Cross-border transfers of personal data

In short

A cross-border transfer is the transfer of personal data to the territory of foreign states (Art. 16(1)). The Law splits countries into two groups. Data may be transferred to countries that “ensure the protection of personal data” (Art. 16(2)). Transfers to other countries require one of the listed grounds, above all the data subject’s consent (Art. 16(3)). Separately, the Law states that cross-border transfer, “except in the cases provided for by Article 16”, takes place subject to the data subject’s consent (Art. 7(6)).

No official list of countries that ensure protection could be found in the Law or in secondary legislation. In practice, consent therefore remains the main ground.

What the Law says

Article 16 is structured as follows:

1. Definition — transfer to the territory of foreign states (Art. 16(1)).
2. Countries that ensure protection — transfers are permitted (Art. 16(2)).
3. Other countries — transfers are possible with the consent of the data subject or their legal representative; in cases provided for by ratified international treaties; in cases provided for by laws where necessary to protect the constitutional order, public order, rights and freedoms, health and morals; or to protect constitutional rights and freedoms where consent cannot be obtained (Art. 16(3)).
4. Bans and restrictions may be set by laws (Art. 16(4)).
5. Subscriber service information in telecommunications is governed by the Communications Law (Art. 16(5)).

The consent rules work alongside this. The consent must state whether cross-border transfer takes place (Art. 8(4)(5)). The data subject may withdraw consent, including consent to cross-border transfer (Art. 24(1)(5)). The Collection and Processing Rules repeat Article 7(6) word for word (para 4-5). From 25 August 2026, information on cross-border transfers is also part of the notification to the regulator before processing starts (Art. 10-1(3)(5)).

Interpretation. Article 7(6) can be read in two ways. First reading: consent is needed for any cross-border transfer, except the cases in Article 16(3)(2)–(4), where the Law itself provides a ground without consent. Second reading: a transfer to a country that ensures protection (Article 16(2)) is also “a case provided for by Article 16”, so no consent is needed. The second reading fits the two-group logic better; the first is more cautious. As long as there is no list of countries, the difference is largely theoretical.

No list of “safe” countries

The Law does not say who determines the countries that ensure protection or by what criteria. Approving such a list is not among the regulator’s powers (Art. 27-1).

A common external benchmark is participation in Council of Europe Convention 108. Kazakhstan itself is not a party: as of 18 October 2026 it does not appear in the chart of ratifications. So the Convention cannot serve as a standard shared with the recipient country either.

Interpretation. Without a list, the company decides on its own whether the recipient country “ensures protection” and bears the risk of getting it wrong. Hence the widespread practice of always obtaining consent to cross-border transfer, even where the company believes the country does ensure protection.

Sector-specific bans

An example of a restriction under Article 16(4) is subscriber service information in telecommunications. Telecom operators store it in Kazakhstan; transferring it abroad is prohibited, except when providing services to Kazakhstan subscribers who are abroad (Communications Law, Art. 15). From 25 August 2026 the law lists what this information is: phone numbers, device identifiers, the subscriber’s IIN or BIN, billing data, device location, network addresses and more (Art. 23-1).

There is also a technical rule for restricted-access data: storage and transmission require cryptographic tools of at least security level 3 under ST RK 1073-2007, but this does not apply to cross-border transfers under Article 16 (Protection Rules, para 15(9)).

Link with localisation

A transfer abroad does not lift the requirement to store data in Kazakhstan (Art. 12(2)). These are two parallel regimes: data must be stored in a database or digital object in Kazakhstan, and sending them abroad is assessed separately under Article 16. See the note “Personal data localisation in Kazakhstan”.

Comparison with the GDPR

Question	Kazakhstan	GDPR
What counts as a transfer	Transfer to the territory of foreign states (Art. 16(1))	Disclosure to an importer in a third country; criteria in Guidelines 05/2021
Countries with adequate protection	The concept exists; no list or procedure	Commission adequacy decisions (Art. 45)
Contractual mechanisms	None	Standard contractual clauses, binding corporate rules (Arts 46–47)
Consent	The main practical tool	Only a derogation for specific situations; must be explicit (Art. 49)
In-country storage	Mandatory (Art. 12)	Not required

Interpretation. Under the GDPR consent is a fallback, and the basis is an assessment of protection plus contractual safeguards. In Kazakhstan it is the other way round: with no list of countries and no contractual mechanisms, consent becomes the main ground. For a company used to SCCs, this means extra work on consent wording.

Open questions

Open question: who decides which countries ensure protection? Neither the Law nor secondary legislation names an authority or criteria. No official regulator guidance on this has been found so far.

Open question: remote access. If data are stored in Kazakhstan and an employee or contractor views them from abroad, is that a “transfer to the territory of a foreign state”? The definition in Article 16(1) does not answer this.

Open question: cloud and AI services. Sending a query containing personal data to a foreign API looks like a cross-border transfer even if the main database is in Kazakhstan. Practitioners take this view too (for example, the SOLIS Partners article), but there is no official guidance.

Open question: withdrawal of consent. The data subject may withdraw consent to cross-border transfer (Art. 24(1)(5)). The Law does not say what happens to data already transferred abroad.

Still to research

• Regulator guidance on countries that ensure protection and on the form of consent to cross-border transfer.
• Kazakhstan’s international treaties providing for transfers of personal data (Art. 16(3)(2)), for example within the EAEU and the CIS.
• Sector-specific restrictions: banking secrecy, medical data.
• Inspection and enforcement practice on cross-border transfers without consent.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.