What happens during a personal data law inspection and how do you help?

The inspector asks you to confirm that personal data protection measures are in place: who is appointed as responsible, which documents and logs are kept, whether the vulnerabilities found have been closed. KEMEL.TECH prepares a document pack for each legal entity, checks it against the inspection checklist and the evidence inventory, and, when a request arrives, prepares the response and documents within 24 hours. Our specialist takes part in the inspection as a technical specialist under a power of attorney, explains the measures taken to the inspector and helps with objections to the inspection act. We support the inspection. Representation in court and in administrative offence cases is handled by a partner law firm.

What category is my company?

Count the total number of unique people whose personal data is held across all your systems: customers, employees, candidates, subscribers. This is not an annual figure. Up to 10,000 is small, 10,000 to 500,000 is medium, 500,000 and above is large. If you process restricted-access personal data, the category goes up one level. For a group of companies the category is determined for each legal entity separately. The calculator on the “Data law” page gives an approximate result in 5 minutes, and KEMEL.TECH helps you determine the category and draw up a measures plan for free. The calculation is not legal advice.

What is the KEMEL platform and what do I need to install?

The KEMEL platform is a cabinet where you see alerts, the findings register, personal data law logs and your inspection readiness status. An agent (Fluent Bit and osquery) is installed: it works over an outbound mTLS connection on port 443, so no inbound ports need to be opened. The agent takes 1 day to install: we install it or you do it yourself. The pilot lasts 14 days: first we run a pentest and find out what vulnerabilities you have, then we switch on the agent, connect sources and mask personal data, after which we record findings and tune the rules to your systems. At the end you receive a pilot report.

Where are my data and logs stored?

IP addresses, logins, full names and sometimes IINs end up in security logs, and these are personal data. The law requires personal data to be stored in a database on the territory of the Republic of Kazakhstan (Art. 12 of Law No. 94-V “On Personal Data and Their Protection”). The KEMEL platform runs in a data center in Kazakhstan (SaaS) or in your own perimeter (on-prem), and IINs, phone numbers and e-mails are masked before they are written. Not legal advice.

How much does the support cost?

KEMEL GUARD is a subscription with the platform, specialists and personal data law documents. GUARD Start is from 250,000 ₸ per month for small companies (up to 10,000 people in the database). GUARD Pro is from 500,000 ₸ per month for medium companies (10,000 to 500,000 people) and includes KEMEL WATCH monitoring. GUARD Ultra is for large companies (500,000 people and above) and holdings, priced individually. GUARD Gov is for government bodies, priced individually. The final price depends on scope and is fixed in the contract. Billed separately: Red Team KEMEL BREACH from 1,200,000 ₸, a duty shift by agreement.

What is a pentest in plain words?

A pentest (penetration test) is a security check in which specialists, under a contract with the system owner, try to break into the systems the way a real attacker would. The goal is to find weak spots before attackers do, confirm them without harming data or service operation, and explain how to fix them. As a result the client receives a report describing each vulnerability, its severity and recommendations.

How does payment only for vulnerabilities found work?

At KEMEL.TECH (Kazakhstan) the client pays only for vulnerabilities actually found, at a fixed rate. If no vulnerabilities are found, you get a “perimeter clean” PDF report for free. There is no prepayment, and duplicates of the same vulnerability are not billed twice. The price of each finding is set by its severity on the CVSS scale: from 15,000 ₸ for LOW to 600,000 ₸ for CRITICAL.

Is pentesting legal in Kazakhstan?

Yes, pentesting in Kazakhstan is legal with the written permission of the resource owner (Authorization Letter). Without such permission it is unlawful access to information under Art. 205 of the Criminal Code of Kazakhstan. KEMEL.TECH works strictly within the law: under a contract with a clear scope and an NDA, in line with the Law of Kazakhstan “On Personal Data and Their Protection” No. 94-V.

What should we do if a breach occurs?

Notify the authorized body, the Information Security Committee of the Ministry of Digital Development, Innovation and Aerospace Industry, within one business day of discovery. The notification states the contact of the responsible person, the measures taken and the data of affected people: full name, IIN or phone number. Citizens are then notified by the e-government operator. The sequence of actions: detection, assessment (what leaked and whose data), notification, measures and a report. KEMEL.TECH prepares a procedure and a notification template in advance, and during an incident joins from 4 hours and helps prepare the notification on time.

Do you work with government bodies?

Yes. For government bodies, the quasi-public sector and owners of critical ICT infrastructure there is GUARD Gov: the KEMEL platform is deployed on-prem in the customer's perimeter, and data does not leave your perimeter. It includes preparation for the new information security requirements, integration and exports for working with NCIS, pentest and Red Team, personal data law logs and training of in-house specialists. We prepare you for compliance testing; the testing itself is performed by an authorized organization. To request a technical specification, use the form on the “Public sector” page.

How much does a pentest cost in Kazakhstan?

The price depends on scope and payment model. At KEMEL.TECH there is no prepayment: you pay only for confirmed vulnerabilities at the CVSS rate, from 15,000 ₸ for LOW to 600,000 ₸ for CRITICAL. If there are no vulnerabilities, the report is free.

How long does a pentest take?

From 48 hours to 10 business days depending on scope. A Red Team engagement takes 2–4 weeks.

Is permission required for a pentest?

Yes. Written permission from the resource owner is required. Without it, the work is considered unlawful access to information (Article 205 of the Criminal Code of Kazakhstan).

Pentest in Kazakhstan: what it is, whether it is legal and how much it costs

KEMEL.TECH · Updated October 16, 2026

A pentest (penetration test) is a security check in which specialists, under a contract with the system owner, try to hack the systems the way a real attacker would. In Kazakhstan a pentest is legal with the written permission of the resource owner; without it, it is unlawful access to information (Article 205 of the Criminal Code of Kazakhstan). At KEMEL.TECH the client pays only for confirmed vulnerabilities: from 15,000 ₸ for a low one to 600,000 ₸ for a critical one, and if there are no vulnerabilities, the report is free.

What a pentest is, in plain words

A pentest answers the question “can we be hacked, and how”. Specialists look for weak points in the website, user account area, API, mobile app and external perimeter, confirm them without harming data or service operation, and explain how to fix them.

As a result the client receives a report: a description of each vulnerability, its severity on the CVSS scale and recommendations for developers. After the fixes, a repeat check (retest) is carried out.

Is a pentest legal in Kazakhstan

Yes, provided there is written permission from the resource owner (Authorization Letter). Work without permission is classified as unlawful access to information under Article 205 of the Criminal Code of Kazakhstan.

An NDA between the client and the contractor.
A testing agreement with clear boundaries: domains, IP addresses, APIs, deadlines.
Written permission from the resource owner. If you rent the system from a hosting or cloud provider, its consent is needed too.
A procedure for handling personal data if the test touches it (Law of Kazakhstan No. 94-V “On Personal Data and Their Protection”).
A certificate of completed work.

What the price consists of

Usually the price of a pentest is calculated from scope: how many applications, pages, roles and APIs. The client pays up front and does not know whether anything will be found. The alternative is payment for results.

KEMEL.TECH uses a “pay for what is found” model: no prepayment, a fixed rate for each confirmed vulnerability by CVSS level, and duplicates of the same vulnerability are not charged twice.

CRITICAL (CVSS 9.0–10.0): 300,000 – 600,000 ₸. For example, remote code execution, SQL injection, authorization bypass.
HIGH (CVSS 7.0–8.9): 120,000 – 200,000 ₸. For example, stored XSS, IDOR, JWT errors.
MEDIUM (CVSS 4.0–6.9): 50,000 – 100,000 ₸. For example, CSRF, reflected XSS, OAuth and CORS errors.
LOW (CVSS 0.1–3.9): 15,000 – 40,000 ₸. For example, security headers, SSL settings.
If no vulnerabilities are found, you receive a free “perimeter is clean” report.

Timeline and what is included

A basic check takes from 48 hours to 10 business days, depending on scope. The contractor reports critical findings immediately, without waiting for the report.

External perimeter: domains, subdomains, exposed services.
Web applications and user account areas (OWASP Top-10).
APIs and mobile applications.
Business logic: access to other people's data, payment bypass, privilege escalation.
Leaked employee passwords in public databases.
A free retest after the fixes.

How to choose a contractor

Ask about written permission and an NDA before work starts.
Find out whether findings are confirmed manually, not only by a scanner.
Ask for a sample report: it should contain CVSS, reproduction steps and recommendations.
Clarify whether a repeat check is included in the price.
Compare payment models: a fixed price for scope or payment for what is found.

Frequently asked questions

How much does a pentest cost in Kazakhstan?: The price depends on scope and payment model. At KEMEL.TECH there is no prepayment: you pay only for confirmed vulnerabilities at the CVSS rate, from 15,000 ₸ for LOW to 600,000 ₸ for CRITICAL. If there are no vulnerabilities, the report is free.
How long does a pentest take?: From 48 hours to 10 business days depending on scope. A Red Team engagement takes 2–4 weeks.
Is permission required for a pentest?: Yes. Written permission from the resource owner is required. Without it, the work is considered unlawful access to information (Article 205 of the Criminal Code of Kazakhstan).

More about pentest and the proposal