Kazakhstan’s personal data law: what companies must do

Date checked: 18 October 2026.

Kazakhstan’s personal data law is Law No. 94-V of 21 May 2013, “On Personal Data and Their Protection.” In 2026, a company must determine what data it needs and why, arrange lawful collection and processing, protect the data, store them in Kazakhstan, and give effect to people’s rights. A legal entity must appoint a person responsible for organizing processing. Whether it must notify the regulator when processing begins and ends depends on its category. Articles 7–12, 25 and 25-1.

Searches for a “personal data protection law” or “Kazakhstan personal data act” generally refer to the same law. Other instruments also apply, including rules on protective measures and, in digital settings, the Digital Code. Customer consent alone is therefore insufficient to organize the entire data process. The following sections map the main requirements for a company. Article 4 of the law; Digital Code.

What a company needs to organize under the law

Personal-data work begins with a purpose: what does the company do for the person, and which details does that purpose actually require? Article 25 requires an approved list of necessary and sufficient personal data, unless a law provides otherwise, and documents defining the operator’s policy. Nearly every field in a form should have an answer to “why do we need this?” Articles 7 and 25.

The table matches legal provisions to operational checks. A company chooses the precise names of its internal documents. The detailed measures come from the rules approved by Order No. 179/NQ, as well as the law itself.

Definition, scope, and examples of personal data in Kazakhstan

Under the law’s definition, personal data consist of information, or a set of information, about a data subject supplemented by one or more personal-data identifiers. The information can thus be connected to a person. The subject is the individual to whom the information relates. An operator collects, processes, and protects it. The owner exercises rights to possess, use, and dispose of a paper database and/or digital object. Roles follow actions and rights, rather than department names. Article 1.

Article 6 lists personal-data identifiers: a person’s full name taken together, individual identification number (IIN), facial image, facial biometric vector, and derivatives of such a vector that can be restored to the original value. Is a full name personal data? Yes, when it relates to a person. Passport details in a customer file can also connect information to that person. Can a field be judged in isolation? No: an order number linked to a customer record should be assessed together with the link, rather than as a random string. Articles 1 and 6.

A company’s list of personal data is not one universal list of “everything about a person.” Examples include a customer’s document details, an employee’s personnel record, or a student’s or schoolchild’s education record. Information about convictions linked to a person also calls for an assessment of purpose and lawful grounds; the personal-data law does not impose a general duty on companies to collect it. Define the information for the actual task: the list identifies what a particular process contains. Articles 7, 12 and 25.

Russian working documents abbreviate “personal data” as PDn or PD. In Kazakhstan, the law’s applicability to citizens, foreign nationals, employees, and customers depends on the particular processing operation. A school or learning management system changes the context; it does not remove the requirements concerning purpose, grounds, and protection. For a child’s data, account for the legal representative and applicable special rules. An adult-consent flow cannot automatically be copied to a child’s case. Articles 3 and 7–8.

The law does not name website cookies as a separate class of personal data. What matters is what the file contains and whether identifiers can link it to a subject. This is an assessment of a particular website configuration, not a rule that “all cookies are always personal data” or permission to collect any identifiers without checking. Article 1 definitions.

Publicly available and confidential personal data

By access level, the law distinguishes publicly available personal data from restricted-access data. It does not replace that division with a universal table of “general, special, and private” data; sector-specific information may be subject to further rules. Restricted-access personal data are confidential information. Owners, operators, and third parties with access must maintain confidentiality, and employees are bound by this duty too. Articles 6 and 11.

Publicly available personal data are information for which the law does not require confidentiality and to which access is free with the subject’s consent. Details about a professional made openly accessible under those conditions are an example. A photo found online does not automatically permit a company to add it to its database: article 7 requires each processor to demonstrate the lawfulness of further processing of self-disclosed data, sets special conditions for subsequent use of published data, and prohibits extraction for an unrelated purpose to create or expand databases. Article 6; article 7, paragraphs 3–5 and 11.

Separate decisions on collection, processing, and consent

Collection means obtaining personal data. Processing includes accumulation, storage, alteration, supplementation, use, distribution, depersonalization, anonymization, blocking, destruction, and deletion. Processing therefore continues after the form closes: the saved questionnaire and support staff’s access remain part of it. Use is permitted only for the previously stated collection purposes. Articles 1 and 14.

Processing purposes must be specific, predetermined, and lawful. The law expressly says that personal data whose content and volume exceed what is necessary for those purposes must not be processed. As a general rule, collection and processing rely on the subject’s or legal representative’s consent, subject to the exceptions in article 7, paragraph 5, and article 9. These exceptions concern cases provided by law, such as law-enforcement activity or state statistics. They are not a menu of convenient grounds for any commercial form. Articles 7–9.

