Awe CheckKazakhstan fine for a personal data leak — up to ₸8.65M
Fines for leaks and unprotected personal data under Article 79 of Kazakhstan’s Administrative Code: 300–2,000 MCI. What counts as a leak and how to prevent it.
Checked against sources: 1 October 2026
- 8,650,000 ₸leak, large business
- 3,243,750 ₸leak, small business
- 2,595,000 ₸no protection, large
What a leak costs
These are the largest fines a website faces in Kazakhstan: a leak costs ten times more than a form without a consent box.
- If protection measures are missing but data did not leave (Article 79, Part 3): small business — ₸1,297,500, medium — ₸1,946,250, large — ₸2,595,000.
- If as a result data leaked, was lost or unlawfully collected (Part 4): ₸3,243,750, ₸4,325,000 and ₸8,650,000 respectively.
What most often causes a leak on a website
- Forms are sent without HTTPS, so a request can be intercepted on the way.
- Personal data ends up in the page URL (?phone=…) and stays in browser history, server logs and analytics.
- Requests go to foreign mail, CRM or Google Sheets while the database sits outside Kazakhstan — a protection failure in itself.
- An outdated CMS and plugins, an open admin panel, a server revealing its version.
What to do
Awe Check checks HTTPS, data in URLs, security headers and the third-party services requests go to, and shows what is broken.
- Enable HTTPS on the whole site with a redirect from http.
- Submit forms with POST, not in the page URL.
- Keep the customer database on servers in Kazakhstan and describe the protection measures in the policy.
- Keep the CMS and plugins updated, close service areas and add security headers.
Frequently asked
Do I have to report a leak?
Yes. The personal data law requires notifying the authorised body of a leak promptly. Check the current text of the law for the exact procedure and deadline.
If a contractor leaks the data, are they fined?
The operator — whoever collects the data on their site — is responsible. That is why it matters where requests are stored and how the services you pass them to are protected.
