biometric data as an explicit anchor. The shift away from a physical-medium anchor also has implications for how the law treats purely digital, non-biometric identifiers such as device or account identifiers, potentially broadening the practical scope of what counts as personal data even as the express biometric anchor is removed. This is a high-confidence finding drawn from consistent secondary legal-advisory reporting, though the underlying primary Adilet.zan.kz consolidated text incorporating both the January and June 2026 amendments has not been directly retrieved this cycle. The redefinition is foundational: because so much of the rest of the framework — controller classification, security-measure obligations, breach reporting — operates by reference to what counts as personal data, this single change ripples across the entire compliance architecture. #### Other Developments A new register of data collectors and processors becomes effective 25 August 2026, to be maintained by the central executive body responsible for personal-data protection. The Ministry of Artificial Intelligence and Digital Development retains its standing authority to conduct unscheduled compliance inspections of businesses, a carried-forward supervisory power rather than a new development this cycle. Consent scope has been clarified for publicly self-published data. Effective 25 August 2026, Kazakhstan's personal data law clarifies that data an individual has publicly self-published does not imply consent to further collection or dissemination by third parties. The same effective date brings new statutory definitions of automated processing, anonymization, masking, and hashing into force, giving the framework a more granular technical-processing taxonomy than it previously had. Controller obligations have been substantially re-architected. A new version of the Rules for the Implementation of Personal Data Protection Measures, in force 12 July 2026, introduces a risk-tiered controller classification — small, medium (10,000 to 500,000 unique data subjects) and large (500,000-plus) — with the tier increased by one level where restricted-access personal data is processed. Controllers processing at the large tier, or at any tier where restricted-access personal data pushes them up one level, face the most substantial compliance uplift, since both the classification framework and the additional security-measure requirements apply cumulatively. A centralised personal-data-security-breach register, compiled from public sources and state cybersecurity-system reports, will be maintained by the competent authority from 25 August 2026. Biometric data's statutory anchor has shifted. As a second-order consequence of the personal-data redefinition, biometric data is no longer an explicit defining anchor of personal data; it is now captured only insofar as it functions as a personal data identifier, though no dedicated AI- or biometric-specific rule change was separately identified this cycle. Enforcement posture is tightening. Administrative liability for personal-data violations has been progressively tightened through recent legislative amendments, and Kazakhstan's data-protection regulator is understood to be signalling intent to pursue cross-border enforcement against foreign controllers lacking a Kazakhstani presence, via cooperation with foreign counterparts — a directional enforcement-posture signal rather than a documented case. #### Cross-Monitor Connections The extraterritorial-reach point — Kazakhstan's data-protection framework is reported to apply to any organisation processing Kazakhstani residents' data regardless of processing location — and the regulator's signalled intent to pursue cross-border enforcement together carry relevance for the crypto monitor's coverage of Kazakhstan's data-handling obligations for AIFC-licensed and onshore digital-asset platforms, and for advennt's operator-facing compliance picture insofar as licensed gambling operators processing Kazakhstani player data sit within the same extraterritorial scope. This brief does not re-analyse either domain; it flags the connection for readers tracking those monitors. #### Outlook Three effective dates converge on 25 August 2026 — the new data-collector/processor register, the public-source-consent clarification, and the centralised breach register — making that date the single most important near-term checkpoint for Kazakhstan's data-protection compliance calendar. Readers should also watch for the first test of the regulator's signalled cross-border enforcement intent — specifically, whether a case is opened against a foreign controller with no Kazakhstani establishment. The primary consolidated text of Law No. 94-V incorporating both 2026 amendment waves remains unretrieved, and no DPA-equivalent enforcement action or fine under the newly tightened administrative-liability schedule has been confirmed this cycle; both are the clearest gaps to close before the next reporting cycle. Read full brief · 1249 words ###### Latest update · 18 October 2026 #### Regulatory Status Kazakhstan's data-protection framework entered a coordinated tightening phase across July and August 2026. Law No. 256-VIII took effect 12 July 2026, deleting the standalone statutory definition of biometric personal data from Law No. 94-V while the term remains used elsewhere in the statute. Law No. 326-VIII, signed 24 June 2026, brought a material-scope redefinition around personal-data identifiers into force from 11 July 2026, with its further provisions, including a three-tier controller/processor classification system (small, medium at 10,000-500,000 unique data subjects, large at 500,000-plus, with an uplift for restricted-access data) and automated-processing consent and objection requirements, in force from 25 August 2026. Order No. 338/НҚ of 22 June 2026 entirely restated the implementing Rules for the Implementation of Personal Data Protection Measures, in force from 12 July 2026. The current administrative-penalty ceiling under Code of Administrative Offences Article 79(4) remains 2,000 MCI (KZT 8,650,000) for large-enterprise violations, though a Vice-Minister proposal announced 10 September 2026 would raise this to 5,000 MCI for repeated violations by large companies, pending discussion with agencies, businesses, and the Kurultai. #### Outlook Resolution of the interpretive gap left by the deletion of the standalone biometric personal data definition, and the progress of the proposed 2,000-to-5,000 MCI fine increase through the pending discussion process, are the two clearest developments to track following this cycle's coordinated amendment wave. ###### Standing brief · as of 23 August 2026 #### Regulatory Status Kazakhstan's 2026 amendment wave to Law No. 94-V is the most significant restructuring of its personal-data regime since the 2013 base law. The definition of personal data was amended effective 11 July 2026, decoupled from physical medium and biometric anchoring and redefined around a personal data identifier concept, with second-order effects on how biometric data is treated. A new register of data collectors/processors, a public-source-consent clarification, and a centralised breach register all become effective 25 August 2026. Separately, a new version of the implementing Rules, in force 12 July 2026, introduces risk-tiered controller classification and additional security measures for restricted-access personal data. Administrative liability for violations has been progressively tightened, and the regulator has signalled intent to pursue cross-border enforcement against foreign controllers lacking a Kazakhstani presence. #### Outlook 25 August 2026 is the single most important near-term compliance checkpoint, when three separate obligations come into effect simultaneously. Retrieval of the primary consolidated statutory text and confirmation of any first cross-border enforcement case are the clearest gaps to close next cycle. Read full brief · 422 words Key regulatory facts for Kazakhstan Regulatory Dimension Kazakhstan Standing Position Jurisdiction Kazakhstan (KZ) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 90 sourced findings) Regulator & Framework Core statute and a newly consolidated supervisory body are confirmed (T1/T2), but registration/filing mechanics and territorial-scope language remain unconfirmed in available sources. Lawful Processing & Special Data Consent threshold is confirmed at T1/T2; special categories, pseudonymisation/anonymisation safe-harbours are unconfirmed gaps. Data Subject Rights Partial rights (access/rectification) confirmed in force; erasure is draft-stage only; portability, restriction/objection and deadlines are unconfirmed gaps. Controller/Processor Duties Only retention-related and draft security-measure findings are confirmed; DPO, ROPA, joint-controller, breach-notification and DPIA sub-modules are unconfirmed gaps on a regime that otherwise claims omnibus status. Primary Instruments Cited DataGuidance, DataGuidance (mirroring official text), DataGuidance, DataGuidance, DataGuidance Last Confirmed / Updated 2026-11-04 (37 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Kazakhstan: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core statute and a newly consolidated supervisory body are confirmed (T1/T2), but registration/filing mechanics and territorial-scope language remain unconfirmed in available sources. Primary framework Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V On Personal Data and its Protection (as amended by Law No. 347-VI of 25 June 2020) Supervisory authority Information Security Committee under the Ministry of Artificial Intelligence and Digital Development (MAIDD) Traffic-light rationale — Amber Core statute and a newly consolidated supervisory body are confirmed (T1/T2), but registration/filing mechanics and territorial-scope language remain unconfirmed in available sources. #### Sub-modules (5) #### Regulator And