Cross-border transfer framework

Law No. 94-V permits cross-border transfers of personal data — provided the receiving country ensures adequate protection of personal data rights. Kazakhstan does not maintain a published list of adequate countries, which means that businesses must conduct their own adequacy assessment for the receiving jurisdiction before transferring personal data. Where the receiving country is not considered adequate, transfer is still permissible with the data subject’s explicit consent or where required by law or international treaty.

Adequate jurisdiction transfers

Personal data may be transferred to jurisdictions that ensure adequate protection of personal data. In practice, most EU member states, the UK, and jurisdictions with GDPR-equivalent regimes are considered adequate. However, since Kazakhstan does not publish an official adequacy list, Bond Stone advises on conducting jurisdiction-specific adequacy assessments before establishing cross-border data flows to non-obvious jurisdictions.

Non-adequate jurisdiction transfers — consent requirement

Where the receiving jurisdiction does not ensure adequate personal data protection, transfer requires the explicit, informed consent of the data subject. Consent must be specific, voluntary, and withdrawable at any time. Bond Stone advises on designing consent mechanisms for cross-border transfer scenarios — including employee data transfers to non-adequate group company locations and customer data transfers for international service delivery.

Intercompany data sharing arrangements

Multinational groups operating in Kazakhstan frequently transfer personal data between group entities across jurisdictions — for HR platform consolidation, shared services, ERP systems, and data analytics. Bond Stone advises on structuring intragroup data sharing agreements (data processing agreements and controller-to-controller transfer agreements) compliant with Kazakhstan’s cross-border transfer requirements, alongside any localisation obligations.

Interaction with localisation requirement

Cross-border transfer compliance is a separate requirement from data localisation — both must be satisfied simultaneously. The primary personal data database must be localised in Kazakhstan; subsequent cross-border transfers from the localised database are subject to the transfer requirements above. Bond Stone advises on managing both localisation and transfer compliance within the same data architecture.

EU-Kazakhstan Data Flow — Multinational

Cross-border Transfer · Kazakhstan · Corporate

Advising a European multinational on structuring EU-Kazakhstan data flows for its HR platform — adequacy analysis for EU → KZ and KZ → EU transfers, consent mechanisms for KZ employee data transferred to EU-hosted HR systems, and intragroup data transfer agreement.

Non-adequate Jurisdiction — Consent Design

Cross-border Transfer · Kazakhstan · Technology

Advising a technology company on transferring Kazakhstan customer data to servers in a non-adequate jurisdiction — designing explicit consent mechanisms for transfer, consent capture at point of data collection, and withdrawal procedures.

Intragroup Agreement — Global Group

Cross-border Transfer · Kazakhstan · Corporate

Drafting an intragroup data transfer agreement for a multinational group’s Kazakhstan subsidiary — covering cross-border HR data transfers to a shared services centre in a non-EU jurisdiction, with Kazakhstan-law-compliant consent and security annexes.

M&A — Cross-border Transfer Risk

Cross-border Transfer · Kazakhstan · M&A

Identifying cross-border transfer risks in M&A due diligence — reviewing the target’s international data flows, assessing whether transfers to foreign group entities were structured lawfully, and quantifying remediation cost.

Cloud Services — Transfer Analysis

Cross-border Transfer · Kazakhstan · Technology

Advising on the cross-border transfer implications of using a US-hosted cloud service for processing Kazakhstan personal data — adequacy analysis, supplementary safeguards, and consent requirements for Kazakhstani data subjects.

EAEU Data Flows

Cross-border Transfer · Kazakhstan · EAEU

Advising on data flows between Kazakhstan and other EAEU member states — Russia, Belarus, Kyrgyzstan, Armenia — in the context of EAEU data protection alignment and Kazakhstan’s domestic transfer requirements.