Personal data leaks are no longer a rare occurrence. Leaks can have various causes: compromise of infrastructure, misconfigured access rights, actions of a dishonest employee, incidents on the contractor’s side, loss of a device, an erroneous mailing, and others.
For businesses, it is crucial that the legal consequences are often determined not by the incident itself, but by the quality of the response to it.
Legal framework
The Law of the Republic of Kazakhstan ‘On Personal Data and Their Protection’ obliges the owner, the operator and the third party to take measures ensuring the prevention of unauthorised access to personal data, the timely detection of such access and the minimisation of its adverse consequences.
Upon detection of a personal data security breach, there is an obligation to notify the authorised body, indicating the contact details of the person responsible for organising the processing of personal data. The deadline is one working day.
In parallel, shorter deadlines apply to infrastructure participants: cybersecurity centres inform the authorised body within three hours, and hosting providers have been given their own obligations to transmit information about incidents.
Step 0. Preparation before an incident
A response plan works only if it has been created in advance. The minimum set includes: a designated person responsible for organising the processing of personal data (a mandatory requirement for legal entities), an internal response procedure allocating areas of responsibility between IT, lawyers and communications, up-to-date contacts and pre-prepared notification templates.
This also covers the registration and recording of actions with personal data, which has been mandatory since July 2026: without such records, it will be difficult for a company to establish the scope of the leak and confirm the lawfulness of the processing.
Step 1. Recording and containment (the first hours)
Record the date and time of detection, the source of the information and a preliminary description of the event.
Preserve the traces: event logs, system images, correspondence. A common mistake is to ‘clean up’ the system immediately, after which it becomes impossible to establish the scope of the leak.
Contain the incident: revoke compromised access rights, change passwords and keys, and restrict access to the affected resources.
Step 2. Classification of the incident
Before sending a notification, several questions must be answered: whether the affected information constitutes personal data (whether it includes identifiers, such as surname, first name and patronymic in combination, IIN (individual identification number) or a facial image); whose data it is; which categories are affected, including restricted-access data; what the volume is; and where the incident occurred – in the company’s own infrastructure or at a contractor’s.
The answer to the last question does not release the company from its obligations: if the data was transferred to a contractor, the owner company remains liable to the data subjects and the regulator.
Step 3. Notification of the authorised body
The deadline is one working day. It runs from the moment the breach is detected, not from the completion of the internal investigation. A full picture is usually not available by that point, and this is normal: the notification is sent on the basis of the information available and may be supplemented as that information is clarified.
The notification must state the contact details of the responsible person, information on the affected data subjects and the measures taken to remedy the breach.
Step 4. Informing data subjects
Data subjects whose data has been leaked are notified through state channels. The company should bear in mind that this will happen regardless of its own decision after the authorised body has been notified, so the company’s own communications must be prepared in advance and must not contradict the official notification.
Step 5. Working with contractors and counterparties
If the incident occurred on the supplier’s side, it is necessary to request an official description of the event and a list of the affected data, record the breach of contractual obligations and assess the prospects for recovering losses.
If the incident occurred on your side and the affected data includes data received from counterparties, you should check your contractual notification obligations and fulfil them within the established time limits.
Step 6. Eliminating the causes
Measures should not be limited to technical ones. In addition to closing the vulnerability and changing keys, it may be necessary to block personal data, destroy data obtained unlawfully, review access rights and reduce the volume of data collected. It is also worth checking separately whether masking and hashing are applied: since 2026, these have been independent protection measures provided for by law.
Step 7. Documentation
The incident file – the chronology, the decisions taken, the notifications sent, the correspondence with the contractor and the report on the measures taken – is the company’s main argument during an inspection. A documented and timely response significantly changes the assessment of good faith.
Step 8. Review of processes
Once the incident has been closed, it makes sense to return to its root cause: excessive data collection, disproportionate access rights, lack of employee training, weak contractual terms with contractors. It is also worth separately assessing the advisability of voluntary cyber insurance, which is expressly provided for by Art. 23-1 of the Law.
Conclusion
A data leak is an operational risk that cannot be eliminated entirely, but can be made manageable in advance.
Key points: a designated responsible person, a working response procedure, keeping records of actions with data, one working day to notify the authorised body, and communication with data subjects that takes into account that they will receive an official notification in any event.
Companies that have this action plan not only described on paper but also tested in practice get through an incident as an unpleasant but controlled episode. For the others, the incident turns into a protracted process with regulatory, contractual and reputational consequences.
The lawyers of REVERA Kazakhstan will be happy to assist with auditing personal data processing procedures, developing policies, incident response procedures and notification templates, preparing data processing agreements with contractors, supporting interaction with the authorised body and challenging its orders and fines, as well as recovering losses from a culpable contractor or employee.
