Articles 31-32 of the Kazakhstan PDPL + Code of Administrative Offences Article 79 + Criminal Code Articles 147-148 establish the comprehensive penalty + enforcement framework. (1) Article 79 Code of Administrative Offences (CoAP) - Standard Administrative Penalties: (a) Individuals - KZT 500,000 to KZT 3,000,000 per violation; (b) Legal entities - KZT 1,500,000 to KZT 30,000,000 per violation; (c) Repeat violations - doubled; (d) Considerations - nature + gravity + duration + intentional/negligent + mitigation + responsibility + previous + cooperation + categories of data + harm. (2) Article 79 Severe Administrative Violations - Heightened: (a) Processing of sensitive personal data without legal basis; (b) Article 12 biometric data localization violation; (c) Violation of cross-border transfer rules; (d) Failure to notify breach (Article 27-Bis); (e) Failure to enable data subject rights; (f) Repeated standard violations; (g) Willful or grossly negligent conduct; (h) Penalties at upper end of administrative range. (3) Criminal Code Articles 147-148 - Criminal Penalties: (a) Article 147 illegal collection or dissemination of personal data - up to 2 years imprisonment + KZT 1,500,000 fine + 240 hours corrective labor; (b) Article 148 illegal use of personal data - up to 3 years imprisonment + KZT 1,500,000 fine; (c) Aggravating circumstances - sensitive data + commercial gain + criminal organisation; (d) Personal criminal liability for individuals (including directors/officers); (e) Reasonable Care defence available. (4) Civil Compensation per Civil Code: (a) Right to compensation for damages caused by violation; (b) Material damage (financial loss + property + medical); (c) Non-material damage (distress + anxiety + reputational) - limited Soviet-era heritage but expanding; (d) Joint and several liability of joint controllers + controller-processor; (e) Limitation period 3 years from awareness; (f) Class action possible per Civil Procedure Code (limited). (5) Director + Officer Liability: (a) Corporate offences attributable to director + officer who consented + connived + neglected; (b) Personal criminal liability for material violations under Articles 147-148; (c) Corporate veil pierced for criminal liability; (d) D and O insurance considerations; (e) Indemnification limits; (f) Personal financial exposure. (6) Operational Sanctions: (a) Operational suspension for material non-compliance; (b) License Revocation for licensed activities (banking + telecom + insurance); (c) Public Naming on Authorized Body website; (d) Government Contract debarment; (e) Sector blacklisting; (f) Foreign cooperation flagging. (7) Reasonable Care Defence: (a) Person took all reasonable precautions and exercised all due diligence; (b) Burden on accused; (c) Corporate due diligence systems essential; (d) Documentation of training + policies + procedures; (e) Compliance audit + internal review records; (f) Industry standard alignment evidence. (8) Training + Awareness Requirements: (a) Mandatory data protection training for all personnel involved in personal data processing; (b) Annual refresher training; (c) Role-based specialised training; (d) Responsible Person + privacy team specialised certifications (CIPP/E or ISO/IEC 27701 lead implementer); (e) Customer service training on rights; (f) Vendor training requirements via contract; (g) Documentation of training completion in Russian + Kazakh. (9) Authorized Body Investigation + Enforcement Procedure: (a) Complaint receipt + admissibility check; (b) Preliminary investigation; (c) Formal investigation + evidence gathering; (d) Interim measures; (e) Provisional findings + right to respond; (f) Final decision + reasoning; (g) Penalty determination + proportionality; (h) Appeal to Administrative Court then Supreme Court of Kazakhstan. (10) Cumulative Penalty Exposure: (a) Administrative + criminal + civil typically separate; (b) Double jeopardy considerations for criminal; (c) Administrative penalty does not bar civil claim; (d) Settlement strategies; (e) Reputational damages typically uninsurable; (f) Multi-jurisdictional considerations (Russia + EAEU + EU exposure). (11) Board + Senior Management Accountability: (a) Tone-at-the-top; (b) Risk Appetite Statement + Privacy Risk Tolerance; (c) Quarterly Privacy Reporting to Board; (d) Annual Privacy Risk Review; (e) Audit Committee oversight; (f) ESG reporting including privacy; (g) Investor + Lender + Insurer scrutiny. (12) AIFC Penalty Framework: (a) Separate AIFC Court jurisdiction; (b) AIFC Data Protection Regulations penalties; (c) AIFC + main Kazakhstan boundary navigation. Coordinates with EU GDPR Articles 82-84 + Russian Personal Data Law 152-FZ + Civil Code + Code of Administrative Offences Article 79 + Criminal Code Articles 147-148 + Kazakhstan Constitution + Civil Procedure Code + Companies Law Director Duties + Insurance Act + AIFC Data Protection Regulations + AIFC Court + Administrative Court + Supreme Court of Kazakhstan + Authorized Body. Kazakhstan PDPL Penalties + Articles 31-32 + CoAP Article 79 + Criminal Code 147-148 apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.