PRACTICE AREA · KAZAKHSTAN
Data Protection in Kazakhstan
Bond Stone advises international investors and multinational corporations on data protection compliance in Kazakhstan — the Law on Personal Data and Its Protection No. 94-V, data localisation requirements, cross-border transfer restrictions, breach notification obligations to the Ministry of Artificial Intelligence and Digital Development, DPO appointment requirements, and sector-specific data protection obligations across financial services, telecommunications, and healthcare. Ranked Legal 500 EMEA and IFLR1000.
Kazakhstan's data protection framework has evolved significantly — the Law on Personal Data No. 94-V has been amended multiple times since 2013, most recently in 2026. A foreign company operating in Kazakhstan that processes employee or customer data should assume the Law applies. Non-compliance exposes businesses to unscheduled regulatory inspections, mandatory prescriptions, and reputational risk.
Primary authority: Law of the Republic of Kazakhstan "On Personal Data and Its Protection" No. 94-V dated 21 May 2013 (as amended, most recently in 2026). Authority: adilet.zan.kz
Data Protection Services
Compliance Audit & Gap Analysis
Reviewing a foreign-invested entity's data processing operations against the current requirements of Law No. 94-V — identifying gaps in localisation compliance, consent mechanisms, data subject rights procedures, breach notification protocols, and DPO appointment. Producing a prioritised remediation roadmap aligned with the Ministry of Artificial Intelligence and Digital Development's inspection focus areas.
Data Localisation Advisory
Advising on the obligation to store personal data in a database located in Kazakhstan — the localisation requirement has been in force since 1 January 2016. Advising on structuring data infrastructure, identifying what categories of data are subject to localisation, and managing cross-border data flows within the localisation framework.
Cross-border Transfer Compliance
Advising on the conditions under which personal data may be transferred outside Kazakhstan — transfer to countries that protect personal data, data subject consent, and the other grounds in Article 16. Advising multinational groups on structuring intercompany data sharing arrangements compliant with Kazakhstan's transfer restrictions.
Breach Notification & Response
Advising on the obligation — effective 1 July 2024 — to notify the Ministry of Artificial Intelligence and Digital Development within one working day of discovering a personal data security breach. Advising on breach response procedures, notification content, and managing regulatory engagement following a breach. The Ministry is authorised to conduct unscheduled inspections following breach notifications.
DPO Appointment & Policies
Advising on the requirement for a legal entity to appoint a person responsible for organising data processing, often called a Data Protection Officer (DPO). Drafting internal data protection policies, consent forms, data processing agreements with third parties, and employee data processing notices aligned with the requirements of Law No. 94-V.
Regulatory Inspection Support
Advising entities subject to unscheduled inspections by the Ministry of Artificial Intelligence and Digital Development — preparing for inspection, managing document requests, responding to mandatory prescriptions, and challenging unlawful inspection actions before the courts or the General Prosecutor's Office.
Kazakhstan Data Protection Framework
Law on Personal Data No. 94-V — scope
Law No. 94-V applies to all organisations processing personal data in Kazakhstan — including public and private entities, and foreign businesses processing data of Kazakhstani residents where they operate within Kazakhstan or use local data processing infrastructure. The Law covers collection, processing, storage, use, transfer, and destruction of personal data. It does not apply to personal data processing for purely personal or family use, archival purposes, or state secrets operations.
Data localisation — from 1 January 2016
Personal data must be stored in a database or digital object located in Kazakhstan (Art. 12(2)). This localisation requirement has been in force since 1 January 2016. Foreign companies operating in Kazakhstan should ensure that the personal data they collect there is stored on Kazakhstan-located servers — whether through local infrastructure, a local cloud provider, or a qualifying data centre in Kazakhstan.
Key 2024 amendments — breach notification and identity documents
Law No. 44-VIII dated 11 December 2023 (in effect from 11 February 2024) introduced: (1) the concept of "personal data security breach"; (2) mandatory notification of the authorised body, now the Ministry of Artificial Intelligence and Digital Development, within one working day of discovering a breach (effective 1 July 2024); (3) prohibition, with exceptions, on collecting and processing paper copies of identity documents (Art. 7(10)); and (4) authorisation for the Ministry to conduct unscheduled compliance inspections. These amendments materially increased the enforcement risk for non-compliant businesses.
2025 and 2026 amendments
Law No. 231-VIII of 17 November 2025 added Article 19-1: automated processing that creates, changes or ends a data subject's rights is prohibited without consent unless a law provides otherwise, and the data subject may object, with a reply due in three working days. Law No. 326-VIII of 24 June 2026 added Article 25-1, which classes owners and operators as small, medium or large by the number of data subjects. Bond Stone advises on the practical effect of these changes.
Data subject rights
Data subjects in Kazakhstan have the right to: access their personal data; request correction of inaccurate data; request deletion of their data under certain conditions; withdraw consent, unless that would contradict the law or an obligation remains unperformed; and request blocking of restricted personal data. Organisations must establish internal procedures for handling data subject requests within the timeframes prescribed by the Law.
Detailed Guides
Experience
Bond Stone advises on data protection as part of market entry, M&A due diligence, and regulatory compliance mandates in Kazakhstan. Client confidentiality is maintained across all matters.