AuthorityAmber Supervisory function now sits with the Information Security Committee under MAIDD, established by government decision to regulate and enforce data-protection and information-security law. Claims (6): - The Government of Kazakhstan approved the Information Security Committee under the Ministry of Artificial Intelligence and Digital Development (MAIDD) to regulate, implement, and oversee personal data protection and information security, including issuing penalties for violations. - Ministry of Artificial Intelligence and Digital Development — Unscheduled inspections of businesses for personal-data compliance. - The Ministry of Artificial Intelligence and Digital Development is the national authorised body for personal-data protection; within the AIFC, the AFSA-appointed Commissioner of Data Protection administers a separate regime under AIFC Data Protection Regulations 2017. - AFSA Commissioner of Data Protection — AIFC Commissioner of Data Protection is distinct from the national Ministry responsible outside the AIFC - Ministry of Artificial Intelligence and Digital Development / AFSA Commissioner of Data Protection — in_force - Information Security Committee (MAIDD) — The Government of Kazakhstan established the Information Security Committee under MAIDD to regulate, implement and oversee personal-data protection and information security, including issuing penalties for violations. #### Act And InstrumentsGreen Primary instrument is Law No. 94-V (2013), amended/operationalised by Law No. 347-VI (2020) which introduced the data protection authority function and consent/legitimate-purpose collection requirements. Claims (10): - The Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V On Personal Data and its Protection is the primary omnibus instrument governing personal data processing in Kazakhstan. - The Law of 25 June 2020 No. 347-VI on Amendments and Regulation of Digital Technologies established a data protection authority function and introduced requirements that personal data be collected and processed with valid consent and legitimate purpose. - Law No. 326-VIII, signed 24 June 2026, amends Law No. 94-V 'On Personal Data and Their Protection'; most personal-data provisions enter into force 25 August 2026. - Law No. 326-VIII — Law No. 94-V 'On Personal Data and Its Protection'; signed 24 June 2026, most provisions in force 25 August 2026 - Rules for the Implementation of Personal Data Protection Measures — New version in force 12 July 2026, introducing revised organisational/technical security requirements for restricted-access personal data - The definition of personal data under Law No. 94-V is amended effective 11 July 2026. - Law No. 326-VIII (24 June 2026) — Law No. 326-VIII amended Law No. 94-V, with the personal-data-identifier-based redefinition of 'personal data' effective 11 July 2026 and most remaining amendments effective 25 August 2026. - Law No. 94-V 'On Personal Data and Their Protection' — in_force - Law No. 326-VIII of 24 June 2026 — Personal-data-protection amendments (Article 1, paragraph 37) entered into force 25 August 2026 - Law No. 94-V 'On Personal Data and its Protection' — Law No. 94-V (21 May 2013) is the primary omnibus instrument governing personal-data processing in Kazakhstan outside the AIFC. #### Material ScopeAmber Material scope is elaborated via subordinate MDAI Rules for the Collection and Processing of Personal Data, covering data-subject rights to information and rectification. Claims (4): - The MDAI Rules for the Collection and Processing of Personal Data (approved 23 October 2020) set requirements for collection, use and processing of personal data and set out data-subject rights including the right to be informed of what data is collected and for what purpose, and the right to rectify. - Law No. 94-V — Definition changed from medium-anchored to 'personal data identifier'-anchored, effective 11 July 2026 - Law No. 94-V — Personal data now means information supplemented by a 'personal data identifier', decoupling the definition from physical medium and biometric-data anchoring. - Law No. 326-VIII (material-scope amendment) — Personal-data definition amended to focus on personal-data identifiers from 11 July 2026, bringing standalone data items into scope when used with an identifier #### Territorial ScopeRed No confirmed statutory language on extraterritorial/non-established-controller application was located in available sources. Claims (1): - Kazakhstan data protection framework — Any organisation processing Kazakhstani residents' data, regardless of processing location. #### Regulator Registration And FilingRed A registrar/notification model for data-processing operators has been proposed via draft amendments but had no confirmed enactment timeline as of the last located public consultation record. Claims (7): - Draft amendments published for public consultation by MDAI in April 2021 proposed introducing a registrar and notification requirements for data-processing operators, with no confirmed enactment timeline. - Law No. 94-V (Chapter 3) — New processor-registry requirement effective 25 Aug 2026. - Law No. 94-V (as amended, Chapter 3) — Requires notification to MAIDD of the start and end of personal-data processing, recorded in a new state register of persons collecting/processing personal data, effective 25 August 2026. - Central executive body for personal-data protection — Register of entities collecting/processing personal data, effective 25 August 2026 - Kazakhstan personal-data register — A new register of data collectors/processors is being established effective 25 August 2026. - Law No. 326-VIII introduces a mandatory duty on data owners, operators and third parties to notify the authorised body of commencement and termination of personal-data processing; applies only to 'large' owners/operators (500,000+ unique subjects). - Law No. 94-V (as amended) — in_force #### Key findings (3) - — source on file - — source on file - — source on file Kazakhstan's data-protection regime rests on the omnibus Law No. 94-V of 21 May 2013 On Personal Data and its Protection, amended and operationalised by the Law of 25 June 2020 No. 347-VI. The Law provides for the establishment of a data protection authority, which will carry out its competencies in the management of data protection supervision and enforcement and issue guidance and clarifications, and introduces new data collection and processing requirements such as the need for data to be collected and processed both with valid consent and through legitimate purposes. Supervisory capacity has since been consolidated: the government approved the Information Security Committee under the Ministry of Artificial Intelligence and Digital Development (MAIDD), which will regulate, implement, and oversee activities in informatization, personal data protection, and information security. Registration/filing obligations remain in a state of flux, with a registrar/notification model only at draft stage as of the last confirmed public consultation. Periodic update · new data 2026-11-04 #### Regulator & Framework Kazakhstan's national personal-data regime continues to sit under the Ministry of Artificial Intelligence and Digital Development, which acts as the authorised body for personal-data protection, while a separate regime applies within the Astana International Financial Centre, where the AFSA-appointed Commissioner of Data Protection administers the AIFC Data Protection Regulations 2017. This dual-perimeter structure is a standing feature of the Kazakhstani framework and has not changed. What has changed is the law those national authorities administer. Law No. 326-VIII, adopted 24 June 2026, amends the principal personal-data statute, Law No. 94-V 'On Personal Data and Their Protection'. The redefinition of 'personal data' around a personal-data identifier, rather than around physical medium or biometric linkage, took effect on 11 July 2026, and most of the remaining amendments took effect on 25 August 2026. The amendment wave is now substantially in force rather than pending. Among the provisions that took effect on 25 August 2026 is a new registration requirement: controllers must notify the Ministry of the start and the end of personal-data processing, with that notification recorded in a newly created state register of persons collecting or processing personal data. This converts what was previously an internal compliance matter into a filing obligation with the national authority, and it applies to both controllers and processors. The AIFC's separate regime under the 2017 Regulations appears unaffected by this national-law amendment wave, preserving the jurisdictional split between the two regimes. The overall picture is of a national framework that has moved from amendment to implementation over the course of 2026, with the authorised body's practical supervisory toolkit - via the new processing register - now broader than it was before the amendment wave took effect. #### Outlook The amendments are now in force, so the near-term question is one of implementation and enforcement practice under the new Chapter 3 processing-notification mechanism, including how the Ministry operates the new state register in practice. Primary-source confirmation directly from the Ministry or the AIFC has not yet been obtained; reliance at present is on law-firm and press commentary describing the enacted text. 4 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework Kazakhstan's data-protection framework rests on Law No. 94-V 'On Personal Data and Their Protection,' as now amended by Law No. 326-VIII, signed 24 June 2026. Most provisions of the amending law enter into force on 25 August 2026, and the amendment introduces a mandatory duty for data owners, operators and third parties to notify the authorised body of the commencement and termination of personal-data processing. This notification duty is confined to 'large' owners or