Kazakhstan Sets New Rules to Connect Shop and Cafe Cameras to National Surveillance Network

Private cameras face a six month connection deadline

Kazakhstan plans to bring cameras in shops, cafes and other places open to the public into its National Video Monitoring System under rules scheduled to take effect on January 3, 2027. Owners notified that they must connect will have up to six months to meet the technical requirements, followed by an equipment check and registration.

The changes come under National Security Committee chairman's Order No. 132/ҚЕ, dated October 28, 2026. They cover the connection process, automated video analysis, storage periods and the procedure government agencies must follow to obtain recordings. National security bodies coordinate the network, whose users include law enforcement agencies, the Ministry of Emergency Situations and local administrations.

For businesses, the practical change is that a camera installed to watch a checkout, entrance or dining area may become part of a national security network. Mandatory connection depends on the legal category of the premises, rather than whether the camera belongs to the government, a company or an individual.

The National Security Committee's official rules register identifies the October 2026 replacement order and says it takes effect 60 calendar days after its first official publication. The existing text displayed beneath that notice sets out procedures and storage periods that differ from the replacement described for January 2027.

Those differences matter to owners preparing equipment and to people whose movements may be recorded. The replacement calls for 30 days of ordinary video storage and 12 months for information about incidents showing signs of public order violations. The existing displayed rules specify 30 days for ordinary footage and at least seven years for recordings of events connected with national security and public order.

Which cameras must join the network?

Article 30-1(3) of Kazakhstan's Law on Cybersecurity sets out the categories subject to mandatory connection. They include cameras operated by central and local government bodies, cameras at facilities vulnerable to terrorism, and those used for public safety and road safety.

The requirement also covers cameras in public spaces, places where large numbers of people gather and facilities open to the public, regardless of ownership. Shops and cafes fall within that broad description. Both individuals and legal entities can be subscribers, the term used for owners or holders of connected surveillance systems.

Local administrations, known as akimats, will prepare annual connection schedules together with agencies that use the system. They must submit those schedules to the coordinator by the end of the first quarter, with approval required by May 1. Owners will then receive notices telling them to connect.

A facility missing from a schedule can be added through an amendment. Owners outside the mandatory categories may apply voluntarily to the coordinator, which decides whether to accept the connection.

How connection will work

Owners receiving a notice will have up to six months to complete the technical conditions. Once ready, they must apply to the operator for an inspection against national standard ST RK 4044. The inspection period is described as 10 working days.

Equipment that passes receives permission to connect. If inspectors identify faults, owners have 60 calendar days to correct them before another check. Within 10 working days after connection, the owner and operator must sign a connection record, and the cameras enter a dedicated register.

The existing rules displayed in the official register use a different sequence: an owner applies for technical conditions within 15 working days of notice, the technical operator supplies them within another 15 working days, and the connection deadline specified in those conditions can extend to 12 months. The replacement described for January therefore gives owners a shorter maximum preparation period.

What owners must maintain and what costs remain unclear

Camera owners will remain responsible for maintaining their equipment and data transmission channels after joining the national network. They must tell the operator about failures, disconnections and planned maintenance. Connection creates an ongoing technical responsibility, rather than a task completed when the first images reach the system.

The operator can require additional equipment at an owner's premises. Its decision will depend on the number of cameras, the capacity of the communications connection and the technical capabilities of the surveillance system. A site with many cameras produces more video to transmit and process than a small shop with a few devices.

The rules do not specify who will pay for connection or additional equipment. That leaves businesses without a stated allocation of those costs as they prepare to meet the requirements.

The existing official appendix provides concrete minimum camera specifications: resolution of 1920 by 1080 pixels, a bitrate of at least 2,000 kilobits per second and at least 25 frames per second. Resolution describes image detail, bitrate measures how much data the video uses, and the frame rate describes how many individual images make up each second of footage. Checks under the replacement are tied to ST RK 4044.

Two storage periods, with a major change for incident records

Ordinary recordings and metadata will be stored for 30 days under the replacement. Metadata is information attached to footage, such as the time of recording and the camera's location. It helps users find a particular event without watching every hour of video.

Information about incidents showing signs of a public order violation will be kept for 12 months. For a person recorded during an incident, that means the relevant record can remain in the system much longer than routine footage.

The existing official text requires at least seven years of storage for video of events connected with national security and public order. Its wording covers a broader category than the replacement's description of incident information. The important practical issue is how an event is classified, because that classification determines whether the ordinary 30 day period or a longer period applies.

Who controls access to the recordings?

National security bodies coordinate the system. The operator's role can be held by a government body or a company with predominantly state ownership, while the State Technical Service serves as administrator. Kazakhtelecom has operated the national network.

Special state agencies, law enforcement bodies, the Ministry of Emergency Situations and local executive bodies are designated users. The administrator manages access rights, maintains the infrastructure and checks compliance with cybersecurity requirements. Users must follow information security rules and may not share their account credentials with other people.

Government agencies seeking data must submit a request to the coordinator in circumstances allowed by Kazakh law, together with digital storage media. The coordinator has 10 working days to check the legal grounds. An approved request goes to the operator for delivery; a rejected request must receive an explanation.

