My Personal Data Was Leaked — What Should I Do

Constitutional Protection of Personal Data

The Constitution of Kazakhstan 2026 for the first time at the constitutional level enshrines the right to protection of personal data.

What is protected:

• Personal data — full name, date of birth, address, IIN, phone number, email, and any other information allowing identification of you.
• Biometric data — fingerprints, facial recognition data, voice prints.
• Confidentiality of digital communications — messenger correspondence and email.
• Right to be forgotten — you may demand removal of information about yourself from public sources.

What to Do When Data Is Leaked

Step 1. Document the fact — take screenshots, save links to publications.

Step 2. Demand deletion — send a written demand to the organisation that allowed the leak.

Step 3. Contact the authorised body — in Kazakhstan the regulatory functions in the field of personal data are performed by the Ministry of Digital Development, Innovation and Aerospace Industry.

Step 4. Prosecutor's office — if the violation is systemic or criminal in nature.

Step 5. Court — you have the right to file a claim for compensation for moral damage and losses caused by the data leak.

Step 6. Constitutional Court (from July 1, 2026) — if a legal provision under which your data was processed violates your constitutional protection, you may now challenge it directly.

• The 2026 Constitution for the first time protects personal and biometric data at constitutional level
• Collecting and distributing data without consent violates constitutional rights
• Document the fact → demand deletion → contact the authorised body
• From July 1, 2026 — direct application to the Constitutional Court
• Right to be forgotten: you may demand removal of information about yourself