Consent must be given in a way that allows the company to demonstrate its receipt. It covers information about the owner and/or operator and the subject, its validity period, transfer to third parties, cross-border transfer, possible publication in publicly accessible sources, and the data to be collected. Data from state digital objects are subject to a rule involving a state service; interaction with such objects also has integration conditions and the exceptions of article 8-1. An ordinary website checkbox does not demonstrate compliance with those special requirements. Articles 8 and 8-1.

Disclosing personal data to third parties or granting access requires a check of the legal ground and consent conditions, taking statutory exceptions into account. Who may request personal data? Companies as well as government bodies may ask a person, but a request alone does not oblige the person to supply them. Article 24 imposes that duty only in cases established by law. Checking a customer’s personal data therefore starts with whether the organization is entitled to obtain precisely those details. Article 7, paragraph 6; articles 10, 15 and 24.

Storage in Kazakhstan and transfer abroad

Collection and storage must be tied to purpose and time. Article 12 requires storage in a database and/or digital object located in Kazakhstan. The period runs until the purposes of collection and processing are fulfilled, unless legislation provides otherwise. The law does not set one retention period for all of a company’s data. Article 12.

Cross-border transfer is regulated separately. Article 16 provides for transfer to states that protect data and lists circumstances in which transfer to states without that protection is allowed, including consent to such transfer. Other laws may prohibit or limit a transfer. For service information about telecom subscribers and users, the article refers specifically to the Law on Communications. Consent concerning an overseas contractor does not cancel the requirement to store data in Kazakhstan. Article 16.

Rules No. 179 add detail: collection and processing of restricted-access data must use digital objects located in Kazakhstan, while digital data must be stored in a server room or data center in the country. An infrastructure map should therefore show where processing and storage actually occur. Checking backups and remote support access is a practical way to identify recipients and possible cross-border transfers. Paragraphs 16 and 18 of the rules.

Whether to notify the operator register depends on category

“Personal data operator register” is a common shorthand. The law calls it the register of persons collecting and/or processing personal data. Article 10-1 requires notification of the authorized body before processing begins and ends, but lets small and medium owners, operators, and third parties operate without such notification. This register should not be confused with the security-breach register in article 23-2; they serve different purposes. Articles 1, 10-1 and 23-2.

Category is based neither on revenue nor on the familiar small-business designation. Article 25-1 counts unique individuals across one or more digital systems. It calls up to and including ten thousand subjects “small,” ten thousand to five hundred thousand “medium,” and five hundred thousand or more “large.” Restricted-access data raise the category by one level. The stated ranges overlap at their boundaries, so the applicable category at ten thousand or five hundred thousand needs clarification before deciding on notification and measures. Article 25-1; Rules No. 179, paragraphs 8–11 and 17.

A notification to the regulator includes the processor, protective measures, start date, data types, whether third-party transfer is possible, cross-border transfer, distribution, and the location of the database or digital object. That is a different procedure from telling a customer their data have been transferred. Article 19 governs the latter: where notification is required, it must be given within ten working days unless a law says otherwise, subject to the article’s listed exceptions. Articles 10-1 and 19.

What protective measures does a company need?

Personal-data protection in Kazakhstan includes legal, organizational, and technical measures. Its aims are to preserve integrity and confidentiality, secure individual rights, including access to data, and prevent unlawful collection and processing. Article 22 requires prevention and detection of unauthorized access and mitigation of its consequences. Duties begin at collection and continue until the data lifecycle lawfully ends. Articles 20–23.

Rules No. 179, as amended by Order No. 534/NQ of 3 September 2026, set measures by category. For small operators they include data and access lists, purposes, internal documents, access controls, user identification and authentication, activity logging, backups, malware protection, and secure channels. Medium operators must meet those requirements plus others: role-based access, MFA for users of restricted-access data, cybersecurity event monitoring and response, training, vulnerability analysis, and internal control. Large operators additionally need security assessments, independent audits, monitoring, and the other measures in paragraph 14. Rules, paragraphs 12–14.

For restricted-access data, paragraph 15 adds rules on logs, integrity, and cryptographic protection, with its stated conditions and an exception for cross-border transfer. Digital protection is more than installing antivirus software. Choosing controls requires reading the full applicable set of requirements, including article 23 on masking and hashing. Rules, paragraph 15; article 23.

For employee data, define HR purposes, who may access the records, and how access ends when duties change. This applies the general rules to an HR process; additional grounds and periods must be checked under employment and other applicable law. The person responsible for processing performs internal control, informs employees, and oversees requests, but appointment alone does not replace technical controls. Articles 11 and 25.

