Data Security in Working with Artificial Intelligence
Starting from September 15, 2025, large language model providers began drastically reducing the retention periods for requests: API call logs are now automatically deleted after seven days instead of the previous thirty. At the same time, Kazakhstan tightened its own regulations: amendments to the Law "On Personal Data and Their Protection," effective from January 18, 2026, increased fines for data breaches to 10,000 MRP, which, at the 2026 MRP rate of 4,325 tenge, amounts to about 43 million tenge for a legal entity. Additionally, there is now a requirement to notify the regulator of an incident within 72 hours. These two facts — short retention by the vendor and increased liability for businesses — set the entire framework for the discussion on data security when working with AI.
In our practice at West Star Ltd, we encounter the same situation almost every month: a company wants to integrate AI into its processes but does not understand where exactly the data goes, who sees it, and what the Kazakh law says about it. The topic seems technical, but in reality, it is primarily a matter of discipline and a properly structured framework. Below, I will analyze where data actually leaks, what model providers do with your requests, how all this intersects with the requirements of the Republic of Kazakhstan, and which measures truly work rather than just create a semblance of protection.
WHERE EXACTLY DATA LEAKS
The first misconception is to think that the main threat is a "malicious" model provider who will steal your secrets. In practice, large vendors are quite strict about business client data, and the main leaks occur within the company itself and due to processes, not algorithms.
The most common channel is employees who insert pieces of work documents into a public chatbot: contracts, exports with clients' personal data, source code, financial reports. A person wants to quickly get a summary or find an error, but in fact, sends confidential text to an external service. A well-known case in 2023, when Samsung engineers uploaded internal code to a public chatbot several times, showed that even in a tech company, culture is more important than any policies on paper.
The second channel is integrations without rights segregation. When an AI agent is connected to a database or accounting system "with one key with full access," the model can read much more than needed for a specific task. If the request is poorly formulated or malicious text enters the system, the agent may extract unnecessary information.
The third channel is logs and intermediate storages. Data settles not only with the model provider but also in your own logs, monitoring, cache, and communication between services. Often, these unnoticed copies become the source of leaks because no one monitors them as strictly as the main database.
WHAT AI PROVIDERS DO WITH YOUR DATA
Here it's important to distinguish between two fundamentally different modes of operation because they are constantly confused.
The first mode is public consumer chats with free or personal subscriptions. Since fall 2025, with several major providers, correspondence in such tariffs is by default used for training future models unless the user disables this option in privacy settings. For personal tasks, this is acceptable, but for work data, it is categorically not: you are effectively giving away the text for an indefinite period and losing control over it.
The second mode is requests via programmatic interface and corporate tariffs. Here the rules are different. Data transmitted via API is not used for model training, and retention periods are minimal — with one of the leading vendors, API logs are deleted after seven days and are only used for abuse control. Corporate and business contracts separately specify that the content of requests does not go into training.
The practical conclusion is simple: work processes should be built only on the programmatic interface or corporate tariffs with signed terms, and public free chats should be kept away from any sensitive data. The difference between these two modes is the boundary that most companies do not draw, and then are surprised by questions from auditors.
LOCALIZATION AND THE LAW OF THE REPUBLIC OF KAZAKHSTAN
A separate layer that cannot be ignored in Kazakhstan is the localization requirement. The law explicitly requires storing personal data of Kazakhstani citizens in databases physically located within the country's territory. This applies to websites, CRM, client databases, mailings, and cloud solutions, and the requirement does not disappear if access to the server is organized remotely.
An obvious contradiction arises: most powerful language models operate outside Kazakhstan, in foreign data centers. Does this mean they cannot be used at all? No, but it means the architecture needs to be thought out in advance. The key idea is to separate storage and processing. The database with personal data remains in the Kazakhstani framework, as required by law, and only what is necessary for a specific task is sent to the external model, preferably in anonymized form.
In practice, it looks like this: before sending a request, direct identifiers — full names, IINs, phone numbers, addresses — are removed or replaced from the text. The model works with the anonymized fragment and returns a result, which is then re-associated with a specific record within the protected framework. This way, you get the benefits of a strong model without exposing the entire array of personal data. Plus, don't forget the obligation to notify the regulator of a leak within 72 hours — this means monitoring and logging should be set up in advance, not assembled in panic after an incident.
