DATA PROTECTION \u00a0\u00b7\u00a0 KAZAKHSTAN<\/p>\n
Bond Stone advises on data protection compliance programme implementation in Kazakhstan \u2014 DPO appointment, internal data protection policies, breach detection and notification to the Ministry of Digital Development, defence against unscheduled inspections, and responding to mandatory prescriptions under Law No. 94-V.<\/p>\n
Primary authority: Law of the Republic of Kazakhstan “On Personal Data and Its Protection” No. 94-V dated 21 May 2013 (as amended by Law No. 231-VIII dated 17 November 2025). Verify at adilet.zan.kz<\/a><\/p>\n DPO appointment requirement<\/p>\n Organisations processing personal data in Kazakhstan are required to appoint a Data Protection Officer (DPO) responsible for overseeing compliance with the Law No. 94-V requirements. The DPO is responsible for: ensuring compliance with data processing requirements; handling data subject rights requests; managing consent mechanisms; overseeing breach detection and notification; and liaising with the Ministry of Digital Development. Bond Stone advises on DPO appointment, role definition, and the minimum competency requirements for the DPO function.<\/p>\n<\/div>\n Breach notification \u2014 one working day<\/p>\n Effective 1 July 2024, organisations must notify the Ministry of Digital Development, Innovation, and Aerospace Industry of Kazakhstan within one working day of discovering a personal data security breach. The notification must contain: identification of the organisation; description of the breach; categories and approximate number of data subjects affected; likely consequences; and measures taken or proposed. Bond Stone advises on establishing breach detection processes and notification procedures to meet the one-working-day deadline.<\/p>\n<\/div>\n Physical identity document prohibition<\/p>\n Law No. 44-VIII ZRK (effective 11 February 2024) prohibited collecting and processing physical copies of identity documents (passports, ID cards, driving licences). Organisations that previously collected physical document copies \u2014 including in HR onboarding, KYC processes, and customer registration \u2014 must update their data collection procedures. Bond Stone advises on transitioning document collection and verification processes to compliant alternatives.<\/p>\n<\/div>\n Unscheduled inspections \u2014 defence<\/p>\n The Ministry of Digital Development is authorised to conduct unscheduled inspections of entities based on specific facts and circumstances \u2014 including data subject complaints, breach reports, and media reports. Inspections are registered with the General Prosecutor’s Office Legal Statistics Committee. Bond Stone advises entities subject to inspection on: preparing documentation demonstrating compliance; managing document production during inspection; responding to inspector queries; and challenging unlawful inspection actions.<\/p>\n<\/div>\n Internal compliance programme<\/p>\n A complete data protection compliance programme under Law No. 94-V includes: (1) data mapping \u2014 identifying all personal data processing activities; (2) lawful basis analysis \u2014 consent, contract, legal obligation; (3) privacy notices \u2014 employee and customer data processing notices; (4) consent management \u2014 collection, recording, and withdrawal mechanisms; (5) data processing agreements with third-party processors; (6) data subject rights procedures; (7) breach response plan; and (8) DPO function and governance. Bond Stone advises on building and implementing compliance programmes for foreign-invested entities.<\/p>\n<\/div>\n<\/div>\n DPO Implementation \u2014 Manufacturing<\/p>\n Compliance \u00b7 Kazakhstan \u00b7 Manufacturing<\/p>\n Advising a foreign manufacturer’s Kazakhstan subsidiary on implementing the DPO function \u2014 defining the DPO role, selecting and appointing the DPO, drafting the DPO mandate, and establishing the reporting line to senior management.<\/p>\n<\/div>\n Breach Response \u2014 E-commerce<\/p>\n Compliance \u00b7 Kazakhstan \u00b7 Technology<\/p>\n Advising an e-commerce platform on a personal data breach \u2014 initial breach assessment, Ministry of Digital Development notification within one working day, managing Ministry follow-up, notifying affected data subjects, and implementing remediation measures.<\/p>\n<\/div>\n Identity Document Process \u2014 HR<\/p>\n Compliance \u00b7 Kazakhstan \u00b7 Corporate<\/p>\n Advising a company on updating its HR onboarding process following the prohibition on physical identity document copies \u2014 transitioning to digital verification systems, updating employment contracts and data collection forms, and retraining HR staff.<\/p>\n<\/div>\n Compliance Audit \u2014 Energy Sector<\/p>\n Compliance \u00b7 Kazakhstan \u00b7 Energy<\/p>\n Conducting a data protection compliance audit for an energy sector entity \u2014 reviewing data processing activities against Law No. 94-V requirements, identifying gaps in localisation, consent, breach notification, and DPO function, and producing a remediation roadmap.<\/p>\n<\/div>\n Data Processing Agreements<\/p>\n Compliance \u00b7 Kazakhstan \u00b7 Corporate<\/p>\n Drafting data processing agreements between a Kazakhstan entity and its foreign IT service providers \u2014 processor obligations, sub-processing restrictions, breach notification requirements, and termination provisions aligned with Law No. 94-V.<\/p>\n<\/div>\n Privacy Policy \u2014 Market Entry<\/p>\n Compliance \u00b7 Kazakhstan \u00b7 Technology<\/p>\n Drafting a Kazakhstan-compliant privacy policy and cookie notice for a digital platform entering the Kazakhstan market \u2014 covering data categories, processing purposes, localisation, cross-border transfers, data subject rights, and DPO contact details.<\/p>\n<\/div>\n<\/div>\n Why Bond Stone<\/p>\n \u2726 \u00a0Data protection integrated into every market entry and M&A mandate<\/p>\n \u2726 \u00a0Ranked Legal 500 EMEA and IFLR1000 \u2014 Almaty and Astana offices<\/p>\n<\/div>\n Primary authority: adilet.zan.kz<\/a><\/p>\n Contact Bond Stone for a confidential discussion about Data Protection Compliance in Kazakhstan.<\/p>\n \ud83d\udce7 info@bondstonelaw.com<\/a> Request a Confidential Consultation<\/a> DATA PROTECTION \u00a0\u00b7\u00a0 KAZAKHSTAN Data Protection Compliance in Kazakhstan Bond Stone advises on data protection compliance programme implementation in Kazakhstan \u2014 DPO appointment, internal data protection policies, breach detection and notification to the Ministry of Digital Development, defence against unscheduled inspections, and responding to mandatory prescriptions under Law No. 94-V. Primary authority: Law of the […]<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-4843","page","type-page","status-publish","hentry"],"translation":{"provider":"WPGlobus","version":"3.0.3","language":"ru","enabled_languages":["en","ru"],"languages":{"en":{"title":true,"content":true,"excerpt":false},"ru":{"title":false,"content":false,"excerpt":false}}},"_links":{"self":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages\/4843","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/comments?post=4843"}],"version-history":[{"count":3,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages\/4843\/revisions"}],"predecessor-version":[{"id":4889,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages\/4843\/revisions\/4889"}],"wp:attachment":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/media?parent=4843"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nKey Framework<\/h2>\n
\nExperience<\/h2>\n
\nDiscuss your data protection matter<\/h2>\n
\n\ud83d\udcde +7 (701) 729 76 72<\/a><\/p>\n
\n\u2190 Cross-border Transfers<\/a>
\n\u2190 Data Protection Hub<\/a>
\n\u2190 Data Protection Hub<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"