Kazakhstan has approved new rules governing how personal data breaches involving citizens must be handled. The document was signed by order of the Deputy Prime Minister — Minister of Artificial Intelligence and Digital Development, according to infohub.kz.
The republic has developed rules for notifying about personal data security breaches. For the first time, the document formally defines the very concept of a "personal data security breach." It refers to a security failure that led to the unlawful dissemination, alteration, destruction or deletion of personal data, as well as unauthorized access to it.
Under the new requirements, when such a breach is identified, the owner or operator of the database must notify the authorized body within one business day. The notification must include the contact details of the person responsible for organizing personal data processing (if one exists), as well as the measures taken to address the breach.
The notification must also include the personal data of the affected individuals needed to send them subsequent alerts: last name, first name and patronymic (if any), and/or the individual identification number (IIN), and/or a mobile phone number.
The order also clarifies what constitutes personal data. This is information or a set of information about a personal data subject, supplemented by one or more personal data identifiers. The owner of a database or digital object containing personal data may be a government body, an individual or a legal entity that owns, uses and disposes of such a database or digital object. An operator is a person or government body that collects, processes and protects personal data.
The order is set to take effect on September 22.
Recall that in August, the publication Mash reported a leak of data on 15 million Kazakhstanis onto the internet. The Ministry of Artificial Intelligence and Digital Development responded to that information. However, several hours later, the Ministry of Digital Development refuted claims of an eGov hack and a leak of data on 15 million citizens. An inspection showed that the files sold on the darknet were not connected to the system.