The main state authority in the field of personal data protection is the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan (the ‘Ministry’). The Ministry:

• shapes and implements the state policy on personal data and its protection;
• develops the procedure for implementation of personal data protection measures by the owner and / or operator of a personal data database and a third party related to the owner and / or operator of a personal data database;
• develops the rules to be followed by the personal data database owner and (or) operator when determining the scope of personal data necessary and sufficient for the performance of their tasks;
• develops the procedure for determining the list of personal data necessary and sufficient for the performance of tasks by the owner and (or) operator of a personal data database;
• determines the procedure for implementation of personal data protection measures by the owner and (or) operator of a personal data database, as well as by a third party;
• reviews requests of a personal data subject or his / her legal representative on compliance of the content of personal data and methods of its processing with the purpose of its processing and makes a respective decision;
• takes measures on bringing persons who have violated personal data laws of Kazakhstan to liability in accordance with the laws of Kazakhstan;
• requests the owner and / or operator of a personal data database and a third party related to the owner and / or operator of a personal data database to clarify, block or destroy inaccurate or illegally obtained personal data;
• takes measures on improving protection of rights of personal data subjects;
• creates an advisory council on issues of personal data and its protection as well as determines the procedure for its formation and activities;
• approves the rules for collection and processing of personal data;
• approves the rules for conducting a survey in order to assess the security level when storing, processing and distributing limited access personal data contained in electronic information resources and such rules should be agreed with the National Security Committee of the Republic of Kazakhstan;
• approves the rules for the functioning of the state service for control of access to personal data;
• coordinates the integration of non-state informatization entities with the state informatization entities and (or) state legal entities, which involves personal data transfer and (or) provision of access to personal data;
• approves the rules for integration with the state service for control of access to personal data;
• exercises other powers provided by Kazakh law.

The Government of Kazakhstan develops the main directions of state policy on personal data and its protection.

In relation to personal data and its protection, state authorities (each within its competence):

• develop and / or approve regulatory acts;
• consider appeals of individuals and / or legal entities regarding personal data and protection of personal data issues;
• take measures for bringing persons who have violated personal data legislation of Kazakhstan to liability;
• exercise other powers provided for by Kazakh law.

Supervision over observance of Kazakh law in respect of personal data and its protection is carried out by the prosecution authorities of Kazakhstan.