News and developments
The Law Amending Legislative Acts on Information Security and Digital Assets
Informatization and Digital Assets" (hereinafter referred to as the "Law Amending Legislative Acts on Information Security and Digital Assets") was adopted in the Republic of Kazakhstan (hereinafter referred to as "Kazakhstan").
On December 12, 2023, the Law Amending Legislative Acts on Information Security and Digital Assets was officially published. It enters into force on February 11, 2024, except for certain provisions that enter into force on July 1, 2024.
We will focus below on the most important legal amendments.
The following amendments were introduced to the Law of Kazakhstan No. 94-V dated May 21, 2013 "On Personal Data Protection":
A new term “infringement of the security of personal data” is provided. An infringement of the security of personal data is defined as an infringement of the protection of personal data, which resulted in the illegal dissemination, modification and destruction, unauthorized dissemination of transmitted, stored, or otherwise processed personal data or unauthorized access to them.
A prohibition related to collection and processing of copies of identity documents on paper was introduced. However, it does not apply to the cases where there is lack of integration with the objects of informatization of the government agencies and/or the state legal entities, or when it is impossible to identify the subject by using software tools.
In case of an infringement of the security of personal data a new obligation is imposed on the owner and/or the operator. The owner and/or operator are now obliged to notify the Ministry of Digital Development, Innovations and Aerospace Industry of Kazakhstan (hereinafter referred to as the "Authorized Body") on this infringement within 1 (one) business day from the moment of detection of the infringement of personal data security. This notice shall contain the contact details of the person responsible for organizing the processing of personal data (if any).
The competence of the Authorized Body was expanded, and it now also includes:
Author: Zafar Vakhidov and Almas Tleupov
-
- The state control over compliance with the Kazakhstan legislation on personal data protection (hereinafter referred to as the “Control over Personal Data Compliance”);
- Submission of the information to the operator of the communication infrastructure of the "electronic government" about an infringement of the security of personal data. This information entails the risk of the infringement of the rights and legitimate interests of subjects, for the purposes provided by this Law and other regulatory legal acts of Kazakhstan.
-
- Approval of the rules of operation of the unified repository of the "electronic government";
- Approval of the rules for the functioning of the program of interaction with information security researchers.
-
- Identifying false information when obtaining the license on digital mining activity;
- Non-compliance of the digital miner with the requirements established by the Kazakhstan laws;
- Failure to eliminate infringements within the set period based on the results of an unscheduled inspection by the Authorized Body;
- Failure to provide to the Authorized Body by the digital miner the information on changes in data within the time limits set by the Kazakhstan laws on digital assets.
Author: Zafar Vakhidov and Almas Tleupov