# My Personal Data Was Leaked – What Should I Do

> The Constitution protects personal data against unlawful collection, processing, storage, and use, including with digital technologies. If your data are leaked, preserve evidence, contact the data operator, and submit a complaint to the Information Security Committee.

Canonical URL: https://constitution.my/p/life-personal-data-leaked?lang=en
Language: en
Updated: 2026-07-26

Section: Rights

## What the Constitution Protects

Article 21 protects personal data against unlawful collection, processing, storage, and use, including with digital technologies. Consent, other lawful grounds for processing, retention periods, biometric data, and deletion procedures are governed by specific legislation.

## What to Do When Data Are Leaked

1. **Preserve evidence:** screenshots, page addresses, messages from the organisation, the date, and the circumstances of discovery.
2. **Contact the data owner or operator:** request an explanation, cessation of unlawful processing, and deletion or correction where the law provides for it.
3. **Submit a complaint through eOtinish to the authorised body:** supervision is handled by the Information Security Committee of the Ministry of Artificial Intelligence and Digital Development.
4. **Provide verifiable details:** the organisation or person involved, the circumstances of the violation, and available evidence. These are needed for an unscheduled inspection or administrative proceedings.
5. **Contact law enforcement** if there are signs of fraud, extortion, unlawful access, or another crime.
6. **Go to court** if you need the violation stopped or proven harm compensated.

The Constitutional Court reviews not the leak itself, but the constitutionality of a legal norm that directly affects your rights. The citizen application mechanism has operated since 2023.

[Authorised body guidance](https://www.gov.kz/memleket/entities/maidd/activities/9552?lang=ru&parentId=6)

## Key Facts

- Processing is allowed with consent or another lawful basis
- The authorised body is the Information Security Committee
- A complaint needs concrete circumstances and supporting materials
- Deletion or correction may be requested where and as provided by law
- If there are signs of a crime, contact law enforcement

## Checked sources

- [Official publication of the 2026 Constitution of the Republic of Kazakhstan](https://adilet.zan.kz/rus/docs/K2600000000) – Adilet Legal Information System (checked 2026-07-16)
- [Law on Personal Data and Their Protection](https://adilet.zan.kz/rus/docs/Z1300000094) – Adilet Legal Information System (checked 2026-07-16)
- [Authorised body guidance on personal-data protection](https://www.gov.kz/memleket/entities/maidd/activities/9552?lang=ru&parentId=6) – Ministry of Artificial Intelligence and Digital Development of Kazakhstan (checked 2026-07-16)

## Qaz.Vision context

> В новой Конституции Казахстана впервые закреплено право на защиту персональных данных, четко прописан запрет на незаконный сбор, обработку и использование сведений, в том числе с применением цифровых инструментов.

- Касым-Жомарт Токаев, Президент
- [Source document](https://qaz.vision/dokument/131)
- Evidence: `direct_quote; atom:2568; unreviewed`

> Он отметил, что еще одной ключевой особенностью нового текста Конституции является ориентация на права человека. Так, права и свободы человека закреплены не только в новой Преамбуле, но и утверждены в качестве особого приоритета и смыслового стержня всей Конституции.

- Ерлан Карин, Государственный советник
- [Source document](https://qaz.vision/dokument/27)
- Evidence: `attributed_speech; atom:818; unreviewed`

---
Source: https://constitution.my/p/life-personal-data-leaked?lang=en
© 2026 Constitution.my – informational resource, not an official legal source