HOW WE BUILD A SECURE FRAMEWORK
Over several years of implementations, we have developed a set of measures that we consider a reasonable minimum, not an ideal.
First — the principle of minimal rights. The AI agent gets access only to the data and functions needed for its task, and never a key with full access to the entire system. A separate role, a separate key, a limited set of operations.
Second — anonymization at the input. We try not to send to the external model what can be replaced with a conditional identifier. The less sensitive text goes outside, the smaller the risk area.
Third — control of channels. We explain to employees and technically restrict which services are permissible for work data and which are not. Public free chats are closed for confidential materials.
Fourth — logging and storage under control. We record which requests went where, but at the same time, we monitor the retention periods of our logs to avoid creating a second, unguarded warehouse of personal data.
Fifth — separation of storage and processing. Personal data of citizens of the Republic of Kazakhstan remains in the Kazakhstani framework, and external models are used only for computations on anonymized fragments.
None of these measures is magic. They only work together and only with the active discipline of the team.
LIMITATIONS AND WEAK SPOTS
I'll honestly name what is usually silent in promotional materials.
First — anonymization is not absolute. By a combination of indirect signs, a person can sometimes be re-identified even without direct identifiers. There is no 100% anonymization in general, and this must be accepted as a given.
Second — provider policies change. Today, API data is not used for training and is stored for seven days, but conditions are reviewed, and what is true at the time of writing this article should be rechecked before each serious implementation. We ourselves treat any vendor statements as something to be fixed in a contract, not taken on faith.
Third — localization complicates and increases the cost of architecture. Separating storage and processing, keeping the database in the Republic of Kazakhstan, and sending anonymized fragments outside is additional engineering, which means time and money. There is usually no cheap way to be both fast and fully compliant with requirements.
Fourth — the human factor overcomes technology. You can build a perfect framework, but one employee inserting a contract into a personal chatbot from a phone nullifies part of the efforts. Training and culture are more important here than any settings.
Fifth — AI introduces new types of attacks. Injecting malicious instructions into the text read by the agent is a real class of threats that did not exist in conventional systems. No one can completely close it yet, only reduce the risk by limiting rights.
Sixth — compliance with the law is a process, not a checkbox. The requirements of the Republic of Kazakhstan are updated, fines increase, new obligations like 72-hour notification appear. You can't "make it safe" once; you have to constantly monitor it.
PRACTICAL CONCLUSION
For a specialist directly working with AI: use only the programmatic interface or corporate tariffs, never insert work data into personal free chats, and get used to anonymizing text before sending. These are three habits that cover most everyday risks.
For a department or project manager: write a clear policy — which services are allowed, who has access, how keys are issued based on the principle of minimal rights. Set up logging and plan in advance who and how will notify the regulator in case of an incident to meet the 72-hour deadline.
For a business owner: treat data security in working with AI not as a one-time project but as a constant expense item and area of responsibility. The localization requirement, increasing fines, and changing provider policies mean that saving on architecture today can result in millions of tenge in fines tomorrow. It's more profitable to lay a secure framework immediately than to redo it under audit pressure.
FREQUENTLY ASKED QUESTIONS
Is it legal to use foreign AI models in Kazakhstan at all?
Yes, if the architecture is built correctly. Personal data of citizens of the Republic of Kazakhstan must be stored in a database on the country's territory, and anonymized fragments can be transferred to the external model for processing. The law itself does not prohibit the use of a foreign model — it prohibits exporting and storing personal data of citizens outside.
Is the model provider definitely not training on our data?
For requests via programmatic interface and corporate tariffs, leading vendors explicitly state that data is not used for training, and retention periods are minimal. For free personal chats, this is generally not the case — there, correspondence can by default go into training. Therefore, work processes are built only on the first option, and conditions are fixed in the contract.
What are the penalties for a personal data breach?
From 2026, fines for legal entities for gross violations increased to 10,000 MRP, which is about 43 million tenge at the 2026 rate. Additionally, the law requires notifying the authorized body of a leak within 72 hours. Criminal liability is also possible in severe cases.
Where to start if we are just implementing AI?
With three steps: close public free chats for work data, move everything to a programmatic interface with signed terms, and set up anonymization plus minimal access rights. This gives maximum effect with minimal investment, and a more refined architecture with storage and processing separation can be built further.