operators, defined by reference to a subject-count threshold of five hundred thousand or more unique subjects, so smaller controllers fall outside this specific registration-style obligation even as the broader law applies to them in other respects. Whether the national registry process associated with this notification duty has begun operating, and what form the notification itself takes, has not been verified in the material available. Separately, whether Kazakhstan's distinct AIFC Data Protection Regulations, which apply within the Astana International Financial Centre's own legal perimeter, have been amended in step with these national changes to Law No. 94-V has also not been verified, leaving the relationship between the two regimes an open question going into the law's August commencement date. #### Outlook The commencement of most of Law No. 326-VIII's provisions on 25 August 2026 is the central date to track for this module. Beyond that date, the two unresolved questions are whether the large-controller notification registry is operating in practice and what filing form it requires, and whether the AIFC's parallel data-protection perimeter is being brought into alignment with the national law. Periodic update · new data 2026-10-18 #### Regulator & Framework Kazakhstan's foundational data-protection statute, Law No. 94-V, underwent two separate amending interventions that together reshape the framework's core definitions and instrument structure. Law No. 256-VIII amended the statute with effect from 12 July 2026, while Law No. 326-VIII, signed by President Tokayev on 24 June 2026, amended it further with its Article 1, paragraph 37 provisions entering force on 25 August 2026. Taken together, these two laws represent the principal legislative vehicle through which Kazakhstan's data-protection framework was tightened this cycle. A central element of this amendment wave is the redefinition of the material scope of personal data itself. From 11 July 2026, the personal-data definition was amended to focus on the concept of personal-data identifiers, which has the effect of bringing standalone data items into scope where they are used in conjunction with an identifier, even where those items would not independently qualify as personal data. This identifier-centred approach represents the framework's shift toward assessing personal-data status in context, considering whether a data item can be linked to an identifying element, rather than classifying data items as personal or non-personal in isolation. Alongside the legislative amendments, Order No. 338/НҚ of 22 June 2026 entirely restated the Rules for the Implementation of Personal Data Protection Measures by Data Controllers and/or Data Processors and Third Parties, with the restated rules in force from 12 July 2026. An entire restatement, rather than a targeted amendment, of implementing rules of this kind typically signals that the regulator intended a comprehensive refresh of operational requirements rather than incremental adjustment, consistent with the broader tightening pattern visible across this cycle's amendment wave. What remains outstanding from a sourcing perspective is a consolidated primary text from Adilet.zan.kz, Kazakhstan's official legal-text portal, incorporating both the January and June 2026 amendment waves into a single current version of Law No. 94-V. The claims in this brief are sourced from secondary legal commentary describing the effect of the amendments rather than from the consolidated statutory text itself. #### Outlook The framework's near-term trajectory depends substantially on how the identifier-centred personal-data definition is applied in practice, since an identifier-based test can expand or contract the practical scope of personal data considerably depending on implementing guidance or enforcement interpretation. Retrieval of the consolidated Adilet.zan.kz text incorporating both 2026 amendment waves would materially improve confidence in the precise statutory language now in force, an improvement this cycle's secondary-source-dependent record was not able to deliver. Periodic update · new data 2026-10-11 #### Regulator & Framework Kazakhstan operates a dual-track data-protection framework. The national regime, outside the Astana International Financial Centre, is administered by a Ministry-level authority, while within the AIFC the AFSA Commissioner of Data Protection administers a distinct regime under AIFC-specific rules. This cycle saw the most significant restructuring of the national statute since its enactment: Law No. 326-VIII, signed 24 June 2026, amended Law No. 94-V 'On Personal Data and Its Protection', with the bulk of provisions entering into force on 25 August 2026. A new, earlier-effective change took hold on 11 July 2026, when the statutory definition of personal data shifted from one anchored to the medium on which data is held to one anchored on a 'personal data identifier'. Alongside the primary statute, a new version of the Rules for the Implementation of Personal Data Protection Measures entered into force on 12 July 2026, introducing revised organisational and technical security requirements for restricted-access personal data. The central executive body responsible for personal-data protection also introduced a new register of entities that collect or process personal data, effective 25 August 2026, creating a registration obligation that did not previously exist in this form. #### Outlook The consolidated text of Law No. 94-V incorporating the January, June and August 2026 amendment waves has not yet been independently retrieved to a primary Adilet.zan.kz source this cycle, and the precise territorial scope of the national regime, as distinct from the AIFC regime, has not been independently pinpointed. Resolution of either gap would sharpen the picture of which entities fall under which of Kazakhstan's two parallel data-protection frameworks. Periodic update · new data 2026-09-28 #### Regulator & Framework Kazakhstan's personal-data protection regime outside the Astana International Financial Centre continues to be anchored by Law No. 94-V, 'On Personal Data and its Protection', dated 21 May 2013, the primary omnibus instrument governing personal-data processing. Supervisory authority rests with the Information Security Committee, established under the Ministry of Digital Development, Innovation and Aerospace Industry (MAIDD), which regulates, implements and oversees personal-data protection and information security, including issuing penalties for violations. This cycle brought the most substantial amendment to that framework in some time. Law No. 326-VIII, signed 24 June 2026, restated the statutory definition of personal data with effect from 11 July 2026, narrowing its focus onto specific identifiers: full name, Individual Identification Number (IIN), facial image, and facial biometric vector and its derivatives. This is a materially tighter and more technically specific definition than a general-purpose omnibus definition would typically provide, and it signals a regulatory focus on biometric and identity-linked data specifically. The same amendment wave established two new state registers, both effective 25 August 2026: a register of persons and entities engaged in the collection and/or processing of personal data, and a separate register of personal-data security breaches. These registers create new registration and filing obligations for data controllers and processors that did not previously exist under the 2013 framework, and they represent a shift toward a more transparent, centrally-tracked population of data handlers. #### Outlook The primary consolidated text of Law No. 326-VIII on Adilet.zan.kz has not been independently retrieved this cycle; all findings here rest on secondary legal-advisory summaries from multiple firms. Confirmation against the primary statutory text would sharpen confidence in the precise scope of the new registers and the definitional changes. Watch for MAIDD's implementing procedures, expected to operationalise the registers now that their August 2026 effective date has passed. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (28) - [DataGuidance](https://www.dataguidance.com/news/kazakhstan-government-establishes-information-security) — The Government of Kazakhstan approved the Information Security Committee under the Ministry of Artificial Intelligence and Digital Development (MAIDD) to regulate, implement, and oversee personal data protection and information security, including issuing penalties for violations. - [DataGuidance (mirroring official text)](https://www.dataguidance.com/legal-research/law-republic-kazakhstan-21-may-2013-no-94-v-personal-data-and-its-protection) — The Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V On Personal Data and its Protection is the primary omnibus instrument governing personal data processing in Kazakhstan. - [DataGuidance](https://www.dataguidance.com/news/kazakhstan-provisions-processing-requirements-and-data-protection-authority-enter-force) — The Law of 25 June 2020 No. 347-VI on Amendments and Regulation of Digital Technologies established a data protection authority function and introduced requirements that personal data be collected and processed with valid consent and legitimate purpose. - [DataGuidance](https://www.dataguidance.com/news/kazakhstan-mdai-approves-rules-collection-and) — The MDAI Rules for the Collection and Processing of Personal Data (approved 23 October 2020) set requirements for collection, use and processing of personal data and set out data-subject rights including the right to be informed of what data is collected and for what purpose, and the right to rectify. - [DataGuidance](https://www.dataguidance.com/news/kazakhstan-mdai-publishes-proposed-amendments-data) — Draft amendments published for public consultation by MDAI in April 2021 proposed introducing a registrar and notification requirements for