Prosecutor General of Kazakhstan Berik Asylov has instructed the Information Security Committee of the Ministry of Artificial Intelligence and Digital Development to investigate the circumstances surrounding malfunctions in Yandex Qazaqstan services. The intervention of the supervisory authority was prompted by an inquiry from Lazzat Zhylkybayeva, a member of the unicameral parliament — the Kurultai — who drew the agency's attention to disruptions recorded on October 11. According to her, the company attributed these failures to damage to infrastructure located abroad. The incident proved not to be local: in October, disruptions affected taxi ordering and food delivery functions, among others, making the audit publicly noticeable.
Position of the Company and the Ministry
Yandex Qazaqstan explained that tasks are distributed among servers in different countries, meaning that issues in one country can affect individual service functions in another. The Ministry of Artificial Intelligence and Digital Development, in turn, stated that servers containing personal data of Kazakhstani users are located within the country, while confirming that some components are hosted outside its borders. Thus, both parties agree that part of the infrastructure is geographically distributed, while personal data, according to the ministry, is stored within Kazakhstan.
Context: UAV Attacks on Data Centers
The backdrop for the October glitches involves a series of incidents in Russia. On October 11, a Yandex data center in Vladimir was damaged as a result of an unmanned aerial vehicle attack, forcing its operation to be suspended. This was the third such incident in a few days following attacks on facilities in Sasovo, Ryazan Oblast, and in Kaluga. On November 10, the company reported that following the October attacks, it had restored access to 97.16% of Yandex Cloud client data, while stating that the remaining data could not be recovered due to critical equipment damage and a lack of backups.
Legal Framework and Scope of Audits
As Interfax notes, Kazakhstan has a requirement obliging owners and operators of personal data databases to store and process this information on servers physically located within the country. Against this backdrop, on November 10, Minister of Artificial Intelligence and Digital Development Zhaslan Madiyev announced that by the end of the month, the agency plans to conduct unscheduled inspections of five Yandex legal entities. In parallel, the Prosecutor General's Office is conducting a comprehensive audit of the Information Security Committee itself, which is responsible for state control in the field of personal data: within its framework, the legality of collecting, storing, and transferring personal data will be examined, as well as the completeness of measures to protect citizens' rights, after which a legal assessment will be given to the findings.
Yandex Presence in Kazakhstan and Company Response
More than 15 Yandex services operate in Kazakhstan, including taxis, food and goods delivery, Maps, Yandex 360, the Yandex Ads advertising platform, Yandex Cloud, the search engine and Neuro, Alice, Weather, scooter rentals, and Gas Stations. Yandex Qazaqstan told RBC that they maintain a dialogue with state bodies and are ready to provide the necessary information for the audit, while also stating their compliance with Kazakhstan's legislation and personal data protection requirements.
