Awe CheckLaws and fines
Personal data in Kazakhstan: the law and Article 79 fines
What Kazakhstan’s personal data law requires and what a violation costs small, medium and large businesses.
Checked against sources: 30 September 2026
- 865,000 ₸Part 1, large business
- 2,595,000 ₸Part 3, large business
- 4,325 ₸1 MCI in 2026
What the law requires
- Collect and process personal data with the person’s consent.
- The person knows who collects their data and why.
- The owner and operator protect data from leaks and tampering.
Fines under Article 79 of the Administrative Code
Fines are counted in monthly calculation indices (MCI). From 1 January 2026 one MCI is 4,325 tenge.
- Part 1, unlawful collection or processing: small business 60 MCI (259,500 ₸), medium 100 MCI (432,500 ₸), large 200 MCI (865,000 ₸).
- Part 3, failing to apply protection measures: small 300 MCI (1,297,500 ₸), medium 450 MCI (1,946,250 ₸), large 600 MCI (2,595,000 ₸).
- Part 4, if the breach led to loss or unlawful processing: up to 2,000 MCI, which is 8,650,000 ₸ for a large business.
What to check on a site
Is there consent next to the form, is a policy published, is data passed to third-party services without notice, does the site run over HTTPS. Awe Check recalculates the tenge amounts using the current MCI.
Frequently asked
How do I know if we are small or large?
The entrepreneurship law sets the category by headcount and annual income. If unsure, plan around the top of the range.
Does the MCI change?
Every year with the national budget. So tenge amounts change while the number of MCI stays the same.