data-processing operators, with no confirmed enactment timeline. - [Uppersetup](https://uppersetup.com/en/blog/personal-data-and-localisation-in-kazakhstan-in-2026-law-no) — Law No. 94-V (Chapter 3) — New processor-registry requirement effective 25 Aug 2026. - [Wikipedia](https://en.wikipedia.org/wiki/Ministry_of_Artificial_Intelligence_and_Digital_Development) — Law No. 326-VIII, signed 24 June 2026, amends Law No. 94-V 'On Personal Data and Their Protection'; most personal-data provisions enter into force 25 August 2026. - [Uppersetup](https://uppersetup.com/en/blog/personal-data-and-localisation-in-kazakhstan-in-2026-law-no) — Law No. 94-V (as amended, Chapter 3) — Requires notification to MAIDD of the start and end of personal-data processing, recorded in a new state register of persons collecting/processing personal data, effective 25 August 2026. - [https://www.ey.com/en_kz/technical/tax-alerts/2026/09/kazakhstan-personal-data-law-amendments-deletion-anonymisation-data-breach-register](https://www.ey.com/en_kz/technical/tax-alerts/2026/09/kazakhstan-personal-data-law-amendments-deletion-anonymisation-data-breach-register) — Law No. 326-VIII — Law No. 94-V 'On Personal Data and Its Protection'; signed 24 June 2026, most provisions in force 25 August 2026 - [https://www.bakermckenzie.com/en/insight/publications/2026/07/kazakhstan-new-amendments-to-personal-data-legislation](https://www.bakermckenzie.com/en/insight/publications/2026/07/kazakhstan-new-amendments-to-personal-data-legislation) — Rules for the Implementation of Personal Data Protection Measures — New version in force 12 July 2026, introducing revised organisational/technical security requirements for restricted-access personal data - [https://www.ey.com/en_kz/technical/tax-alerts/2026/07/personal-data-protection-rules-updated-kazakhstan-2026](https://www.ey.com/en_kz/technical/tax-alerts/2026/07/personal-data-protection-rules-updated-kazakhstan-2026) — Law No. 94-V — Definition changed from medium-anchored to 'personal data identifier'-anchored, effective 11 July 2026 - [https://www.morganlewis.com/pubs/2026/07/republic-of-kazakhstan-data-protection-law-amendments-in-2026](https://www.morganlewis.com/pubs/2026/07/republic-of-kazakhstan-data-protection-law-amendments-in-2026) — Central executive body for personal-data protection — Register of entities collecting/processing personal data, effective 25 August 2026 - [Morgan Lewis](https://www.morganlewis.com/pubs/2026/07/republic-of-kazakhstan-data-protection-law-amendments-in-2026) — The definition of personal data under Law No. 94-V is amended effective 11 July 2026. - [GRATA International](https://gratanet.com/publications/persona-data-protection-state-oversight-and-legislative-updates) — Ministry of Artificial Intelligence and Digital Development — Unscheduled inspections of businesses for personal-data compliance. - [EY Kazakhstan](https://www.ey.com/en_kz/technical/tax-alerts/2026/07/personal-data-protection-rules-updated-kazakhstan-2026) — Law No. 94-V — Personal data now means information supplemented by a 'personal data identifier', decoupling the definition from physical medium and biometric-data anchoring. - [VLO Law Firms](https://vlolawfirm.com/legal-updates/kazakhstan-2026-q3-data-protection) — Kazakhstan data protection framework — Any organisation processing Kazakhstani residents' data, regardless of processing location. - [Morgan Lewis](https://www.morganlewis.com/pubs/2026/07/republic-of-kazakhstan-data-protection-law-amendments-in-2026) — Kazakhstan personal-data register — A new register of data collectors/processors is being established effective 25 August 2026. - [Wikipedia](https://en.wikipedia.org/wiki/Ministry_of_Artificial_Intelligence_and_Digital_Development) — The Ministry of Artificial Intelligence and Digital Development is the national authorised body for personal-data protection; within the AIFC, the AFSA-appointed Commissioner of Data Protection administers a separate regime under AIFC Data Protection Regulations 2017. - [Morgan Lewis](https://www.morganlewis.com/pubs/2026/07/republic-of-kazakhstan-data-protection-law-amendments-in-2026) — Law No. 326-VIII (24 June 2026) — Law No. 326-VIII amended Law No. 94-V, with the personal-data-identifier-based redefinition of 'personal data' effective 11 July 2026 and most remaining amendments effective 25 August 2026. - [https://www.bakermckenzie.com/en/insight/publications/2026/07/kazakhstan-new-amendments-to-personal-data-legislation](https://www.bakermckenzie.com/en/insight/publications/2026/07/kazakhstan-new-amendments-to-personal-data-legislation) — AFSA Commissioner of Data Protection — AIFC Commissioner of Data Protection is distinct from the national Ministry responsible outside the AIFC - [Uppersetup](https://uppersetup.com/en/blog/personal-data-and-localisation-in-kazakhstan-in-2026-law-no) — Law No. 326-VIII introduces a mandatory duty on data owners, operators and third parties to notify the authorised body of commencement and termination of personal-data processing; applies only to 'large' owners/operators (500,000+ unique subjects). - [Wikipedia](https://en.wikipedia.org/wiki/Ministry_of_Artificial_Intelligence_and_Digital_Development) — Ministry of Artificial Intelligence and Digital Development / AFSA Commissioner of Data Protection — in_force - [Morgan Lewis](https://www.morganlewis.com/pubs/2026/07/republic-of-kazakhstan-data-protection-law-amendments-in-2026) — Law No. 94-V 'On Personal Data and Their Protection' — in_force - [Uppersetup](https://uppersetup.com/en/blog/personal-data-and-localisation-in-kazakhstan-in-2026-law-no) — Law No. 94-V (as amended) — in_force - [https://www.ey.com/en_kz/technical/tax-alerts/2026/09/kazakhstan-personal-data-law-amendments-deletion-anonymisation-data-breach-register](https://www.ey.com/en_kz/technical/tax-alerts/2026/09/kazakhstan-personal-data-law-amendments-deletion-anonymisation-data-breach-register) — Law No. 326-VIII of 24 June 2026 — Personal-data-protection amendments (Article 1, paragraph 37) entered into force 25 August 2026 - [Wikipedia](https://en.wikipedia.org/wiki/Ministry_of_Artificial_Intelligence_and_Digital_Development) — Information Security Committee (MAIDD) — The Government of Kazakhstan established the Information Security Committee under MAIDD to regulate, implement and oversee personal-data protection and information security, including issuing penalties for violations. - [Morgan Lewis](https://www.morganlewis.com/pubs/2026/07/republic-of-kazakhstan-data-protection-law-amendments-in-2026) — Law No. 94-V 'On Personal Data and its Protection' — Law No. 94-V (21 May 2013) is the primary omnibus instrument governing personal-data processing in Kazakhstan outside the AIFC. - [https://www.morganlewis.com/pubs/2026/07/republic-of-kazakhstan-data-protection-law-amendments-in-2026](https://www.morganlewis.com/pubs/2026/07/republic-of-kazakhstan-data-protection-law-amendments-in-2026) — Law No. 326-VIII (material-scope amendment) — Personal-data definition amended to focus on personal-data identifiers from 11 July 2026, bringing standalone data items into scope when used with an identifier ### Kazakhstan: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Consent threshold is confirmed at T1/T2; special categories, pseudonymisation/anonymisation safe-harbours are unconfirmed gaps. Primary framework Law No. 94-V (2013), as amended by Law No. 347-VI (2020) Supervisory authority Information Security Committee under MAIDD Traffic-light rationale — Amber Consent threshold is confirmed at T1/T2; special categories, pseudonymisation/anonymisation safe-harbours are unconfirmed gaps. Periodic update · new data 2026-11-04 #### Lawful Processing & Special Data A substantive new restriction on the use of publicly available personal data took effect on 25 August 2026 under Article 7.11 of Law No. 94-V as amended. The provision prohibits the unauthorised extraction or accumulation of publicly available personal data for the purpose of building or expanding databases, without the data subject's express consent. The provision also clarifies a point that had previously been ambiguous: a person's voluntary decision to publish their own personal data does not, by itself, constitute consent to further collection or dissemination of that data by third parties. This closes a gap that scraping and database-aggregation practices had previously been able to exploit by treating public availability as equivalent to consent. Alongside this restriction, the same effective date brought a set of new statutory definitions into the law: automated processing, anonymisation, masking, hashing and personal-data security breach are now each defined terms. The definition of 'personal data' itself was reoriented around the concept of a personal-data identifier, rather than being tied to a physical medium or to biometric linkage as under the prior formulation. Together, the new anti-extraction rule and the new definitional architecture mark a clear tightening of the lawful-processing baseline: the law now reaches activity - bulk collection of ostensibly public data - that the prior text did not clearly address, and it does so with a firmer conceptual vocabulary for anonymisation and pseudonymisation-adjacent techniques than existed before. These changes apply uniformly to both controllers and processors, and they engage regardless of sector, which distinguishes this update from narrower sectoral interventions. The practical effect for any entity that aggregates personal data from public sources - whether for commercial enrichment, due-diligence, or analytics purposes - is that such activity now requires an identifiable legal basis of express consent rather than an assumption that public availability suffices. #### Outlook How Kazakhstani authorities interpret 'building or expanding databases' in practice, and what counts as adequate express consent in this context, are the open questions following the 25 August 2026 