The requirement to store personal data in Kazakhstan and related technical requirements.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
The law requires personal data to be stored in a database or digital system on Kazakhstan's territory — this applies to all personal data and all companies. The law does not say "only", so whether a parallel copy may be kept abroad is debatable. According to a law firm's account, the regulator accepted this in 2024 if the main, up-to-date database is in Kazakhstan, but the text of that guidance has not been published.
Data must be stored on servers in Kazakhstan — in a server room or data centre. If a service keeps data only abroad, the requirement is not met; a Kazakhstan database or the provider's Kazakhstan site is needed. Sending data to a foreign service is additionally assessed as a cross-border transfer.
The law gives no direct answer. The requirement applies to companies operating in Kazakhstan. Whether it covers a foreign online service with no presence in the country is an open question.
There is no separate offence. A breach would probably be classified under the general personal data article — as unlawful processing or failure to apply protection measures: fines from 30 to 600 MCI, and up to 2,000 MCI if data were lost or unlawfully processed.
Note
When personal data may be sent abroad: Article 16 of the Law, how it interacts with the consent requirement in Article 7, sector-specific bans, and why the absence of a list of "safe" countries leaves much unclear.
Note
A summary table of 20 issues showing where Kazakhstan's personal data rules resemble the GDPR and where they differ fundamentally — legal grounds, localisation, cross-border transfers, deadlines, the responsible person, fines. Plus a list of what a GDPR-compliant company must additionally do for Kazakhstan.
Note
The special regime for personal medical data under the Health Code: medical confidentiality and when it may be lifted, the electronic health passport, who may access patient data and when, and Ministry of Health rules on consent, patient notification and storage in Kazakhstan.
Note
The Communications Law's special regime for subscriber data: what counts as service information (numbers, IMEI, IIN, billing, location, IP addresses), the absolute ban on transferring it abroad, access by state bodies, secrecy of communications and device registration. The 2026 amendments and a pilot project running to the end of 2027.
Note
A working note on Kazakhstan's in-country storage rule: Article 12 of the Personal Data Law as amended in 2026, the implementing rules, the contrast with the GDPR, and the questions that remain open.
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
The 2026 amending package. Changes to the Personal Data Law are in Art. 1(37): "digital object" in the localisation rule, new Arts 10-1, 23-2 and 25-1, erasure and anonymisation. In force 60 days after publication (computed: 25 August 2026).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsDeletion and anonymisationData localisationNotification and register of operators
Special regime for subscriber service information (numbers, device IDs, billing, location, IP addresses, Art. 23-1): it must be stored in Kazakhstan and may not be transferred abroad except to serve Kazakhstan subscribers roaming abroad (Art. 15(1)(2)).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceCross-border transfersData localisationTelecommunications
The main secondary act on protection measures, restated in September 2026: notification, operator size categories and tiered measures, restricted-access data (incl. cryptography), local collection and storage in a server room or data centre in Kazakhstan, the responsible person, and breach notification within one working day.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsTypes of personal dataData localisationNotification and register of operatorsResponsible person and internal policiesSecurity measures
The 33-item list used in inspections; handy as a ready-made compliance checklist (consent, purposes, localisation, transfers, DPO, logs, encryption). Wording predates the 2026 amendments.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceData localisationRegulator and state supervisionSecurity measures
Used for comparison. The GDPR has no general localisation duty: data move freely within the EU (Art. 1(3)), and exports outside the EEA are governed by Chapter V, with the transfer conditions in Arts 44–49.
Open:EUR-Lex (opens in a new tab)official
● Checked 26 October 2026in forceCross-border transfersKazakhstan and the GDPRData localisation
A practical piece on localisation after the 2026 amendments. Distinguishes storage (Art. 12) from transfer (Art. 16) and argues, citing a 6 May 2024 regulator letter, that parallel storage abroad is acceptable if the primary database stays in Kazakhstan.