Kazakhstan - Data Management Requirements (385/NQ)

Overview

The Order of the Minister No. 385/NQ (14 October 2022) established a unified set of Requirements for Data Management to govern how state bodies and specified organisations in Kazakhstan manage data throughout its lifecycle. The instrument aimed to improve data quality, enable secure cross-agency sharing, and define institutional roles (data owners, data stewards, custodians) and procedural obligations for inventories, classification, metadata, access control and incident response. The Order was published and made available via official legal information systems, including registers hosted at Adilet and announcements on the Ministry portal Ministry press page. The Order underwent amendment in February 2024 and was ultimately revoked by a later ministerial order in November 2024.

Definitions

The Order defined core terms to standardize understanding across entities: "data asset" (a dataset or collection managed as a unit), "data owner" (official accountable for data value and classification), "data steward" (operational manager responsible for quality and metadata), "data custodian" (technical manager responsible for storage and security), "metadata" (descriptive information to support findability and governance), "data lifecycle" (phases from creation to disposal), and "sensitive/personal data" (categories subject to heightened protections under national law). The definitions aligned these roles to existing public-sector organisational structures to enable assignment of responsibilities and accountability for data governance and security.

Governance and Institutional Framework

The instrument required each ministry, agency and specified organisation to establish a data governance structure composed of appointed data owners and stewards, supported by IT and security units. Entities were directed to maintain a centralized inventory/catalog of datasets and publish metadata to facilitate discovery and authorized reuse. Oversight responsibilities were assigned to the Ministry of Digital Development, Innovations and Aerospace Industry for coordination, methodological support and monitoring. The Order also envisaged interagency coordination mechanisms for data exchange and for establishing common technical standards and interfaces. The Ministry provided explanatory materials and public notices via its website and the national legal portal to guide implementation; see the Ministry’s announcement at Ministry press page and the consolidated text at Adilet.

Key Focus Areas

The Requirements addressed multiple technical, organisational and procedural areas. Data inventory and classification rules required entities to catalogue datasets and label them by sensitivity, criticality and retention. Metadata standards and cataloguing rules supported discoverability and reuse while preserving privacy and security constraints. Lifecycle management provisions established retention schedules, legal basis checks, secure archival and disposal procedures. Data quality and validation rules required entities to set quality metrics, monitor completeness and correctness, and document provenance. Access management provisions mandated role-based access controls, authentication and authorization mechanisms, and logging and auditing of data access. Data-sharing provisions required formal agreements, purpose limitation clauses, and safeguards for transfers, including cross-border considerations. Security controls required technical measures (encryption at rest/in transit, network segmentation, secure backups) and organisational measures (incident response plans, staff training). The Order also required reporting of breaches and incidents to designated supervisory authorities and coordination for remediation.

Implementation Framework

The Order set an implementation sequence: initial inventory and classification; appointment of roles; deployment of metadata catalogues; establishment of sharing agreements; adoption of technical security controls; and continuous quality monitoring. Entities were required to prepare internal regulations and schedules aligned to the Order and to report progress to the Ministry within prescribed timeframes. The instrument envisaged methodical support and templates to be issued by the Ministry for inventories, agreements and security baselines. The February 2024 amendment updated certain operational deadlines and clarified procedural steps; those amendments are recorded in the legal information systems (see Amendment text).

Monitoring and Evaluation

Monitoring obligations included periodic reporting to the Ministry, scheduled audits of data inventories and data quality metrics, and compliance checks focusing on access controls and incident handling. The Ministry was authorised to conduct methodological reviews and to issue corrective recommendations. Performance indicators included completeness of inventories, percentage of datasets classified, number of data-sharing agreements in force, and incident response times. The Order anticipated that monitoring outputs would inform revisions to methodology and technical standards over time.

Penalties, Liability, and Appeals

The Order itself specified administrative and procedural measures for non-compliance, including directives to remedy deficiencies, temporary suspension of data exchanges, and referral to competent agencies for administrative sanctions where statutory breaches occurred (for example, violations of data protection or information security legislation). Entities retained the right to appeal ministerial decisions through administrative and judicial channels under Kazakh law. The February 2024 amendment adjusted enforcement modalities; both the original and the amendment were later revoked by Order No. 691/NQ (11 November 2024), which removed these specific obligations from force and transferred any outstanding enforcement to successor acts.

Relationship to Other Instruments

The Requirements were explicitly linked to existing national frameworks: Kazakhstan's Law on Personal Data, laws on informatization and public information systems, and sectoral regulations for health, finance and other sensitive domains. Where personal data or sector-specific rules applied, those instruments retained primacy and the Requirements were to be read as complementary for data governance rather than as a substitute for sectoral legal obligations. The Order referenced methodological documents and standards to ensure interoperability with state information systems and to align with other ministerial acts; see consolidated references at Adilet record.

International Alignment

The Order reflected an effort to align Kazakhstan’s public-sector data management practice with international best practices in data governance, privacy-by-design, and information security. While not a direct transposition of any single foreign regime, its structure mirrors OECD and EU-inspired approaches to data stewardship, role-based accountability, lifecycle management, and risk-based security measures. The instrument paid particular attention to cross-border data exchange rules and encouraged safeguards consistent with international norms, yet transfers and processing remained subject to national law and sectoral restrictions.

Implementation Timeline

Event	Date	Notes
Order issued	2022-10-14	Order No. 385/NQ signed by Minister.
Registered with Ministry of Justice	2022-10-17	Registration No. 30186 (official registration of the normative act).
Amendment issued (No. 90/NQ)	2024-02-23	Amendments and additions; registered 2024-02-26 (Reg. No. 34051).
Order revoked	2024-11-11	Order No. 691/NQ revoked Order No. 385/NQ and related amendments; registered 2024-11-12.

Compliance Checklist

Requirement	Compliant (Yes/No)	Notes
Appoint data owners and stewards	Yes	Mandatory assignment for state bodies.
Create data inventory and metadata catalogue	Yes	Required for all covered entities.
Classify data by sensitivity and retention	Yes	Classification required, with sectoral nuances for personal/sensitive data.
Implement role-based access controls and logging	Yes	Technical control requirement; must be auditable.
Execute formal data-sharing agreements	Yes	Purpose limitation and safeguards required.
Report incidents to designated authority	Yes	Incident reporting and response obligations apply.

Sources and References

Source	Type
Об утверждении Требований по управлению данными (Order No. 385/NQ) — Adilet	Primary Source
Amendment: Order No. 90/NQ (23 Feb 2024) — Adilet	Primary Source
Revocation: Order No. 691/NQ (11 Nov 2024) — Adilet	Primary Source
Ministry announcement and project materials — Ministry of Digital Development	Primary Source