The coordinator may allow requests and responses in digital form. The operator must also keep the system running around the clock, protect stored information, provide technical maintenance and promptly notify the National Cybersecurity Coordination Center of detected cybersecurity incidents.

What automated identification means for people

Video analytics allows software to examine camera images automatically. Its functions can include spotting an abandoned object, detecting a gathering or matching an image of a person against identifying information. Facial recognition uses features of a face to make that comparison.

The replacement permits identification of people only on the National Video Monitoring System's technological platform and only for national security and public order purposes. Analytics software can operate in system data centers and on additional equipment installed at subscribers' premises.

An incident at Almaty airport in June 2025 shows why the use of identification systems has drawn scrutiny. Political blogger and former official Sanzhar Boqaev was stopped after the TargetEYE facial recognition system flagged him. He said an officer showed him a profile containing his personal details and identifying him as a civil activist. He was released after being briefly detained.

The Interior Ministry said Boqaev had been added incorrectly because he resembled another person. Interior Minister Yerzhan Sadenov denied that the government was compiling a database of activists and offered this explanation:

technology can make mistakes, too.

Target AI, the company behind TargetEYE, said law enforcement agencies decide how its technology is used. In a statement about its role, the company said:

In most cases, our company has no information about what purposes or how the platform's technical functions are applied.

Existing camera networks show the scale of the task

Almaty's mayor's office put the city's camera count at at least 128,000 in 2025. Dmitry Panchenko, TargetAI's commercial director, said those cameras were linked to the company's system. Target AI also said its platform had been integrated into police and supervisory systems in eight regions.

Local officials cited 6,000 connected cameras in Atyrau and at least 5,000 in Pavlodar, where another 4,200 were planned over three years. Against the stated base of 5,000, that planned addition would represent an 84 percent increase.

Almaty's municipal Unified Video Monitoring System had 45,200 cameras connected at public and private premises in December 2024. Its software could detect fights, people, vehicles, fire and smoke. The Defense Ministry separately said 14,000 cameras were installed in state buildings under its control, with recordings stored on servers within military units.

The national system has also been described as including more than 43,000 cameras using artificial intelligence to detect fights, crowds and abandoned objects. These figures describe municipal networks, commercial integrations, departmental installations and national connections. A combined national total has not been published.

The Interior Ministry has credited the national system with helping locate wanted people and detect unattended objects. In March 2026, it included the system's deployment and video analytics among its main digital projects.

Privacy concerns began before the latest rules

Kazakhstan's debate over biometric identification reaches back to proposals for regulating digital technologies published for public discussion on August 17, 2019. Those proposals sought a legal basis for compulsory and voluntary connections to a national video system. Almaty also planned 1,000 facial recognition cameras for places where crowds gather, with images sent to the city police control center.

The legal framework discussed at the time included the Law on Personal Data and Protection of May 21, 2013, and the Law on Dactyloscopy and Genome Record-Keeping of December 30, 2016. The latter dealt with fingerprints and genetic records and then had a planned effective date of January 1, 2021. Privacy concerns centered on biometric databases, exceptions to consent and the need for independent oversight.

The National Security Committee's archived 2020 draft, published on July 29 that year, shows how detailed the network's design had become. It proposed keeping copies of archive requests and responses for at least 24 months and placing analytics equipment at subscribers with more than 500 cameras.

Digital rights expert Dana Malikova, who has worked with civil liberties groups in Kazakhstan, has warned about the consequences of losing control of identifying information. Explaining her concern about facial recognition, she said:

The risk here is much higher because of the use of facial recognition,

Malikova has also questioned the model of technology use Kazakhstan follows as Chinese equipment becomes part of its digital infrastructure. Separately, Kazakhstan's digital ministry disputed allegations that the country had become an international client of Chinese company Geedge Networks for an internet censorship system. For camera users and the public, the immediate concerns remain access controls, personal data security and accountability for identification decisions.

The dates that shape implementation

Kazakhstan's national video system has operated since 2020, with later deployments and technical changes expanding its reach. The legal register distinguishes the October 2026 replacement from amendments issued in April 2026, some of which took effect on July 12, 2026.

• July 29, 2020: An early draft of the operating rules was published for public discussion.
• October 27, 2020: Order No. 69-қе approved the national system's operating rules.
• December 2024: Almaty's municipal network had 45,200 connected cameras.
• October 28, 2026: Order No. 132/ҚЕ approved a replacement version of the rules.
• January 3, 2027: The replacement is scheduled to take effect.
• Each year: Local administrations must submit connection schedules by the end of the first quarter, with approval due by May 1.

Owners will face their individual connection deadlines after receiving notice. For customers, pedestrians and other people entering public premises, implementation means more privately operated cameras feeding a system used by designated government agencies, with automated analysis and storage rules attached.

Key Points

• Cameras in shops, cafes and other facilities open to the public fall within mandatory connection categories, regardless of ownership.
• Owners notified to connect will have up to six months to meet technical conditions.
• The replacement provides 30 days of ordinary storage and 12 months for information about incidents showing signs of public order violations.
• The existing official text specifies at least seven years for certain national security and public order event recordings.
• Identification through video analytics is restricted to the national platform and national security and public order purposes.
• Owners remain responsible for equipment and communications maintenance; payment arrangements for connection and extra equipment are unspecified.