effective date. No enforcement action under the new Article 7.11 provision has been identified to date; the provision is new enough that implementation practice has not yet become visible in available reporting. Periodic update · new data 2026-10-25 #### Lawful Processing & Special Data Law No. 326-VIII introduces a risk-based classification system for controllers and the databases they hold, under a new Article 25-1 of Law No. 94-V as amended. Under this system, a database would ordinarily be classified as 'small' where it covers fewer than ten thousand unique subjects, but the amendment provides that any database containing biometric data is reclassified upward to the 'medium' tier regardless of how few subjects it covers. This means the presence of biometric data, rather than the volume of subjects processed, independently determines a meaningful part of a controller's regulatory tier and, by extension, the compliance obligations that attach to that tier. The practical significance of this reclassification is that controllers holding comparatively small datasets, who might otherwise have assumed a lighter compliance posture based on subject-count alone, must now separately assess whether any biometric data within that dataset pushes them into the medium tier. This is a tightening of the classification test specifically targeted at sensitive-category data rather than at overall processing scale. #### Outlook The reclassification rule takes effect alongside the rest of Law No. 326-VIII's provisions from 25 August 2026. What to watch is whether implementing guidance clarifies the precise definition of biometric data for the purposes of this reclassification test, and whether further categories of special data beyond biometric data are brought within the same upward-reclassification logic in future amendments. Periodic update · new data 2026-10-18 #### Lawful Processing & Special Data Kazakhstan introduced a more granular lawful-processing requirement specific to automated decision-making this cycle. From 25 August 2026, Law No. 326-VIII requires specific consent for automated processing of personal data and establishes a corresponding right to object to such processing. This represents a tightening of the lawful-basis framework as it applies to automated processing specifically, distinguishing it from the more general consent and lawful-basis provisions that apply to manual or non-automated processing under the pre-existing framework. The requirement for specific consent, rather than reliance on a general consent previously obtained for other processing purposes, suggests that automated processing is now treated as requiring its own distinct lawful-basis justification under Kazakhstani law. Pairing this consent requirement with an explicit objection right gives data subjects a mechanism to resist automated processing even after initially consenting to it, a structure that provides an ongoing control point rather than a one-time gating decision at the point consent is first given. This development sits within the same 25 August 2026 effective-date wave as the controller/processor classification tiers described under Controller/Processor Duties, and the two provisions are best read together: entities newly classified into higher processing tiers, particularly those engaged in large-scale automated processing, now face both a scale-based classification obligation and a processing-specific consent and objection requirement applicable to their automated-processing activity. The available record for this cycle does not extend to data-subject-rights provisions more broadly, such as access or rectification deadlines, which were not independently re-verified against a primary source this cycle; the automated-processing consent and objection requirement is the specific lawful-processing development evidenced this cycle, and should not be read as representing a comprehensive re-statement of Kazakhstan's full data-subject-rights architecture. #### Outlook How Kazakhstani controllers operationalise the new automated-processing consent and objection requirement, particularly whether implementing guidance clarifies what constitutes automated processing for these purposes, is the clearest open question following this cycle's amendments. The interaction between this consent requirement and the new controller-classification tiers, specifically whether larger-tier controllers face additional documentation or disclosure obligations when relying on automated-processing consent, is a related area likely to develop further as the 25 August 2026 changes bed in. Periodic update · new data 2026-10-11 #### Lawful Processing & Special Data Amendments effective 25 August 2026 under Law No. 94-V, as amended by Law No. 326-VIII, tightened the rules governing already-published personal data. The law now provides that a data subject's own publication of their personal data does not imply consent to its further collection, use, or dissemination by others, and imposes a masking duty where such data is republished. This closes what had been a gap around data that individuals had themselves made public, treating self-publication as distinct from a general waiver of protection. The same amendment wave added statutory definitions, effective 25 August 2026, for deletion, anonymisation, masking, hashing, and personal data security breach, terms that had not previously been defined in the statute and that now give the law vocabulary to describe the technical lifecycle of personal data from collection through to destruction. #### Outlook The practical application of the new consent-limitation rule for self-published data, including how masking duties on republication will be enforced in practice, has not yet been tested; how the regulator interprets the new definitions of anonymisation and masking against actual processing practices will be a significant point to watch following the 25 August 2026 effective date. Periodic update · new data 2026-09-28 #### Lawful Processing & Special Data Two related developments under Law No. 326-VIII, both effective 25 August 2026, tighten the lawful-processing framework in Kazakhstan. First, the amendments clarify that a data subject's voluntary publication of their own personal data in the public domain does not automatically constitute consent to subsequent collection, dissemination or further processing of that data by others. This closes what had been an ambiguous gap: previously, publicly available data carried uncertain consent status for downstream processors, and this clarification narrows the lawful basis available to anyone relying on public availability alone as a justification for further processing. Second, the same amendment wave introduced new statutory definitions of automated processing, anonymization, masking, personal-data security breaches and hashing, effective August 2026. These definitions provide the technical scaffolding underlying the security-measures obligations elsewhere in the amended law (see Controller/Processor Duties), giving controllers and processors a firmer statutory basis for understanding what counts as anonymised or masked data, and by extension what data may fall outside the scope of certain obligations. #### Outlook The practical interaction between the new consent clarification and existing sectoral practices — particularly around scraped or aggregated public data — has not been tested or clarified this cycle. Watch for MAIDD guidance or early enforcement practice interpreting the new definitions, none of which has been identified in the evidence available this cycle. D2 · Lawful Processing — Full Module Record 4 sub-modules · 43 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kazakhstan: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Partial rights (access/rectification) confirmed in force; erasure is draft-stage only; portability, restriction/objection and deadlines are unconfirmed gaps. Primary framework Law No. 94-V (2013); MDAI Rules for the Collection and Processing of Personal Data (2020) Supervisory authority Information Security Committee under MAIDD Traffic-light rationale — Amber Partial rights (access/rectification) confirmed in force; erasure is draft-stage only; portability, restriction/objection and deadlines are unconfirmed gaps. #### Sub-modules (5) #### Access RightGreen Right to be informed on what personal data is collected/stored and for what purpose is set out in the 2020 Rules. Claims (2): - The 2020 MDAI Rules for the Collection and Processing of Personal Data include the right to be informed on what personal data is collected and stored and for what purposes. - Kazakhstan personal-data legislation — Right to information about processing, right to withdraw consent, right to request modification/blocking/destruction #### Rectification And ErasureAmber Right to rectify is confirmed in force; right to erasure exists only as a draft-amendment proposal. Claims (2): - The 2020 MDAI Rules for the Collection and Processing of Personal Data include the right to rectify personal data. - Draft amendments to the Personal Data Law would introduce a right to erasure not present in the current operative regime. #### Restriction And ObjectionRed No confirmed restriction/objection (including profiling opt-out) right was located. #### Data PortabilityRed No confirmed data-portability right was located. #### Deadlines And Response WindowsRed No confirmed statutory deadline for controller response to data-subject requests was located. #### Key findings (3) - — source on file - — source on file - — source on file Confirmed data-subject rights are limited to the right to be informed and the right to rectify, set out in the 2020 MDAI Rules. A right to erasure appears only in unenacted draft amendments; portability, restriction/objection and statutory response deadlines were not confirmed. Sources and claims (4) - [DataGuidance](https://www.dataguidance.com/news/kazakhstan-mdai-approves-rules-collection-and) — The 