In Kazakhstan, it has been proposed to increase the maximum fine for violations in the field of personal data protection from 2,000 to 5,000 monthly calculation indices (MCI). The initiative affects, in particular, large companies and is currently at the coordination stage.
WHY THE AUTHORITIES ARE PROPOSING TO INCREASE FINES
As reported by Deputy Minister of Artificial Intelligence and Digital Development Doszhan Mussaliyev at the KazHackStan forum, the current fines do not always have a sufficient impact on large companies.
In 2025, amendments were already made to the Code of Administrative Offences (CAO) of the Republic of Kazakhstan, increasing liability for violations in the field of cybersecurity and personal data protection. However, the ministry believes that for large legal entities the prescribed sanctions remain insufficiently substantial.
BY HOW MUCH FINES COULD INCREASE
Currently, the maximum administrative fine for the relevant violations is 2,000 MCI (KZT 8.6 million). The ministry proposes to increase it to 5,000 MCI (KZT 21.6 million), primarily for large legal entities in cases of repeat violations.
Thus, the proposed maximum fine is more than double the current one.
AT WHAT STAGE THE INITIATIVE IS
According to Mussaliyev, the draft law and proposals to increase the fines have already been prepared. However, in order to advance the initiative further, the ministry needs to coordinate it with other government bodies and business representatives.
The proposals are then planned to be submitted for consideration to the Kurultai. A final decision on introducing amendments to the legislation has not yet been made.
CONTEXT
The proposal to increase the maximum fine to 5,000 MCI had also been discussed earlier. In January 2026, First Deputy Minister of Artificial Intelligence and Digital Development Rostislav Konyashkin stated that the country plans to introduce criminal liability for mass leaks of citizens' personal data.
Minister of Artificial Intelligence and Digital Development Zhaslan Madiyev also spoke about mass violations in the field of information security. According to him, heads of government bodies will bear personal responsibility for personal data leaks, regardless of the causes and technical explanations.
