KazakhstanLaw on Personal Data and Their Protection, breach notification
In force since , effective .
A breach notification rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- An app that suffers a personal data security breach involving Kazakhstani data subjects must notify the competent authority within one business day from the moment the breach is detected, naming the contact details of the person responsible for organizing personal data processing where one exists. The Law runs this notice to the competent authority, not to the affected individuals.
These lines are LexLint's reading of the law's text. Also read by: Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, the competent authority for personal data protection: Rules for Notifying Data Subjects of a Personal Data Security Breach, Order No. 481/NK of , as reworded by Order No. 232/NK of (guidance, recorded ).
Who enforces it
Settledness
Under the competent authority's rules, notice to the affected data subjects is sent by the "digital government" operator from information the competent authority passes on, so the owner or operator's own notice runs to the competent authority.
- As of
- Guidance link
- https://adilet.zan.kz/rus/docs/V2400034919
- Guidance body
- Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, the competent authority for personal data protection: Rules for Notifying Data Subjects of a Personal Data Security Breach, Order No. 481/NK of , as reworded by Order No. 232/NK of
- Open questions
- Does Article 25(2)(8) require the owner or operator to notify the competent authority of every "personal data security breach", or only of a breach that puts the rights or legitimate interests of data subjects at risk?
- Does the duty in Article 25(2)(8) to notify the competent authority of a breach reach a third party that processes personal data, though Article 25(2) opens "The owner and (or) operator shall be obliged to"?
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 25(2)(5) obliges an owner or operator to give evidence that it obtained the subject's consent, which cannot be shown without a record. Article 25(2)(8), the clause this instrument is named for, requires the competent authority to be notified within one business day of detecting a breach; it is a duty to notify and says nothing about documenting or keeping a record of breaches. Article 25(2)(1-1) requires policy documents, which are not a log. Article 25(2)(3-1) lets the competent authority demand information on the methods and procedures used to comply, which is a power to ask rather than a named record.
- Kind
- Implicit
- As of
- Provision
- Article 25(2)(5)
- Trigger
- consent_or_optout
What this law does
Article 25(2)(8) requires the owner or operator, within one business day from the moment a personal data security breach is detected, to notify the competent authority, naming the contact details of the person responsible for organizing personal data processing where one exists.
The one-business-day deadline is stated in the lead-in to the list in which the sub-paragraph sits, and the competent authority's Rules for Notifying Data Subjects of a Personal Data Security Breach (Order No. 481/NK of , as reworded by Order No. 232/NK of ) repeat it in paragraph 4, under which the owner or operator notifies the competent authority within one working day of detecting the breach.
Article 25(2)(8) names the competent authority as the recipient of the breach notice. Under paragraph 7 of the Rules, the "digital government" operator, not the owner or operator, notifies the affected data subjects, on information it receives from the competent authority. A distinct Article 19(1) duty to notify the subject of a transfer of their data to a third person within ten business days should not be confused with a breach notice.
Law No. 326-VIII of supplemented the Law with Article 23-2, a register of personal data security breaches that the authorized body keeps from publicly available sources and from the cybersecurity operations centers and incident-response services, and Article 1(15-2) now defines a personal data breach. The Law of numbered 44-VIII added the breach-notice clause to Article 25(2)(8), by sub-paragraph 4 of paragraph 11 of its Article 1.
Article 2 of that Law brings that sub-paragraph into force from , an exception to its general rule of sixty calendar days after first official publication. Article 25 has been amended four times since the base Act's 2013 commencement, most recently by Law No. 326-VIII; the amendment before it, Law No. 44-VIII, states its own effective date directly in the base Act's footnote rather than by a from-publication formula.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .