What the personal data law requires of your company specifically

The inspector requests documents and proof of the measures taken. We assemble a package per legal entity in advance: the category opinion, the findings register with retest reports, the logs and the leak response procedure. During the inspection our specialist takes part as a technical specialist under power of attorney, prepares responses to requests and helps with objections to the inspection report.

Count the total number of unique people whose personal data is in all your systems: customers, employees, candidates, subscribers. This is not an annual figure. Up to 10,000 — small; from 10,000 to 500,000 — medium; from 500,000 — large. If you process restricted-access personal data, your category goes up one level. The calculator above gives an indicative result in 5 minutes.

From 21 September 2026, penetration testing, security assessment and an independent audit of personal data protection measures are mandatory for large operators, from 500,000 unique data subjects. Medium operators must run vulnerability analysis, train employees, approve an incident response procedure and carry out internal control. For small operators (up to 10,000) the law does not require a pentest.

This is information whose access is restricted by the legislation of Kazakhstan. The requirements for it are stricter: such data may be collected and processed only on servers and in systems located in Kazakhstan, and must be protected by encryption of at least level 3 under the national standard ST RK 1073-2007 (from 1 January 2027, ST RK 1073-2025). The company's category also goes up one level.

From the moment of discovery, the company has one business day to notify the authorized body: the Information Security Committee of the Ministry of AI and Digital Development. The notification states the contact of the responsible person, the measures taken and the data of those affected: full name, IIN or phone number. The citizens themselves are then notified by the e-government operator. We step in within 4 hours and help prepare the notification.

Under Art. 79 of the Administrative Offenses Code of Kazakhstan, for failing to apply personal data protection measures the fine is from 300 to 600 MCI (≈1.3–2.6 million ₸); if it led to data loss, up to 2,000 MCI (≈8.65 million ₸). MCI is the monthly calculation index. The fine depends on the size of the business.

IP addresses, logins, full names and sometimes IINs all end up in security logs. The law requires personal data to be stored in a database on the territory of the Republic of Kazakhstan (Art. 12 of Law No. 94-V). The KEMEL platform runs in a data center in Kazakhstan or in your own environment, and IINs, phone numbers and e-mails are masked before they are written.

GUARD Start: from 250,000 ₸ per month for small companies (up to 10,000 people in the database). GUARD Pro: from 500,000 ₸ per month for medium companies (from 10,000 to 500,000 people), includes KEMEL WATCH monitoring. GUARD Ultra: for large companies (from 500,000 people) and holdings, priced individually. GUARD Gov: for government bodies, priced individually. The final price depends on scope and is fixed in the contract.

Yes. For government bodies and the quasi-public sector there is GUARD Gov: a platform inside the customer's environment, preparation for the new information security requirements, integration with the NCISC (НКЦИБ), pentest, personal data law logs and staff training. For the public sector →