Kazakhstan Moves to Strengthen Data Protection Laws After Historic Breach Kazakhstan is advancing strict new measures to combat personal data leaks, including criminal liability for mass breaches and significantly higher fines for security violations. The proposals, introduced by the Ministry of Artificial Intelligence and Digital Development, follow the country’s largest-ever data breach in summer 2025, which exposed the personal information of over 16 million citizens more than three-quarters of Kazakhstan’s population. First Deputy Minister Rostislav Konyashkin announced the reforms during a government meeting, emphasizing a "zero-tolerance" policy for mishandling digital data. The changes would align Kazakhstan’s regulations with stricter standards seen in the EU and parts of Asia, where data breaches carry both administrative and criminal penalties. Under the new framework, officials and organizations including government agencies, financial institutions, and private companies could face fines up to $42,500, a sharp increase from the current maximum of $17,000. The push for tighter controls follows a series of high-profile breaches, including a 2024 leak affecting 2 million clients of the microfinance platform zaimer.kz. President Kassym-Jomart Tokayev has also called for constitutional protections for personal data, framing digital security as a fundamental right in the country’s evolving legal landscape. The reforms reflect Kazakhstan’s broader effort to modernize its cybersecurity framework amid rapid digital transformation.