"Digitize what you can protect": why data leaks happen in Kazakhstan

A Kazakhstani cybersecurity expert explained why data leaks keep happening in the country and formulated a principle worth hanging on every executive's wall: "We must digitize what we are able to protect." The problem is not digitization as such but its pace: data is collected and converted to electronic form faster than protection systems are built around it.

The mechanics of a typical leak are duller than Hollywood scripts. Not a genius hacker, but a database sitting on a server with a default password; an export sent to a contractor "real quick" over a messenger; a dismissed employee's access nobody revoked. Every new service that collects personal data widens the attack surface — while protection stays at the level of "someday later".

For business in Kazakhstan the expert's principle converts into a short test before launching any new system — a CRM, a loyalty program or an AI service. Who exactly has access to this data, and is it revoked on dismissal? Is the data encrypted at rest and in transit? Would you learn about a leak before it makes the news? If even one question has no answer, it is too early to collect that data. Fines for leaks are growing, but customer trust lost to a single headline costs more than any fine.