Kazakhstan Data Protection Librarysources and working notes
RUEN

Library

All library items. Links lead to primary sources; annotations describe the content and are no substitute for the text itself.

ConstitutionKazakhstan

Constitution of the Republic of Kazakhstan (adopted by national referendum on 15 March 2026)

Республиканский референдум · 15 March 2026

The new Constitution, in force from 1 July 2026 in place of the 1995 Constitution (Art. 94). Article 21 for the first time expressly guarantees protection of personal data against unlawful collection, processing, storage and use, including by digital technologies.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 21, Art. 94
In force from
1 July 2026

● Checked 26 October 2026in forceProcessing principlesScope and key terms

Code255-VIIIKazakhstan

Digital Code of the Republic of Kazakhstan

Парламент Республики Казахстан · 9 January 2026

The new code on the digital environment. Key for data protection: the concept of a "digital object" (Art. 20), now used in the Personal Data Law, and the right to erasure, anonymisation and restriction (Art. 41). In force six months after publication on 10 January 2026.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 20, Art. 41, Art. 106

● Checked 26 October 2026in forceData subject rightsDeletion and anonymisationScope and key terms

Code360-VIKazakhstan

Code of the Republic of Kazakhstan "On Public Health and the Healthcare System"

Парламент Республики Казахстан · 7 July 2020

Personal medical data, the fact of seeking care, health status and diagnosis constitute medical secrecy (Art. 273(1)); Art. 273 lists when they may be disclosed without consent, and Art. 62 covers digital resources with medical data.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 62, Art. 273

● Checked 26 October 2026in forceTypes of personal dataHealthcare

Code350-VIKazakhstan

Administrative Procedural and Process Code of the Republic of Kazakhstan

Парламент Республики Казахстан · 29 June 2020

General procedure for handling applications by state bodies. The regulator handles data subjects' complaints under it: 15 working days, extendable by no more than two months (Art. 76(1), (3)).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 76

● Checked 26 October 2026in forceData subject rights

Code414-VKazakhstan

Labour Code of the Republic of Kazakhstan

Парламент Республики Казахстан · 23 November 2015

The Code says little about employee data: employees have a right to protection of their data (Art. 22), employers must process it under personal data law (Art. 23(2)(24)) and report contracts to the unified system (Art. 23(2)(27)). Only documents listed in Art. 32 may be required on hiring.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 6, Art. 22, Art. 23, Art. 25, Art. 32

● Checked 26 October 2026in forceProcessing without consentEmployment

Code375-VKazakhstan

Entrepreneurial Code of the Republic of Kazakhstan

Парламент Республики Казахстан · 29 October 2015

Procedure for inspecting businesses. Personal data compliance of private businesses is checked only through unscheduled inspections (Art. 27-2 of the Law) on the grounds in Art. 144(5), such as a substantiated complaint or a prosecutor's demand; anonymous complaints do not count.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 143, Art. 144

● Checked 26 October 2026in forceRegulator and state supervision

Code235-VKazakhstan

Code of the Republic of Kazakhstan on Administrative Offences

Парламент Республики Казахстан · 5 July 2014

Article 79 sets administrative fines for personal data violations: unlawful collection or processing, abuse of position, failure to take protection measures, and such failure resulting in loss or unlawful processing. Fines range from 30 to 2,000 MCI.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 79

● Checked 26 October 2026in forceLiability

Code226-VKazakhstan

Criminal Code of the Republic of Kazakhstan

Парламент Республики Казахстан · 3 July 2014

Art. 147: criminal liability for failure to apply protection measures causing substantial harm, for unlawful collection, processing and dissemination of personal data causing substantial harm, and for violating privacy. Penalties range from fines to up to seven years' imprisonment.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 147

● Checked 26 October 2026in forceLiability

Statute94-VKazakhstan

Law of the Republic of Kazakhstan "On Personal Data and Their Protection"

Парламент Республики Казахстан · 21 May 2013

The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 1, Art. 3, Art. 10-1, Art. 12, Art. 16, Art. 25-1, Art. 29

● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures

Statute326-VIIIKazakhstan

Law No. 326-VIII amending legislation on digitalisation, personal data protection, road traffic and transport technologies

Парламент Республики Казахстан · 24 June 2026

The 2026 amending package. Changes to the Personal Data Law are in Art. 1(37): "digital object" in the localisation rule, new Arts 10-1, 23-2 and 25-1, erasure and anonymisation. In force 60 days after publication (computed: 25 August 2026).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 1(37), Art. 2
In force from
25 August 2026

● Checked 26 October 2026in forceBreaches and notificationsDeletion and anonymisationData localisationNotification and register of operators

Statute258-VIIIKazakhstan

Law of the Republic of Kazakhstan "On Banks and Banking Activity in the Republic of Kazakhstan"

Парламент Республики Казахстан · 16 January 2026

The new 2026 law replacing the 1995 Banking Law (in force from 18 March 2026, some provisions later). Banking secrecy and disclosure (Art. 69), biometric authentication for remote accounts and loans (Arts 52, 58), client data in asset transfers (Art. 68).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 52, Art. 58, Art. 68, Art. 69, Art. 75

● Checked 26 October 2026in forceFinancial sector

Statute230-VIIIKazakhstan

Law of the Republic of Kazakhstan "On Artificial Intelligence"

Парламент Республики Казахстан · 17 November 2025

Kazakhstan's first AI law: risk and autonomy levels, prohibited functions (including unlawful processing of personal data and emotion recognition without consent), transparency and training data. Automated decisions are left to personal data law (Art. 21(4)).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 7, Art. 10, Art. 16, Art. 17, Art. 21, Art. 27

● Checked 26 October 2026in forceAutomated processing and AI

Statute40-VIKazakhstan

Law of the Republic of Kazakhstan "On Dactyloscopic and Genomic Registration"

Парламент Республики Казахстан · 30 December 2016

A rare example of an express statutory rule: fingerprint and genomic information is restricted-access personal data (Art. 8(1)).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 8

● Checked 26 October 2026in forceTypes of personal data

Statute11-VIKazakhstan

Law of the Republic of Kazakhstan "On Payments and Payment Systems"

Парламент Республики Казахстан · 26 July 2016

Defines the National Bank infrastructure handling client data: the Identification Data Exchange Centre (biometric authentication) and the anti-fraud centre (data on transactions showing signs of fraud).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 1

● Checked 26 October 2026in forceFinancial sector

Statute418-VKazakhstan

Law of the Republic of Kazakhstan "On Cybersecurity"

Парламент Республики Казахстан · 24 November 2015

The former Informatisation Law. Relevant here: cybersecurity centres must alert the data protection regulator within three hours of a personal data breach (Arts 7-4, 7-5 etc.), subjects are informed via eGov (Art. 7-1), and personal data resources must be protected (Art. 56).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 7-1, Art. 7-4, Art. 7-5, Art. 14, Art. 16, Art. 56

● Checked 26 October 2026in forceBreaches and notificationsSecurity measures

Statute401-VKazakhstan

Law of the Republic of Kazakhstan "On Access to Information"

Парламент Республики Казахстан · 16 November 2015

Defines "restricted-access information": state secrets, personal, family, banking and commercial secrets, medical secrecy and other legally protected secrets, restricted-access personal data and restricted official information (Art. 1(8)).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 1

● Checked 26 October 2026in forceTypes of personal data

Statute56-VKazakhstan

Law of the Republic of Kazakhstan "On Microfinance Activity"

Парламент Республики Казахстан · 26 November 2012

Microcredit secrecy, the microfinance counterpart of banking secrecy: borrower and loan data are disclosed to the borrower, to third parties with written consent and to state bodies as provided by law (Art. 21).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 21

● Checked 26 October 2026in forceFinancial sector

Statute191-IVKazakhstan

Law of the Republic of Kazakhstan on Countering the Legalisation (Laundering) of Criminal Proceeds and the Financing of Terrorism and Proliferation

Парламент Республики Казахстан · 28 August 2009

Customer due diligence (Art. 5), reporting to the financial monitoring authority (Art. 10) and keeping customer files for at least five years after the relationship ends (Art. 11(4)) — statutory grounds for processing client data.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 5, Art. 10, Art. 11

● Checked 26 October 2026in forceFinancial sector

Statute573-IIKazakhstan

Law of the Republic of Kazakhstan "On Credit Bureaus and Formation of Credit Histories in the Republic of Kazakhstan"

Парламент Республики Казахстан · 6 July 2004

Credit histories are built with the borrower's consent; negative information is shared without consent (Art. 25). Data subjects may get their report, dispute entries and set a voluntary self-ban on borrowing free of charge (Art. 22).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 22, Art. 25

● Checked 26 October 2026in forceFinancial sector

Statute567-IIKazakhstan

Law of the Republic of Kazakhstan "On Communications"

Парламент Республики Казахстан · 5 July 2004

Special regime for subscriber service information (numbers, device IDs, billing, location, IP addresses, Art. 23-1): it must be stored in Kazakhstan and may not be transferred abroad except to serve Kazakhstan subscribers roaming abroad (Art. 15(1)(2)).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
Art. 15, Art. 23-1

● Checked 26 October 2026in forceCross-border transfersData localisationTelecommunications

Secondary legislation395/НҚKazakhstan

Rules on the collection and processing of personal data (Order No. 395/NK of 21 October 2020)

Министерство искусственного интеллекта и цифрового развития РК · 21 October 2020

Detailed rules on collection and processing: consent for public dissemination, disclosure and cross-border transfer (para 4-5), a three-working-day deadline to answer data subjects (para 16), irreversible de-identification (paras 20–21), blocking and deletion (para 25).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
paras 4–4-5, para 6-3, para 11, para 16, paras 17–18, paras 20–21, para 25

● Checked 26 October 2026in forceConsentCross-border transfersData subject rightsDeletion and anonymisationDisclosure to third partiesPurpose, scope and retention

Secondary legislation179/НҚKazakhstan

Rules on personal data protection measures for owners, operators and third parties (Order No. 179/NK of 12 June 2023)

Министерство искусственного интеллекта и цифрового развития РК · 12 June 2023

The main secondary act on protection measures, restated in September 2026: notification, operator size categories and tiered measures, restricted-access data (incl. cryptography), local collection and storage in a server room or data centre in Kazakhstan, the responsible person, and breach notification within one working day.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
paras 3–7, paras 8–14, para 15, para 16, para 18, paras 19–20, para 23
In force from
21 September 2026

● Checked 26 October 2026in forceBreaches and notificationsTypes of personal dataData localisationNotification and register of operatorsResponsible person and internal policiesSecurity measures

Secondary legislation283-НҚKazakhstan

Standard on the use of artificial intelligence in secondary education of the Republic of Kazakhstan (Order of the acting Minister of Education No. 283-NK of 28 September 2026)

Министерство просвещения РК · 28 September 2026

A sector act on AI in schools with express rules on pupils' data: school staff, not the system, decide on grades and discipline (para 4); materials are anonymised before being passed to third-party AI services (para 5); no demanding a pupil's full prompt history (para 8).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
paras 4–6, para 8, para 11, paras 14–16

● Checked 26 October 2026in forceAutomated processing and AI

Secondary legislation279-НҚKazakhstan

List of standard documents of state and non-state organisations with retention periods (Order No. 279-NK of 17 June 2025)

Министерство культуры и информации РК · 17 June 2025

Retention periods for standard documents of any organisation. For HR: internal personal data policies — permanently; employment contracts and personnel files — 75 years; documents of rejected applicants — until no longer needed; employees' consent forms — 1 year.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
items 460–467

● Checked 26 October 2026in forcePurpose, scope and retentionEmployment

Secondary legislation481/НҚKazakhstan

Rules on notifying data subjects of personal data breaches (Order No. 481/NK of 9 August 2024)

Министерство искусственного интеллекта и цифрового развития РК · 9 August 2024

How breach notification works: the owner or operator reports to the regulator within one working day (para 4), cybersecurity centres within three hours (para 5); the regulator passes the data to the e-government operator, which notifies data subjects via eGov or SMS (paras 6–7).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
paras 3–7
In force from
12 July 2026

● Checked 26 October 2026in forceBreaches and notifications

Secondary legislationKazakhstan

Inspection checklist on compliance with personal data legislation (joint order, March 2024)

МНЭ РК; МЦРИАП РК · 19 March 2024

The 33-item list used in inspections; handy as a ready-made compliance checklist (consent, purposes, localisation, transfers, DPO, logs, encryption). Wording predates the 2026 amendments.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
items 1–33

● Checked 26 October 2026in forceData localisationRegulator and state supervisionSecurity measures

Secondary legislation199/НҚKazakhstan

Rules on determining the list of personal data necessary and sufficient for the owner's or operator's tasks (Order No. 199/NK of 21 June 2023)

Министерство искусственного интеллекта и цифрового развития РК · 21 June 2023

How to build the inventory of processed data: analyse tasks before processing, state clear and lawful purposes, exclude excessive data (paras 3–4), make the inventory accessible (para 5); a template is annexed. Purpose limitation and minimisation in practice.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
paras 3–5

● Checked 26 October 2026in forceProcessing principlesPurpose, scope and retention

Secondary legislation144/НҚKazakhstan

Rules on the operation of the state access control service for personal data (Order No. 144/NK of 29 April 2022)

Министерство искусственного интеллекта и цифрового развития РК · 29 April 2022

How the state service for consent to access data in state digital objects works: requests answered via the 1414 SMS gateway or e-government, withdrawal, a list of who holds consent, and notifications of actions with the data (para 3).

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
paras 2–4

● Checked 26 October 2026in forceConsentData subject rights

Secondary legislationҚР ДСМ-30Kazakhstan

Rules on the collection, processing, storage, protection and provision of personal medical data by digital health entities (Order of the Minister of Health No. KR DSM-30 of 14 April 2021)

Министерство здравоохранения РК · 14 April 2021

Patient consent, processing only for medical care, automatic notification via e-government of each use of the data, de-identification for research, storage on servers in Kazakhstan, 3 working days to answer a patient's request.

Open:Adiletofficialzakon.uchet.kzalternative source, unofficial

Key provisions
paras 5–7, paras 12–16, para 19, paras 27–29

● Checked 26 October 2026in forceHealthcare

EU law2016/679EU

Regulation (EU) 2016/679 (General Data Protection Regulation)

Европейский парламент и Совет ЕС · 27 April 2016

Used for comparison. The GDPR has no general localisation duty: data move freely within the EU (Art. 1(3)), and exports outside the EEA are governed by Chapter V, with the transfer conditions in Arts 44–49.

Open:EUR-Lexofficial

Key provisions
Art. 1(3), Art. 44–49

● Checked 26 October 2026in forceCross-border transfersKazakhstan and the GDPRData localisation

International instrumentETS 108International

Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) — chart of signatures and ratifications

Совет Европы, Бюро договоров · 28 January 1981

The only binding international treaty on data protection, open to non-member states. As of 18 October 2026 Kazakhstan is not a party, which matters when assessing which countries "ensure protection" for transfers.

Open:coe.int

● Checked 18 October 2026Cross-border transfers

ArticleKazakhstan

Ch. Oralbayev (SOLIS Partners). SaaS and foreign AI models: where to store data under Kazakhstan's personal data law

THE TECH · 15 October 2026

A practical piece on localisation after the 2026 amendments. Distinguishes storage (Art. 12) from transfer (Art. 16) and argues, citing a 6 May 2024 regulator letter, that parallel storage abroad is acceptable if the primary database stays in Kazakhstan.

Open:the-tech.kz

Cross-border transfersData localisation