Law note · Kazakhstan
Code of Administrative Offences, personal data violations
What it requires
- An app processing Kazakhstani personal data may be investigated by the Ministry of Artificial Intelligence and Digital Development's Committee for Information Security and fined under Code of Administrative Offences Art. 79 for unlawful collection or processing, separately from the Personal Data Law itself. An individual harmed may also seek compensation for moral and material damage under Art. 24(1)(7), though this is not framed as a dedicated statutory cause of action.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
What we found
Art. 79 of the Code of Administrative Offences, not the Personal Data Law itself, sets the fine schedule for a breach of Kazakhstan's personal-data legislation, starting at thirty monthly calculation indices for individuals for illegal collection or processing of personal data and scaling up by entity type. The Code was adopted 5 July 2014 and entered into force 1 January 2015 (Art. 920).
Article 79's fine schedule has since been amended four times; the most recent, Law No. 155-VIII, raised the amounts and took effect 12 March 2025. The Ministry of Artificial Intelligence and Digital Development (formed 28 September 2025) and its Committee for Information Security are the competent authority; no private right of action was found in the Personal Data Law, which instead gives the subject a general civil-damages right at Art. 24(1)(7).
A separate AI-specific fine article and a Criminal Code backstop were not read at primary source and are not recorded here.