In Kazakhstan, the protection of personal data in government systems has been strengthened.

The Committee on Information Security of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan announces the entry into force of updated rules on personal data protection, aimed at strengthening the information security of state digital systems and protecting citizens' data.

As of December 22, 2025, amendments to the Rules on Implementing Measures to Protect Personal Data have entered into force. The new provisions strengthen access control to restricted data, particularly for large databases containing more than 100,000 records.

Now, owners, operators, and third parties working with such large volumes of personal data are required to use multi-factor authentication, including biometric methods. This will significantly reduce the risk of unauthorized access and enhance the security of digital systems.

Doszhan Musaliyev, Vice Minister

Additionally, the methodologies and rules for conducting tests of "e-government" informatization objects and critical information and communication infrastructure facilities for compliance with information security requirements have been updated. The new norms establish a three-year validity period for test protocols, after which re-testing is required.

The adopted changes are part of the state's systematic efforts to strengthen cybersecurity, protect citizens' personal data, and ensure the stable operation of digital services amid growing volumes of information and increasing cyber threat risks.

Source: Gov.kz