Data Protection · Kazakhstan · Manufacturing
Localisation Audit — Manufacturing
Advising a foreign manufacturer establishing a Kazakhstan subsidiary on data localisation — identifying employee and customer data subject to Law No. 94-V localisation, structuring Kazakhstan-based HR data infrastructure, and drafting employee data processing notices.
Data Protection · Kazakhstan · M&A
M&A Due Diligence — Data Risk
Including data protection compliance as a component of legal due diligence on a Kazakhstan target — reviewing the target's localisation compliance, consent framework, data processing agreements, breach history, and Ministry of Digital Development correspondence.
Data Protection · Kazakhstan · Financial Services
Breach Response — Financial Services
Advising a financial services entity on breach notification — preparing the one-working-day notification to the Ministry of Digital Development, managing the Ministry's follow-up, and implementing remediation measures to reduce inspection risk.
Data Protection · Kazakhstan · Corporate
Cross-border Transfer — Intercompany
Advising a multinational group on structuring intercompany data sharing arrangements for a Kazakhstan subsidiary — identifying transfer restrictions, obtaining required data subject consents, and drafting intragroup data transfer agreements.
Data Protection · Kazakhstan · Market Entry
Market Entry — Data Compliance
Advising a European company entering the Kazakhstan market on data protection requirements as part of the market entry legal package — localisation infrastructure, DPO appointment, privacy policy drafting, and employee data processing framework.
Data Protection · Kazakhstan · Regulatory
Inspection Defence
Advising an entity subject to an unscheduled Ministry of Digital Development inspection — reviewing the inspection grounds, managing document production, responding to the inspector's queries, and challenging a mandatory prescription before the courts.
Why Bond Stone
- Data protection advisory integrated into every market entry and M&A mandate
- Direct engagement with the Ministry of Artificial Intelligence and Digital Development on breach notification and inspections
- Ranked Legal 500 EMEA and IFLR1000 — Almaty and Astana offices
Primary authority: adilet.zan.kz
Related Industry Practice
Digital businesses operating in Kazakhstan must comply with data protection law from the outset. See the FinTech & Digital Assets sector guide.
Frequently Asked Questions — Data Protection in Kazakhstan
What is the primary data protection law in Kazakhstan?
The primary data protection law is the Law on Personal Data and Its Protection No. 94-V dated 21 May 2013 (as amended). It regulates the collection, processing, storage, and cross-border transfer of personal data of Kazakhstani citizens and residents. The Law applies to all data owners and operators — including foreign companies — that process personal data of Kazakhstani individuals, regardless of place of incorporation. Bond Stone advises international businesses on the Law's territorial reach and on building compliant data processing and governance programmes.
Does Kazakhstan require personal data to be stored on servers located in Kazakhstan?
Yes. The data localisation requirement has been in force since 1 January 2016. Personal data must be stored in a database or digital object located in Kazakhstan (Art. 12(2)); further transfer abroad may be permitted under Article 16. Non-compliance is an administrative offence enforced by the Ministry of Artificial Intelligence and Digital Development — including through unscheduled inspections and access restrictions on non-compliant services. Bond Stone advises on localisation architecture, compliant vendor selection, and cross-border data flow permissibility analysis.
What are Kazakhstan's personal data breach notification requirements?
Under amendments effective 1 July 2024, data owners and operators must notify the Ministry of Artificial Intelligence and Digital Development of a personal data breach within one working day of discovery (Law No. 94-V, Art. 25(2)(8)). The Law requires the notice to give the contact details of the person responsible for organising data processing, if there is one; a good notice also covers the nature of the breach, the data subjects affected, likely consequences, and measures taken or proposed. Breaches of the Law can lead to liability under Article 79 of the Code on Administrative Offences. Bond Stone advises on breach response protocols, notification drafting, and regulatory liaison with the Ministry.
Is a Data Protection Officer (DPO) required under Kazakhstani law?
Yes. The Law on Personal Data No. 94-V requires data owners and operators that are legal entities to appoint a responsible person for organising personal data processing — equivalent in function to a Data Protection Officer under GDPR-aligned frameworks. This person carries out internal control, informs staff of the rules and oversees data subject requests (Art. 25(3)). Bond Stone advises on structuring the DPO/responsible person role to align with Kazakhstani requirements and group-level data governance frameworks — including GDPR or UK GDPR where multinational groups operate across multiple data protection regimes.
Can personal data be transferred from Kazakhstan to other countries?
Cross-border transfer is permitted to countries that protect personal data (Art. 16(2)). For other countries, it needs the data subject's consent, a ratified treaty, a law protecting listed public interests, or protection of constitutional rights where consent cannot be obtained (Art. 16(3)). A contract alone is not one of these grounds. Bond Stone advises on cross-border transfer compliance, data transfer agreement drafting, and the interaction between Kazakhstani requirements and EU GDPR transfer mechanisms for multinational structures.
Discuss your data protection matter
Contact Bond Stone for a confidential discussion about data protection compliance in Kazakhstan.
[email protected]
+7 (701) 729 76 72 — Almaty
Request a Confidential Consultation Data Localisation → Cross-border Transfers → Compliance & Breach Response →