2020 MDAI Rules for the Collection and Processing of Personal Data include the right to be informed on what personal data is collected and stored and for what purposes. - [DataGuidance](https://www.dataguidance.com/news/kazakhstan-mdai-approves-rules-collection-and) — The 2020 MDAI Rules for the Collection and Processing of Personal Data include the right to rectify personal data. - [DataGuidance](https://www.dataguidance.com/news/kazakhstan-mdai-publishes-proposed-amendments-data) — Draft amendments to the Personal Data Law would introduce a right to erasure not present in the current operative regime. - [Council of Europe (hosted KZ national report)](https://rm.coe.int/personal-data-protection-kazakhstan/48802c0464) — Kazakhstan personal-data legislation — Right to information about processing, right to withdraw consent, right to request modification/blocking/destruction ### Kazakhstan: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only retention-related and draft security-measure findings are confirmed; DPO, ROPA, joint-controller, breach-notification and DPIA sub-modules are unconfirmed gaps on a regime that otherwise claims omnibus status. Primary framework Law No. 94-V (2013); Government Decree of 12 November 2013 Supervisory authority Information Security Committee under MAIDD Traffic-light rationale — Red Only retention-related and draft security-measure findings are confirmed; DPO, ROPA, joint-controller, breach-notification and DPIA sub-modules are unconfirmed gaps on a regime that otherwise claims omnibus status. Periodic update · new data 2026-11-04 #### Controller/Processor Duties Two related obligations for controllers took effect on 25 August 2026 under the Law No. 326-VIII amendments to Law No. 94-V. First, the law now classifies personal-data controllers into small, medium and large categories, determined by the volume of personal data processed. Each category carries its own set of mandated technical and organisational security measures, including requirements around encrypted transmission and cryptographic protection of stored data; the technical Rules implementing this classification took effect slightly earlier, on 12 July 2026. This is a risk-based tiering of security obligations where none previously existed in this form, meaning the scope of a controller's security duties under Kazakhstani law now depends on the scale of its processing rather than applying uniformly across all controllers. Second, the amendments establish a register of personal-data security breaches, administered by the Ministry of Artificial Intelligence and Digital Development, also effective 25 August 2026. This creates a documented, centrally held record of breach events rather than leaving breach-handling as a matter addressed solely within each controller's own internal processes. Read together with the risk-tiered security-measures regime, the breach register gives the Ministry both an ex-ante classification tool - who must do what, by size of operation - and an ex-post accountability record - what went wrong and when - that did not exist in this combined form before the 2026 amendment wave. This tightening sits within a broader pattern across the 2026 amendments: the national framework is accumulating structural accountability mechanisms - registration, classification, breach recording - in a way the prior text did not provide for, strengthening the Ministry's supervisory position over controllers and processors without altering the dual-perimeter structure that keeps the AIFC's own regime separate. #### Outlook How the breach register is populated and used in practice, and how controllers are assigned to the small, medium or large categories in borderline cases, are the practical implementation questions that follow the 25 August 2026 effective date. Direct confirmation from the Ministry's own published Rules has not yet been obtained; current reporting relies on professional-services commentary describing the enacted provisions. Periodic update · new data 2026-10-25 #### Controller/Processor Duties Two controller/processor-facing developments converge. First, a new version of the Rules for the Implementation of Personal Data Protection Measures entered into force on 12 July 2026, introducing revised organisational and technical security measures that controllers and processors are required to apply when handling personal data. Second, Law No. 326-VIII establishes a register of personal-data security breaches, to be maintained by the authorised state body, which represents a new institutional mechanism for tracking breach events at the national level. The specific deadline and recipient test that would govern individual breach notification, meaning when and to whom a controller must notify an affected data subject directly following a breach, as distinct from the state-level breach register itself, has not been located in the material available. This leaves a practical gap between the existence of the state register and the controller-facing notification duty that would typically accompany it in a mature breach-notification regime. #### Outlook The security-measures update is already in force as of 12 July 2026, and the breach register is established by a law whose other provisions largely commence 25 August 2026. The specific question to track is whether implementing guidance or a subsequent instrument supplies the missing deadline and recipient test for individual breach notification to data subjects, which would complete the breach-notification duty as a practical compliance obligation rather than a state-register-only mechanism. Periodic update · new data 2026-10-18 #### Controller/Processor Duties Kazakhstan introduced a risk-tiered controller and processor classification system this cycle, a structural change to how compliance obligations are calibrated across the market. From 25 August 2026, Law No. 326-VIII classifies controllers and operators into three tiers: small, medium, covering entities processing data on 10,000 to 500,000 unique data subjects, and large, covering entities processing data on 500,000 or more unique data subjects. Entities handling restricted-access personal data are raised one tier above where their data-subject volume alone would place them, meaning the sensitivity of the data processed, not only its volume, factors into an entity's classification. Alongside this classification system, Order No. 338/НҚ of 22 June 2026 entirely restated the Rules for the Implementation of Personal Data Protection Measures by Data Controllers and/or Data Processors and Third Parties, with the restated rules in force from 12 July 2026. An entire restatement of implementing rules governing how controllers and processors must implement protective measures, delivered within weeks of the tiered-classification system taking shape, suggests the two instruments are intended to operate together: the classification tier determines which category of obligation an entity falls into, while the restated implementing rules set out what protective measures entities in each category, or more broadly, must follow. The classification system's three-tier structure, by volume of unique data subjects, with an uplift for restricted-access data, mirrors a risk-based regulatory design common internationally, scaling compliance burden to the scale and sensitivity of processing rather than applying a single uniform standard across all controllers regardless of size. The reported new breach-register obligation referenced in connection with this amendment wave is consistent with this risk-tiered design, though the specific documentation this cycle retrieved does not establish full procedural detail for how the breach register itself must be maintained or reported to the regulator. #### Outlook The practical operation of the three-tier classification system, particularly how entities determine their unique-data-subject count for classification purposes and how frequently that classification must be reassessed, is the clearest area requiring further regulatory or commercial guidance. The interaction between the restated Order No. 338/НҚ protective-measures rules and the classification tiers, specifically whether the restated rules impose differentiated protective-measure requirements by tier, is a related area this cycle's record does not fully resolve. Periodic update · new data 2026-10-11 #### Controller/Processor Duties Law No. 326-VIII's amendments to Law No. 94-V, effective 25 August 2026, introduced a risk-based classification of data controllers by the number of unique data subjects they process: small controllers process fewer than 10,000 data subjects, medium controllers process between 10,000 and 500,000, and large controllers process 500,000 or more. Alongside this classification, the amendments introduced a new data-breach register and raised administrative fines, which may now reach up to 2,000 monthly calculation indices for personal-data violations and up to 1,000 monthly calculation indices for cybersecurity-requirement violations. Separately, a new version of the Rules for the Implementation of Personal Data Protection Measures entered into force on 12 July 2026, introducing additional organisational and technical security measures specifically for restricted-access personal data, ahead of the broader August amendment wave. #### Outlook The exact breach-notification deadline and the recipient mechanics for the new breach register, meaning to whom and by when a breach must be reported, were not located in the sources available this cycle and remain an open question for controllers newly subject to the small, medium or large classification. