Kazakhstan - Data Management Amendments (90/NQ)

Overview

Order No. 90/NQ of 23 February 2024 amended and supplemented Ministerial Order No. 385/NQ of 14 October 2022 approving the Requirements for Data Management for public-sector organizations in Kazakhstan. The Order was registered with the Ministry of Justice on 26 February 2024 (registration No. 34051) and published in the reference legal database; it clarified applicability, strengthened governance roles such as data steward and CDO, prescribed mandatory data cataloguing, and formalized integration with the Smart Data Ukimet environment. The official text is available on Adilet. The Order was subsequently repealed by Ministerial Order No. 691/NQ of 11 November 2024, published on Adilet.

Definitions

The 90/NQ amendments expand and standardize core terminology used throughout Kazakhstan's public-sector data governance framework. Definitions added or revised include: "data" (information in a formalized form), "data owner", "data steward" (responsible official for compliance and in-organization data management), "officer on data", "CDO" (Chief Data Officer), "data catalog" and "data passport" (standardized metadata/description forms), "Smart Data Ukimet (SDU)" (a unified data repository/analytic environment), "anonymization" and "pseudonymization", "etalon (reference) data", "non-digitized data" and "digitized data", processes ETL and CDC, and clear definitions of data quality and its measurement criteria (uniqueness, accuracy, integrity, timeliness, consistency, completeness). These definitions are intended to align legal wording with technical practice and are published in the consolidated Order text. See the official appendices for the sample passport and non-digitized data description forms in the published Order: Order No. 90/NQ (full text and appendices).

Governance and Institutional Framework

The Order emphasizes a multi-actor governance model. The primary obligations fall on state bodies, state-owned legal entities and quasi-state sector entities (with certain carve-outs, e.g., National Bank and similar organizations). Key roles created or defined include: the data owner (legal title/rights holder), the data steward (responsible official within an organization for policy compliance, catalog completion, internal verification and coordination), the operator (entity tasked with maintaining the "electronic government" information-communication infrastructure), and the service integrator (responsible for architectural and technical support of the government's data catalog and integration). The Order places coordination and cross-sectoral leadership authority on the authorized central executive body (the "authorized organ" for data management) while assigning concrete operational tasks to the operator and service integrator. The ministry and the operator are also required to ensure required security measures, register integration services in service registries, and provide methodological and technical support to organizations. The Ministry of Digital Development, Innovations and Aerospace Industry is the issuing authority; information about the ministry and its responsibilities is available at the government portal: Ministry page (gov.kz). The formal legal texts are published and accessible via national legal information systems: Adilet and zakon.uchet.kz.

Key Focus Areas

The amendments address multiple interlocking subject-matter areas: (1) Scope and Applicability — clarifying which public bodies and quasi-state entities must apply the Requirements (and noting exceptions); (2) Metadata and Cataloguing — mandatory formation and maintenance of a centralized data catalog containing standardized data passports and descriptions for non-digitized data; (3) Data Quality — establishment of criteria and processes for measuring and improving data quality (with concrete indicators such as uniqueness, accuracy, timeliness and consistency); (4) Integration with National Platforms — operational procedures, roles and deadlines for integrating organizational systems with the SDU, including operator-led anonymization where necessary; (5) Roles and Accountability — introduction and detailing of roles (data steward, CDO, officer on data) and their responsibilities (monitoring, internal control, verification with SDU, creation of internal acts and staff training); (6) Reference/Etalon Data — designation and governance of authoritative sources used for cross-system reconciliation; (7) Security and Anonymization — technical and procedural obligations to anonymize or pseudonymize data before inclusion in SDU, and the use of ETL/CDC approaches; and (8) Publication and Transparency — requirements for publishing data passports and statistics of data use on the architectural portal of "electronic government". These changes were supported by the addition of standardized templates (Appendices 1 and 2) for data passports and for describing non-digitized data to ensure uniform implementation across agencies (see published appendices in the official text: Order No. 90/NQ text and appendices).

Implementation Framework

The Order sets a practical implementation framework with assigned short-term deadlines for technical interactions between organizations and the operator/service integrator (for example, the operator must request table and field descriptions within five working days and prepare interaction regulations within five working days; organizations then have five working days to approve). It requires organizations to complete data passports and descriptions prior to placing information systems into production and mandates automated publication of usage statistics on the architectural portal. The operator and service integrator have explicit duties: ensuring the technical ability to form and maintain passports and non-digitized descriptions on the architectural portal; providing technical and methodological support; ensuring access controls and security of catalog content in line with unified ICT and information security requirements; notifying the operator about passports prepared with read-only access on the data catalog; and configuring anonymization via ETL tools when organizations cannot perform anonymization themselves. The Order therefore mixes legal/regulatory obligations with implementation-level timebound technical tasks to accelerate practical operationalization of national data architecture (see the order text and appendices at Adilet and zakon.uchet.kz).

Monitoring and Evaluation

Monitoring provisions require data stewards to oversee compliance, conduct internal verification of SDU entries against local systems and ensure timely submission of indicators to SDU. The Order instructs the collection and publication of automated statistics on dataset access on the architecture portal and assigns the authorized organ and operator specific notification and verification duties. Data quality evaluation may be performed proactively by data users and, for statistics purposes, by the authorized statistical body per referencing rules in the Order. The declared approach intends to enable continuous quality monitoring, identification of inconsistencies against etalon data sources and corrective actions to harmonize conflicting records. The official text provides that non-conformance on core quality indicators is grounds to consider data unreliable and triggers remediation actions (see formal provisions: full text).

Penalties, Liability, and Appeals

The Order principally prescribed governance obligations, processes, and technical timelines rather than establishing monetary fines or criminal penalties; enforcement and liability for non-compliance are governed by applicable administrative procedures of the Republic of Kazakhstan. The Order was repealed by Ministerial Order No. 691/NQ dated 11 November 2024, as recorded on Adilet.

Relationship to Other Instruments

Order No. 90/NQ amends and operates as a subordinate regulatory act under the framework of the Requirements originally approved by Order No. 385/NQ (14 October 2022). It cross-references other ministerial acts including the 2019 Order No. 193/NQ on formation and monitoring of the "electronic government" architecture and interacts with statutory authorities responsible for national statistics, information security, and regulated sectors (e.g., National Bank carve-out). Subsequently, a Government-level act (November 2024 Governmental documents on Requirements for Data Management) and Ministerial Order No. 691/NQ (11.11.2024) superseded or repealed the ministerial-level acts. Key related instruments and consolidated texts are accessible via national legal information systems: Order No. 385/NQ (Adilet), Order No. 90/NQ (Adilet), and the repeal instrument Order No. 691/NQ (Adilet).

International Alignment

The amendments reflected international data-governance practices: role-based stewardship, centralized metadata cataloguing, data quality metrics, and standards for anonymization and pseudonymization. While the text was a domestic ministerial instrument, its approaches mirrored international trends toward data catalogs, provenance, and privacy-preserving analytics. The official record of the instrument is preserved on Adilet.

Implementation Timeline

Sources and References

Primary sources for this instrument include the official consolidated text of Order No. 90/NQ on Adilet, the parent requirements in Order No. 385/NQ on Adilet, the repeal instrument Order No. 691/NQ on Adilet, and organizational details on the Ministry of Digital Development portal.