Constitutional Protection of Personal Data
The Constitution of Kazakhstan 2026 for the first time at the constitutional level enshrines the right to protection of personal data.
What is protected:
- Personal data — full name, date of birth, address, IIN, phone number, email, and any other information allowing identification of you.
- Biometric data — fingerprints, facial recognition data, voice prints.
- Confidentiality of digital communications — messenger correspondence and email.
- Right to be forgotten — you may demand removal of information about yourself from public sources.
What to Do When Data Is Leaked
Step 1. Document the fact — take screenshots, save links to publications.
Step 2. Demand deletion — send a written demand to the organisation that allowed the leak.
Step 3. Contact the authorised body — in Kazakhstan the regulatory functions in the field of personal data are performed by the Ministry of Digital Development, Innovation and Aerospace Industry.
Step 4. Prosecutor's office — if the violation is systemic or criminal in nature.
Step 5. Court — you have the right to file a claim for compensation for moral damage and losses caused by the data leak.
Step 6. Constitutional Court (from July 1, 2026) — if a legal provision under which your data was processed violates your constitutional protection, you may now challenge it directly.