Personal liability for data breaches: new rules in Kazakhstan
On July 1, new rules for the protection of personal data came into force in Kazakhstan. Now specific individuals will be held responsible for data leaks. These changes were introduced by the ICRIAP order of February 28, signed by former Minister of Digital Development Bagdat Musin.
On July 1, new rules for personal data protection, introduced by ICRIAP's order of February 28, became effective. These changes provide for personal liability for data leaks of Kazakhstani citizens.
The order was signed by former Minister of Digital Development Bagdat Musin. It clarifies the definition of personal data and establishes rules for its collection, protection, blocking, destruction and depersonalization. However, the new norm is particularly noteworthy.
Now, if there is a leakage of personal data, the operator responsible for them is obliged to notify the authorized body about the incident within one working day. At the same time, it will be necessary to specify the contact details of the person responsible for data processing at the time of the leak.
Thus, the specific administrator on duty at the time of the incident will be responsible for the data leak.