Unofficial translation
As per sub-paragraph 7-1) of paragraph 1 of Article 27-1 of the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” and sub-paragraph 269) of paragraph 15 of the Regulations on the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan, approved by Resolution of the Government of the Republic of Kazakhstan № 501 dated 12 July 2019, I HEREBY ORDER:
Footnote. The preamble – as revised by Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan № 154/NK of 16.04.2025 (shall enter into force ten calendar days after the date of its first official publication).1. To approve the attached Rules for the implementation of a survey to ensure the security of the processes of storage, processing and distribution of personal data of restricted access contained in electronic information resources.
2. The Information Security Committee of the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan shall ensure:
1) state registration of this order with the Ministry of Justice of the Republic of Kazakhstan;
2) placement of this order on the Internet resource of the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan;
3) within ten working days after the state registration of this order, submission to the Legal Department of the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan of information on the implementation of the measures provided for in subparagraphs 1) and 2) of this paragraph.
3. To impose control over the execution of this order on the supervising vice minister of digital development, innovation and aerospace industry of the Republic of Kazakhstan.
4. This order shall come into effect ten calendar days after the day of its first official publication.
|
Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan |
B. Mussin |
"AGREED"
National Security
Committee of the Republic of Kazakhstan
"AGREED"
Ministry of National Economy of the
Republic of Kazakhstan
| Approved by order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan dated April 30, 2021 № 156/НҚ |
The Rules for the implementation of a survey to ensure the security of the processes of storage, processing and distribution of personal data of restricted access contained in electronic information resources
Chapter 1. General Provisions
1. These Rules for the Implementation of a Survey to Ensure the Security of the Processes of Storage, Processing and Distribution of Personal Data of Restricted Access Contained in Electronic Information Resources (hereinafter referred to as the Rules) have been drawn up under sub-paragraph 7-1) of paragraph 1 of Article 27-1 of the Law of the Republic of Kazakhstan “On Personal Data and Its Protection” (hereinafter referred to as the Law), sub-paragraph 269) of paragraph 15 of the Regulations on the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan, approved by Decree of the Government of the Republic of Kazakhstan № 501 dated 12 July 2019, and determine the procedure for integration with the state service for controlling access to personal data and set the procedure for conducting an assessment of the security of the processes of storage, processing and distribution of restricted access personal data contained in electronic information resources.
Footnote. Paragraph 1 – as revised by Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan № 154/NK of 16.04.2025 (shall take effect ten calendar days after the date of its first official publication).2. The following basic concepts shall be used in these Rules:
1) owner of the database containing personal data (hereinafter referred to as the Owner) - a state body, an individual and (or) legal entity, implementing in accordance with the laws of the Republic of Kazakhstan the right to own, use and dispose of the database containing personal data;
2) operator of the base containing personal data (hereinafter referred to as the Operator), - the state body, individual and (or) legal entity that collects, processes and protection of personal data;
3) protection of personal data - a set of measures, including legal, organizational and technical, carried out for the purposes established by the Law;
4) processing of personal data - actions aimed at the accumulation, storage, modification, addition, use, distribution, depersonalization, blocking and destruction of personal data;
5) personal data sharing means actions that result in the transfer of personal data, including via mass media, or the provision of access to personal data by any other means;
6) personal data of limited access - personal data, access to which is limited by the legislation of the Republic of Kazakhstan;
7) state technical service - a joint-stock company established by decision of the Government of the Republic of Kazakhstan;
8) third party - a person who is not the subject, owner and (or) operator, but associated with them (him/her) by circumstances or legal relations for the collection, processing and protection of personal data.
9) survey of ensuring the security of the processes of storage, processing and distribution of personal data of restricted access contained in electronic information resources (hereinafter referred to as the Survey) - an assessment of the security measures and protective actions used in the processing, storage, distribution and protection of personal data of restricted access contained in electronic information resources.
10) survey subjects - owners and (or) operators, as well as third parties processing personal data of limited access contained in electronic information resources.
Footnote. Paragraph 2, as amended by Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan № 154/NK of 16.04.2025 (shall come into force ten calendar days after the date of its first official publication).Chapter 2. The procedure for the implementation of a survey to ensure the security of the processes of storage, processing and distribution of personal data of restricted access contained in electronic information resources
3. For the survey, the subjects of the survey shall provide access to the state technical service to informatization objects that use, store, process and distribute personal data of limited access contained in electronic information resources.
4. While the inspection is underway, an analysis shall be executed of the legal, organisational and technical measures established by the Rules for the Implementation by the Owner and (or) Operator, as well as by a Third Party, of Measures to Protect Personal Data, approved by Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan № 179/NK of June 12, 2023 (registered in the Register of State Registration of Regulatory Legal Acts under № 32810).
Footnote. Paragraph 4 – as revised by Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan № 154/NK of 16.04.2025 (shall enter into force ten calendar days after the date of its first official publication).5. Based on the results of the survey of the informatization object, the State Technical Service shall form a report on the survey, as well as recommendations for eliminating the identified inconsistencies (if any).