An individual’s request and a security breach

A request from the data subject is a distinct operational scenario. A person may ask what data are held and about purposes, sources, methods, and periods of processing; they may seek correction and, in the cases provided for, blocking, anonymization, destruction, or deletion. A company needs a channel for requests and a reasoned response if it refuses. Article 25 also lists actions subject to a one-working-day deadline. Articles 24–25.

State supervision of personal-data operators generally takes the form of an unscheduled inspection under the Entrepreneurial Code. Supervision of government bodies follows the personal-data law; for the National Bank and its organizations, the Entrepreneurial Code, personal-data law, and Law on the National Bank apply. This is a separate supervisory regime, not the procedure for answering a customer’s request. Article 27-2.

Withdrawal of consent does not automatically mean immediate deletion of everything. Article 8 limits withdrawal where it would conflict with the law or an obligation remains unfulfilled. Within fifteen working days of withdrawal notice, processing must cease if legislation does not require further retention or processing, or a reasoned refusal must be provided. Article 18 refers to the exceptions in article 41, paragraph 4, of the Digital Code, including preservation needed for justice and public interests expressly established by law. Where retention is mandatory, the code separately regulates restricted access and suspension of processing, with exceptions. Articles 8 and 18; Digital Code, article 41.

On discovering a personal-data security breach, an owner, operator, or third party must notify the authorized body within one working day, providing the responsible person’s contact details if there is one. A routine reply to a customer cannot substitute for this notice, and it must not wait until the internal investigation ends. Article 25, paragraph 2, subparagraph 8; Rules, paragraph 23.

Open full-size diagram

Examine one remote-identification session

Suppose a customer starts identity verification, uploads a document and selfie, but does not finish the application. The company may hold different items: the image, extracted details, a facial vector, a comparison result, and a technical log. This is a hypothetical architecture, not a description of a particular product. For each item, establish the purpose, legal ground, processing location, recipient, and event that ends retention.

The diagram’s point in words: identify the necessary item and purpose first, then the lawful ground, recipients and geography, applicable protection, and the condition for ending processing. These decisions are connected; consent does not replace the other checks.

A counterexample: abandonment of an application does not prove that every associated record may immediately be destroyed. Legal duties or grounds to resolve a dispute may remain. The opposite mistake is indefinite “just in case” retention; that does not explain why each item is necessary under article 7. Testing the map against an abandoned application, a complaint, and a contractor change is an editorial recommendation, not proof of legal compliance.

If automated processing creates, changes, or ends a person’s rights or lawful interests, article 19-1 prohibits it except with consent or in cases provided by law. It also requires an explanation of the procedure and consequences, an opportunity to object, and consideration of an objection within three working days. Face-comparison output and the service decision should therefore be designed as separate things. The general law does not prescribe one universal technical identification flow for every sector. Article 19-1.

Changes in 2025–2026 and liability

Amendments to the personal-data law must be read with their commencement dates. Law No. 231-VIII of 17 November 2025 added, among other things, requirements for automated processing. Law No. 256-VIII of 9 January 2026 changed digital terminology. Law No. 326-VIII of 24 June 2026 introduced the processor register, categories, and several data-lifecycle rules. Its paragraph 37, which concerns the personal-data law, takes effect under the general rule in article 2: sixty calendar days after first official publication. Deferrals to 2027 for other provisions of the same act must not be applied to it. Law No. 231; Law No. 256; Law No. 326, article 1, paragraph 37, and article 2.

An old personal-data checklist alone is insufficient in 2026. Protection Rules No. 179 were restated by Order No. 534/NQ, officially published on 10 September 2026 and taking effect ten calendar days after first official publication. The provisions here were checked as of 15 October 2026. Order No. 534/NQ.

Article 29 refers liability to Kazakhstan’s laws. Article 79 of the Administrative Offences Code distinguishes unlawful collection or processing from failure to protect data, as well as offences involving additional circumstances; penalties depend on the conduct and the party involved. Article 147 of the Criminal Code provides for criminal liability under its stated conditions, including substantial harm for some offences. Not every error automatically becomes a criminal case; one fine amount for all companies would also be misleading. Administrative Offences Code, article 79; Criminal Code, article 147.

Start with one real form, questionnaire, or verification session. Link each field and derived file to its purpose, ground, recipient, storage location, and end-of-processing rule. Then compare the map with the company’s legal category and protective measures. Send unclear grounds, borderline categories, and sector-specific retention periods to the responsible specialist before changing the process.

Originally published in Russian. Adapted for English readers.

This article is for information only and does not replace advice from a qualified lawyer.