Publicly available and restricted-access data; biometrics; data requiring special treatment.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
These are data to which access is restricted by law — for example, medical information (medical confidentiality), fingerprint and genomic information, and information covered by banking secrecy. Stricter rules apply — confidentiality, extra protection measures (encryption, access logs), processing only through systems in Kazakhstan — and the operator moves up a category.
Publicly available data are data not subject to confidentiality and freely accessible with the person's consent; as a rule, data may be published only with consent. Identifiers are what makes a person identifiable — full name taken together, the IIN, an image of the face and a facial biometric vector. Information becomes personal data when it is linked to such an identifier.
There is no single list — it has to be assembled from sector laws: the Health Code (medical confidentiality), the Law on Fingerprint and Genomic Registration, the Banking Law (banking secrecy) and the Law on Access to Information. Links to these acts are collected in the library.
There is no direct equivalent. In the EU, special categories are defined by content (health, religion, political opinions and so on); in Kazakhstan, by whether some law restricts access to the information. So political opinions or religion, for example, are not restricted-access data as such.
Note
Kazakhstan law splits data not into "ordinary" and "special" as the GDPR does, but into publicly available and restricted-access. There is no list of restricted-access data: it has to be assembled from other laws on medical secrecy, fingerprint and genomic registration and access to information. The answer drives security measures, place of processing and the operator's category.
Note
How the Law distinguishes disclosure to specific persons from publication in public sources, when consent is needed, what the rules on self-published data and the ban on "non-purposive extraction" change, and why Kazakhstan law has no familiar "processor" figure.
Note
The foundations of Kazakhstan personal data law after 2026: the new Constitution, a narrow definition of personal data built on a closed list of identifiers, the roles of owner, operator and third party, the exclusions from the Law, and the unresolved question of whether the Law reaches foreign services.
Note
What the Labour Code says about personal data: a closed list of documents on hiring, a ban on asking for more, the unified system for recording employment contracts. When an employer needs consent and when the law suffices, how to handle applicants' data, how long to keep HR records and why identity documents should not be photocopied.
Note
How personal data law interacts with banking secrecy, microcredit secrecy, credit history rules and AML/CFT in banks, microfinance organisations and credit bureaus. The new 2026 Banking Law, biometric authentication through the National Bank and retention of customer files.
Note
The special regime for personal medical data under the Health Code: medical confidentiality and when it may be lifted, the electronic health passport, who may access patient data and when, and Ministry of Health rules on consent, patient notification and storage in Kazakhstan.
Note
What security measures the Law requires and how, from September 2026, they depend on the operator's category (small, medium or large by number of data subjects), plus separate rules for restricted-access data. Compared with the GDPR's risk-based approach.
Personal medical data, the fact of seeking care, health status and diagnosis constitute medical secrecy (Art. 273(1)); Art. 273 lists when they may be disclosed without consent, and Art. 62 covers digital resources with medical data.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceTypes of personal dataHealthcare
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
A rare example of an express statutory rule: fingerprint and genomic information is restricted-access personal data (Art. 8(1)).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
Defines "restricted-access information": state secrets, personal, family, banking and commercial secrets, medical secrecy and other legally protected secrets, restricted-access personal data and restricted official information (Art. 1(8)).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
The main secondary act on protection measures, restated in September 2026: notification, operator size categories and tiered measures, restricted-access data (incl. cryptography), local collection and storage in a server room or data centre in Kazakhstan, the responsible person, and breach notification within one working day.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsTypes of personal dataData localisationNotification and register of operatorsResponsible person and internal policiesSecurity measures