s.16-2(7) points to 'measures referred to in section 24-1(1) and 24-1(2)'; s.24-1 contains no measures

Section 16-2(7): adherence by a Processor or Sub-processor to an approved certification mechanism "may demonstrate the sufficiency of the measures referred to in section 24-1(1) and 24-1(2)". Section 24-1(1) allows a certification scheme to be established; section 24-1(2) says certification does not relieve responsibility. None of them refers to any measures. The assurances and measures of processors and sub-processors are dealt with in section 16-2(1), (2) and (3).

Proposed correction

Please state which measures section 16-2(7) refers to (for example those in section 16-2(1) and (2), or in section 16-2(1) and (3)) and correct the reference to section 24-1(1) and (2) accordingly.

Jurisdiction

Kazakhstan — AIFC

Act

AIFC Data Protection Regulations

Place

s.16-2(7)

Record

Discrepancy

Class

Text of the act

Where it arose

The text of the act

Arxo's conclusion

Confirmed

Official text

Unchanged at last check

Last checked

2026-10-24

Evidence

Contradiction within the text. Quotations are verbatim from the official material; translations are ours and marked.

may demonstrate the sufficiency of the measures referred to in section 24-1(1) and 24-1(2).

A certification scheme may be established for the purposes of enabling a Data Controller or Data Processor to demonstrate compliance with these Regulations.

Any certification achieved by a Data Controller or Data Processor does not relieve it of any responsibility for compliance with these Regulations.

A Controller must only enter into agreements with Processors that provide sufficient assurances to implement appropriate technical and organisational measures

How to check it without Arxo's tools

1. Open AIFC DATA PROTECTION REGULATIONS (with amendments as of 1 April 2025) and find s.16-2(7); s.24-1(1); s.24-1(2); s.16-2(1). Compare the text with the quotation above. A copy is kept in this register: d1a6312a3161802b-aifc-data-protection-regulations-2025-1.pdf (SHA-256 d1a6312a3161802bcd4f252058143c087a07fd8cd3c57f8d3cc9c968f1e5a022, copy of the official file).
2. The finding holds if the quoted passages read as shown and the comparison gives the result stated at the top of this page. If it does not, write to us with the record ID.

How this finding was made

AI agents read the official texts, turned the provisions concerned into executable rules and ran the comparison; they also drafted this record. A person at Arxo checked the finding and approved the report before it was sent (2026-10-27).

Responsible institutions

• AIFC Authority — body that prepares AIFC acts and publishes them on the AIFC website

Reported to

Responses

No response recorded.

Documents and reproduction

• AIFC DATA PROTECTION REGULATIONS (with amendments as of 1 April 2025)

History

1. 2026-10-24Confirmed by Arxo
2. 2026-10-27Entered in the register
3. 2026-10-27Reported to AIFC Authority (e-mail)

Cite this record

Arxo Law, Arxo Findings Register, ARXO-2026-0203, https://arxo.io/findings/ARXO-2026-0203/ (status as of 2026-10-24). Data: ARXO-2026-0203.json.