Kazakhstan Proposes Criminal Penalties for Mass Personal Data Leaks

Kazakhstan’s Ministry of Artificial Intelligence and Digital Development proposed introducing criminal liability for mass leaks of citizens’ personal data and raising administrative penalties for failures to meet information security requirements. The proposal was presented by First Deputy Minister Rostislav Konyashkin during a government meeting, framing the move as a “zero tolerance” approach to mishandling personal digital data and positioning data protection as a core element of the country’s digital transformation agenda.

Reporting indicated the initiative would also increase the maximum administrative fine for officials violating information security standards from roughly $17,000 to about $42,500, and would apply across government agencies, quasi-public entities, financial institutions, and private companies handling large volumes of personal data. Separately, President Kassym-Jomart Tokayev publicly emphasized elevating personal data protection to a constitutional-level right, signaling broader political backing for stricter enforcement and accountability around large-scale data breaches.