A guest database from Wi-Fi and the new personal data rules

A captive portal collects guest phone numbers. That is personal data, which makes the venue its owner with all the duties attached. In September 2026 the rules were updated, so this is not a "someday" topic.

Why it applies to any cafe with Wi-Fi

The moment a guest types a phone number on the login page, you begin processing personal data. Whether you ever send anything is irrelevant: collection and storage already count. The same logic covers the connection log you must keep under communications law — see Wi-Fi log retention.

So one and the same table lives under two regimes: as a session log it is required by communications rules, as a contact base it falls under personal data law. The requirements do not contradict each other, but they should not be confused.

Which act this is about

The Rules on personal data protection measures were approved by an order of the Minister of Artificial Intelligence and Digital Development of 3 September 2026 and took effect in September 2026. Publications disagree on the exact effective day, so verify the date and the current wording on the official legal information portal adilet.zan.kz. The governing act is the Law on Personal Data and Its Protection.

Which category you fall into

Category	Number of subjects	Notification of the authority
Small	up to 10,000	not required
Medium	10,000 to 500,000	required
Large	500,000 and above	required

A single cafe or a small hotel almost certainly counts as small and notifies nobody. A chain or a shopping centre with a few thousand people a day crosses the threshold faster than it seems — count unique guests over all time, not per month.

What everyone must do, including small owners

• Define what you collect and why. "Phone number — for guest network authorization and offers" is already a list and a purpose
• Appoint a responsible person. A named individual, not "the management"
• Separate access. A waiter should not be able to export the whole base
• Log actions on the data. Who looked, who exported, when
• Keep backups and protect the system from malware

Medium owners add role-based access, multi-factor authentication for restricted data, staff training and vulnerability analysis. Large owners add an independent audit, security monitoring and penetration testing.

A breach: one working day

The toughest requirement. On discovering a personal data security breach you must notify the authority within one working day. The notice names the person responsible for processing, the measures taken, and details of the affected subjects.

Practically: the answer to "who does this and through which channel" must exist in advance. Looking up the regulator mid-incident guarantees missing the deadline.

What changes on the portal itself

• Consent must be explicit and separable. Consent to authorization and consent to marketing are different things; one checkbox for both weakens each
• Collect the minimum. A number is enough for authorization. Passport details and addresses in a guest Wi-Fi system only grow your liability
• Deletion must be real. The rules define deletion as actions that rule out recovery. Flagging a record "inactive" is not deletion
• Unsubscribe works first time. Both a legal requirement and common sense — see collecting a guest database via Wi-Fi

How TheLink handles it

Data sits in the cloud, access is role-based, actions on the base are logged, export and deletion are available from the dashboard, and consent to authorization is separated from consent to marketing at the form level. That covers the baseline measures but does not remove the venue’s role as data owner: you appoint the responsible person and you notify the regulator. Scenarios for cafes, hotels and malls.

Checklist

• I know how many unique guests are in the base and which category that puts me in
• A responsible person is appointed
• The data list and purposes are written down
• Authorization consent is separate from marketing consent
• Not every employee can reach the base
• I know who reports a breach and where, within one working day
• Communications requirements for the session log are handled separately — see the page about the law and inspections

This material is for reference and is not legal advice. The personal data rules were amended several times during 2026; verify the current wording and effective date on adilet.zan.kz or with a lawyer.