Privacy & Information Security Policy
This policy sets out how the University of Innovation and Technology (Innotech) protects information and personal data across its systems and services. It is aligned with the Republic of Kazakhstan's Law “On Informatisation” (No. 418-V, November 24, 2015), the Law “On Personal Data and its Protection” (No. 94-V, May 21, 2013), and the ISO/IEC 27001 standard, and is binding on all staff, students and partners.
Last updatedApril 4, 2026
1. General provisions
This Information Security Policy defines the principles, objectives and measures by which Innotech ensures the confidentiality, integrity and availability of information. It applies to everyone who accesses university information systems and data.
The policy is issued in accordance with Kazakhstan legislation and international best practice (ISO/IEC 27001) and is reviewed at least once every three years.
2. Terms and definitions
Key terms used throughout this policy include: information security (protecting information from unauthorised access, alteration or destruction); information system; ICT infrastructure; personal data; threat; incident; and means of protection such as multi-factor authentication.
3. Goals and objectives
The goal of the policy is to maintain a data-protection system that lets the university community use information safely.
- Ensure the confidentiality, integrity and availability of information.
- Prevent unauthorised access to systems and data.
- Protect the personal data of staff, faculty, students and partners.
4. Scope of application
The policy covers information systems and databases, cloud services, hardware and network equipment, mobile and removable media, printed and electronic documents, and the personal data of staff, students and partners.
5. Core principles
- Lawfulness — compliance with legislation.
- Systematic and continuous protection.
- Integrity, availability and confidentiality of information.
- Accountability for information security across all roles.
6. Objects of protection
- Information systems and databases.
- Personal data of staff, faculty and students.
- Paper and electronic documents.
- Technical means and communication networks.
- The university's reputation.
7. Threats and risks
Recognised threats include data leaks, cyber-attacks (viruses, phishing, hacking), technical failures, human error or negligence, and external events such as fire or natural disaster.
8. Responsibility and roles
The Rector approves the policy. Information is classified as open, service or confidential. An accountable officer from the Technical Support Office is appointed by the Rector's order; heads of structural units enforce the policy locally; and all staff and students must report security incidents promptly.
9. Information protection measures
- Strong passwords and multi-factor authentication.
- Antivirus, firewalls and intrusion-detection systems.
- Encryption of communication channels and storage media.
- Regular backups with restore testing.
- Role-based access control.
- Ongoing security-awareness training for staff.
10. Final provisions
The policy remains in force until replaced, for a maximum of three years. The original is held by the Quality Control Service, with a copy held by the Technical Support Office. Questions about this policy or your personal data can be directed to info@innotech.edu.kz.