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Law No. 326-VIII introduces a risk-based classification of personal-data controllers into small, medium and large categories, based on the volume of personal data processed. This classification is understood to scale obligations by category, though the specific obligations attached to each tier have not been detailed in the evidence retrieved this cycle. Separately, Article 23 of the Personal Data Law — restated as 'Protection of digital objects containing personal data' — now mandates the use of masking and hashing methods for digital objects containing personal data. The specific application procedure for this mandate is to be determined by MAIDD, meaning the practical compliance requirement is not yet fully specified pending that implementing guidance. This security-measures obligation draws directly on the new statutory definitions of masking, hashing and anonymization introduced in the same amendment wave (see Lawful Processing & Special Data). Both developments took effect 25 August 2026, alongside the new controller/processor and breach registers described under Regulator & Framework. Together they represent a coordinated tightening of controller and processor obligations: classification determines the scale of obligation, while Article 23 determines a specific technical security measure that applies regardless of tier. #### Outlook Breach-notification timelines under the new breach register were not specifically confirmed this cycle and remain a gap. Watch for MAIDD's implementing procedure for the Article 23 masking-and-hashing mandate, and for clarification of what obligations attach to each of the small, medium and large controller categories. D4 · Controller & Processor — Full Module Record 7 sub-modules · 46 words · 19 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kazakhstan: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Data-localisation mandate is clearly confirmed at T2; adequacy/SCC/BCR/TIA mechanisms are unconfirmed gaps, consistent with a localisation-first rather than adequacy-based transfer model. Primary framework Law No. 94-V (2013); Law on Informatisation No. 418-V (2015), as amended by Law No. 128-VI (2017) Supervisory authority Information Security Committee under MAIDD Traffic-light rationale — Amber Data-localisation mandate is clearly confirmed at T2; adequacy/SCC/BCR/TIA mechanisms are unconfirmed gaps, consistent with a localisation-first rather than adequacy-based transfer model. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 45 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kazakhstan: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Single confirmed sectoral overlay (telecoms) against six unconfirmed sub-modules; broad sectoral picture is materially incomplete. Primary framework Law on Informatisation No. 418-V (2015), as amended by Law No. 128-VI (2017) Supervisory authority Information Security Committee under MAIDD Traffic-light rationale — Red Single confirmed sectoral overlay (telecoms) against six unconfirmed sub-modules; broad sectoral picture is materially incomplete. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 34 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kazakhstan: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No sub-module returned confirmed evidence; this module carries a full absent-field gap rather than a substantive finding. Traffic-light rationale — Not assessed No sub-module returned confirmed evidence; this module carries a full absent-field gap rather than a substantive finding. #### Sub-modules (6) #### Cookies And TrackersRed No confirmed cookie/tracker consent rule located. #### Dark PatternsRed No confirmed dark-pattern prohibition located. #### Opt Out SignalsRed No confirmed recognition of opt-out signals (e.g., GPC) located. #### Clean Rooms And DcrRed No confirmed clean-room/data-collaboration-room rule located. #### Cross Context AdvertisingRed No confirmed cross-context-advertising rule (sale/share analogue) located. #### Direct MarketingRed No confirmed direct-marketing consent/suppression regime located. No confirmed cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room framework, cross-context-advertising rule, or direct-marketing consent/suppression regime specific to Kazakhstan was located in available sources. ### Kazakhstan: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sub-module returned confirmed evidence in this research pass; full absent-field gap. Traffic-light rationale — Red No sub-module returned confirmed evidence in this research pass; full absent-field gap. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance Kazakhstan's Law No. 230-VIII ZPK 'On Artificial Intelligence,' signed 17 November 2025, entered into force on 18 January 2026 and establishes a risk-tiered legal framework for AI systems operating within the country. The law states transparency, safety, accountability and data-privacy as among its governing objectives, positioning data-privacy as one of several named goals the risk-tiered structure is meant to serve, alongside the biometric-data reclassification rule under Law No. 326-VIII, which separately escalates a database's regulatory tier whenever it contains biometric data regardless of subject count. Whether Law No. 230-VIII imposes any data-protection-specific transparency duty beyond its general stated objectives, for example a specific disclosure requirement tied to an AI system's processing of personal data, has not been independently retrieved or verified in the material available. The law's stated objectives establish the policy direction, but the operative content translating those objectives into enforceable transparency obligations specific to data processing remains to be confirmed. #### Outlook The AI law has been in force since 18 January 2026, so the near-term question is not commencement but content: whether further implementing regulations or guidance under Law No. 230-VIII articulate concrete data-protection-specific transparency duties, and how the risk-tiered AI framework interacts in practice with the biometric-driven database reclassification rule introduced separately by Law No. 326-VIII. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Kazakhstan's statutory treatment of biometric personal data changed in a way that creates an interpretive ambiguity this cycle. Law No. 256-VIII of 9 January 2026 deleted the standalone statutory definition of biometric personal data from Article 1(1) of Law No. 94-V, with the deletion effective 12 July 2026. Notably, the term biometric personal data itself continues to be used elsewhere in the statute even though its dedicated defining provision has been removed, a legislative-drafting outcome that leaves open the question of what definition now governs the term's use in those remaining statutory provisions. This development should be read as probable rather than confirmed, reflecting the fact that the underlying evidence for this cycle traces to secondary commercial legal commentary rather than directly retrieved primary statutory text. The deletion itself, and the continued use of the term elsewhere in the statute, are both reported findings; what is not established from the available record is whether a general definition, a cross-reference to a different instrument, or an interpretive gap now governs how biometric personal data is treated under Kazakhstani law. The practical significance of this ambiguity is non-trivial for any entity processing biometric data in Kazakhstan, since biometric data typically attracts heightened processing obligations as a form of sensitive or special-category data. Without a clear statutory definition, entities and their advisers are left to infer the term's current scope from its remaining contextual uses in the statute, or to await clarifying guidance, implementing regulation, or judicial or regulator interpretation that resolves what the legislature intended by removing the standalone definition while retaining the term's operative use. #### Outlook The clearest development to watch is whether Kazakhstani authorities issue clarifying guidance, or whether a consolidated statutory text surfaces, resolving how biometric personal data is now defined following the removal of its standalone Article 1(1) definition. Until such clarification emerges, entities processing biometric data in Kazakhstan face genuine interpretive uncertainty as to the precise statutory scope of obligations attaching to that category of data. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance Kazakhstan's Law No. 230-VIII 'On Artificial Intelligence', in force since 18 January 2026, treats AI systems as digital objects across seven chapters and twenty-eight articles, and adds rules covering automated decisions and what the law terms digital sovereignty. On the biometric side, the redefined personal-data concept under Law No. 94-V, as amended, effective 11 July 2026, explicitly names full name, individual identification number, facial image, and facial biometric vector and its derivatives among the identifiers treated as personal data. Bringing facial biometric vectors and their derivatives within the statutory definition is a material extension of scope beyond raw facial images, reaching the processed biometric templates increasingly used in automated identification systems. #### Outlook How the AI Law's automated-decision rules interact with the personal-data law's biometric-identifier provisions in practice, particularly for facial-recognition systems that generate biometric vectors, has not yet been clarified by further guidance and is a point to watch as both frameworks mature. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 26 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kazakhstan: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No sub-module returned confirmed Kazakhstan-specific evidence in this research pass; full absent-field gap. Traffic-light rationale — Not assessed No sub-module returned confirmed Kazakhstan-specific evidence in this research pass; full absent-field gap. #### Sub-modules (5) #### Age VerificationRed No confirmed statutory age-of-consent threshold for data processing located. #### Parental ConsentRed No confirmed parental-consent mechanism located. #### Minor Profiling BansRed No confirmed profiling ban specific to minors located. #### Education SettingsRed No confirmed education-setting-specific rule located. #### Dependent AdultsRed No confirmed dependent-adult protection provision located. No confirmed Kazakhstan-specific age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection was located in available sources. ### Kazakhstan: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Penalty framework and a 2025 institutional consolidation are confirmed; enforcement track record, funding/capacity, and collective/private redress remain unconfirmed gaps. Primary framework Code of the Republic of Kazakhstan of 5 July 2014 No. 235-V on Administrative Infractions Supervisory authority Information Security Committee under MAIDD Traffic-light rationale — Amber Penalty framework and a 2025 institutional consolidation are confirmed; enforcement track record, funding/capacity, and collective/private redress remain unconfirmed gaps. Periodic update · new data 2026-11-04 #### Enforcement & Redress Administrative liability for personal-data and cybersecurity violations has been increased under the 2026 amendments to Law No. 94-V, effective 25 August 2026, raising the ceiling on fines that can be imposed for breaches of the law. A separate, earlier proposal from January 2026 would have raised the maximum fine from roughly USD 17,000 to roughly USD 42,500 and introduced criminal liability for mass personal-data leaks; whether that specific proposal has been enacted in its originally proposed form has not been confirmed, and the figures and the criminal-liability element should be read as a reported proposal whose final enacted status remains to be verified rather than as a confirmed figure. The pattern here is one of two distinct enforcement-related developments running on different tracks: a general increase in administrative fine ceilings that is confirmed as part of the in-force 2026 amendment wave, and a more specific criminal-liability proposal whose enactment status is still unresolved. Treating the two as a single confirmed development would overstate what is presently known; the general fines increase is the more securely evidenced of the two. This enforcement tightening sits alongside the accountability architecture introduced elsewhere in the 2026 amendments - the new processing register, the breach register, and the risk-tiered security obligations - which together give the Ministry a materially expanded supervisory and punitive toolkit compared with the position before the amendment wave, even setting aside the unresolved criminal-liability question. #### Outlook Whether the January 2026 proposal to raise the fine ceiling to roughly USD 42,500 and introduce criminal liability for mass data leaks is enacted in that form, and if so when, remains the open question for this module. Confirmation would most likely come through direct publication of the final legislative text, which has not yet been retrieved. Periodic update · new data 2026-10-25 #### Enforcement & Redress No specific enforcement decision or fine schedule tied to Kazakhstan's data-protection regime was located in the material available. The principal development bearing on enforcement and redress is institutional rather than case-specific: Law No. 326-VIII's commencement timeline, with most provisions taking effect 25 August 2026, is the main driver of what the enforcement landscape will look like going forward, since it is this law that creates both the large-controller notification duty and the new breach register maintained by the authorised state body. The breach register itself represents a potential future enforcement and redress mechanism, in that it creates an institutional record against which the authorised body could act, but the specific deadline and recipient test governing individual breach notification to affected data subjects, which would typically be the provision most directly tied to redress for an affected individual, has not been located. Absent that detail, it is not yet possible to assess how directly an individual data subject's redress rights are engaged by a breach event under the new regime. #### Outlook The 25 August 2026 commencement date is again the key marker here, since it brings the breach register and notification duty into force. What to watch beyond that date is whether any enforcement action or fine is issued under the amended law, and whether implementing guidance supplies the missing individual-notification deadline and recipient test that would complete the redress mechanism for affected data subjects. Periodic update · new data 2026-10-18 #### Enforcement & Redress Kazakhstan's current administrative-penalty ceiling for personal-data-protection violations sits under Article 79(4) of the Code of Administrative Offences, which sets a maximum fine of 2,000 MCI, equivalent to KZT 8,650,000 at the 2026 monthly calculation index, applicable to a large enterprise for failure to take protective measures resulting in loss or unlawful processing of personal data. This figure represents the current binding ceiling as it stands; no confirmed enforcement action or fine imposed under this specific tightened administrative-liability schedule was located during this cycle. A proposal to raise this ceiling is under active discussion but had not been adopted as at its announcement. On 10 September 2026, a Vice-Minister at the Ministry of Artificial Intelligence and Digital Development, Doszhan Musaliyev, proposed raising the maximum fine for repeated personal-data-protection violations by large companies from 2,000 to 5,000 MCI. As reported, this proposal remained pending discussion with other government agencies, businesses, and the Kurultai, Kazakhstan's representative assembly, meaning it had not become binding law as at the date of the announcement. Separately, earlier commentary from January 2026 recorded that the Ministry of Artificial Intelligence and Digital Development had proposed introducing criminal liability for mass leaks of citizens' personal data, a distinct and more severe form of liability from the administrative-fine increase proposed in September 2026. Both proposals point toward a direction of travel favouring materially stronger penalties for personal-data violations, though neither had been enacted as at the respective dates these proposals were reported. The gap between the current 2,000 MCI ceiling and the proposed 5,000 MCI ceiling, and the further gap between either administrative figure and a potential criminal-liability regime for mass leaks, together describe an enforcement landscape in active transition, with the direction of travel toward materially increased deterrence, but with the specific binding ceiling as at this cycle remaining the existing 2,000 MCI figure under Article 79(4). #### Outlook Whether the proposed increase to 5,000 MCI for repeated large-company violations, and the earlier-proposed criminal-liability regime for mass leaks, progress from proposal to enacted law is the central development to track in this module going forward. Any confirmed enforcement action applying either the current 2,000 MCI ceiling or a future increased ceiling would also be a significant development, since no such confirmed action was located this cycle despite the tightened classification and security-measure framework now in force. Periodic update · new data 2026-10-11 #### Enforcement & Redress Administrative fines under Kazakhstan's national data-protection regime rose materially this cycle: Law No. 94-V, as amended by Law No. 326-VIII and effective 25 August 2026, sets fines of up to 2,000 monthly calculation indices for personal-data violations and up to 1,000 monthly calculation indices for cybersecurity-requirement violations. This sits alongside the distinct AIFC enforcement track: under AIFC Data Protection Rules section 5.1, the AIFC Commissioner of Data Protection must give a written fine notice stating the contravention and the alleged facts before imposing a fine, a procedural safeguard specific to the AIFC regime and separate from the national enforcement process. #### Outlook How the national regulator will apply the new, higher fine caps in practice, and whether any enforcement action under the new breach-register regime is reported, are the two points most likely to clarify the practical bite of this cycle's enforcement-and-redress tightening. Periodic update · new data 2026-09-28 #### Enforcement & Redress Reports indicate that recent reforms have strengthened administrative liability for violations in the field of personal-data protection and introduced obligations to notify citizens in the event of data breaches. This is reported with probable rather than confirmed confidence, and no specific named enforcement action or decision has been identified in the evidence retrieved this cycle — the finding is a general strengthening trend rather than a discrete enforcement event. The Information Security Committee under MAIDD retains authority to issue penalties for violations of the personal-data framework, a standing feature of the regime's enforcement architecture. The new breach-notification obligation, once its specific procedural requirements are clarified, is expected to interact with the enforcement track by giving the regulator visibility into breach events through the newly-created breach register (see Regulator & Framework), which itself is effective 25 August 2026. #### Outlook Watch for the first substantive enforcement action or administrative penalty decision under the strengthened liability regime, and for confirmation of the specific breach-notification timelines that citizens and the regulator can expect once the breach register becomes operational. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 65 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action