Starting September 21, Kazakhstan is introducing new rules for handling personal data. The more information an organization stores, the higher the level of protection it will be required to provide. This includes Individual Identification Numbers (IINs), phone numbers, photographs, banking details and other data shared with digital services every day. Data operators will be divided into three categories – small, medium and large. The strictest requirements will apply to operators handling 500,000 or more records, including security assessments, cybersecurity monitoring and vulnerability testing. Additional safeguards will also apply to restricted-access databases containing over 100,000 records. In particular, users will be required to undergo identification and authentication. In the event of a security breach, an operator must notify the authorized body within one business day.
«Medium and small operators – those storing up to 10,000 records and those storing between 10,000 and 500,000 records will not be included in any registries at present. They will also not be required to send a notification that they are operating. However, this does not relieve them of their responsibility to ensure the protection of these data sets. The requirements for medium-sized operators are somewhat stricter, while those for small operators are fairly basic,» noted Yekaterina Smyshlyayeva, member of the Kurultai of the Republic of Kazakhstan.
«We have already had a platform in place for some time. It allows users to control access to their personal data. Anyone can log on to eGov and see what personal data is being processed and which organization is processing it. For instance, if you log in and see that certain banks or organizations have access to your personal data, and you know that you have no obligations to that company, you can simply click a button and revoke access to your personal data. This service is already operational,» said Umitzhan Arykbekova, Deputy Chair of the Information Security Committee, Kazakh Ministry of Artificial Intelligence and Digital Development.
The protection of personal data is enshrined in Article 21 of the Constitution. It guarantees the right to privacy and protects personal information from unlawful use. The new rules strengthen organizations’ responsibility, and Kazakh citizens will not only know where their personal data is being shared, but also understand how exactly it is being protected.
Related Articles
