Localisation requirement — from 1 January 2016

Personal data of Kazakhstani residents must be stored in databases located within the territory of Kazakhstan. This requirement has been in force since 1 January 2016, when amendments to Law No. 94-V introduced mandatory data localisation. The requirement applies to databases containing personal data — whether electronic or paper-based. Any company processing personal data of Kazakhstani residents and operating in Kazakhstan, or using local data processing infrastructure, must comply.

What data is subject to localisation

The localisation requirement applies to personal data — any information relating to an identified or identifiable individual. This includes: employee data (name, contact details, identification numbers, payroll data, biometric data used for access control); customer and user data (contact details, transaction data, identification data); and operational data that identifies individuals. Data that has been irreversibly anonymised is not personal data and is not subject to localisation.

Infrastructure options for compliance

Companies can satisfy the localisation requirement through: (1) dedicated local servers in Kazakhstan — owned or leased data centre capacity in Kazakhstan; (2) local cloud providers — Kazakhstani cloud infrastructure providers whose servers are physically located in Kazakhstan; (3) hybrid arrangements — localised primary database with a non-localised backup (subject to legal analysis of each specific arrangement). Bond Stone advises on structuring data infrastructure to satisfy the localisation requirement while managing cost and operational efficiency.

Cross-border data flows within localisation framework

Localisation does not prohibit all cross-border data transfers — it requires that the primary database containing personal data be located in Kazakhstan. Subsequent transfers of personal data from the localised database to foreign systems may be permissible subject to cross-border transfer compliance requirements (adequate jurisdiction, consent, or contractual safeguards). Bond Stone advises on structuring lawful data flows for multinationals with Kazakhstan data localisation obligations.

Enforcement — unscheduled inspections

The Ministry of Digital Development is authorised to conduct unscheduled inspections of entities to verify localisation compliance. Inspections are initiated based on specific facts — including complaints from data subjects. Entities found non-compliant receive mandatory prescriptions requiring remediation. Bond Stone advises on preparing for inspections and managing compliance with mandatory prescriptions.

Localisation Infrastructure — Manufacturing

Data Localisation · Kazakhstan · Manufacturing

Advising a foreign manufacturer on setting up Kazakhstan-compliant data infrastructure — identifying personal data categories processed, selecting a local cloud provider, and updating data processing agreements with HR software vendors to ensure Kazakhstan-hosted processing.

Hybrid Structure — Multinational

Data Localisation · Kazakhstan · Corporate

Advising a multinational group on a hybrid localisation structure — primary database in Kazakhstan for personal data, with analytics and aggregated non-personal data processed on global infrastructure, and data flows structured to comply with cross-border transfer requirements.

M&A Due Diligence — Localisation Risk

Data Localisation · Kazakhstan · M&A

Reviewing a Kazakhstan target’s localisation compliance as part of M&A legal due diligence — identifying whether employee and customer data is stored on Kazakhstan-located servers and whether any legacy non-compliant arrangements create post-acquisition remediation obligations.

Cloud Provider Selection — Advisory

Data Localisation · Kazakhstan · Technology

Advising a fintech company on selecting a Kazakhstan-compliant cloud provider — reviewing provider’s physical server location, data processing terms, and whether the arrangement satisfies the localisation requirement under Law No. 94-V.

Inspection Defence — Localisation

Data Localisation · Kazakhstan · Regulatory

Advising an entity subject to a Ministry of Digital Development inspection alleging localisation non-compliance — reviewing the factual basis, demonstrating Kazakhstan-hosted data infrastructure, and responding to the mandatory prescription.

HR System Localisation — Pharma

Data Localisation · Kazakhstan · Pharmaceuticals

Advising a pharmaceutical company using a global HR platform on restructuring its Kazakhstan employee data to satisfy localisation — configuring Kazakhstan-hosted data storage within the global HR system and updating data processing agreements with the vendor.