Privacy Map

Kazakhstan. Comprehensive data protection. Law

PD LawLaw of the Republic of Kazakhstan No. 94-V 'On Personal Data and Their Protection'

In force
Partly verifiedMedium confidence. In-force date (2013-11-25) from general knowledge; adilet page needed JS. Regulator renamed with ministry restructuring in 2025.

§1Summary

Synopsis

Kazakhstan's core personal data law governing consent-based collection and processing, data subject rights and security duties of owners and operators. It requires personal data of Kazakh data subjects to be stored in databases in Kazakhstan and controls onward cross-border transfers.

Key themes
  • consent
  • localisation
  • cross-border transfers
  • breach notification
  • responsible person
  • automated decisions
  • registers
Unique features

Strict localisation of databases plus one-working-day breach reporting; 2026 amendments ban solely automated decisions and state that self-publication is not consent to further processing.

SaaS relevance

Foreign SaaS collecting Kazakh users' data must keep a primary database in Kazakhstan (cross-border copies allowed under art 16) and appoint a responsible person.

§2Obligations

Extraterritorial
Limited
Breach notification
Authority within 1 working day; data subject notified via e-gov channels
DPO
Yes
Cross-border transfers
Localisation of databases in Kazakhstan (art 12(2)); transfer to adequate states or on consent/treaty/statutory grounds (art 16); no official adequacy list
Maximum penalty
Administrative up to 2,000 MCI (~KZT 8.65m in 2026) for large business; criminal (Criminal Code art 147) up to 3,000 MCI or 2 years' restriction/deprivation of liberty

§3Dates

Key dates
  • Adopted
  • In force
  • Localisation (art 12(2)) since 2016; 2026 amendments: identifier-based definition of personal data from 2026-07-11; new definitions (anonymisation, masking, hashing, breach) and public-source data rules plus state breach register from 2026-08-25; small/medium/large controller classes, with only large ones notifying start/end of processing.

§4Text and authority

Text
Authority
Ministry of Artificial Intelligence and Digital Development (Committee for Information Security)

§5Where it applies

Domestic law of
Kazakhstan

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. In-force date (2013-11-25) from general knowledge; adilet page needed JS. Regulator renamed with ministry restructuring in 2025.