Compare countries

Two or three countries, side by side, one row per question. Pick up to 3.

Countries

KazakhstanChecked 18 August 2026

A copy must stayWork: HighEnforcement: Active

In one paragraph: Kazakhstan says a copy of personal data must live inside the country. The law is blunt: personal data has to be kept in a database located on Kazakh territory. You may still send data abroad, but only if the receiving country protects it as well as Kazakh law does, or if the person has agreed. Some industries go further and allow no copy abroad at all.
The catch: The 'keep a copy here, send a copy out' rule is the general position. It is not the whole picture. Telecoms operators must keep their subscriber and connection records in Kazakhstan. Gambling operators must run their servers in Kazakhstan. Any website using a .KZ or .ҚАЗ address must be hosted on equipment in Kazakhstan. And firms registered inside the Astana International Financial Centre live under a completely different, European-style rulebook with its own regulator and no local storage duty at all.
Does this apply to me?: Almost certainly yes, but the law is vague about it. Kazakhstan's personal data law does not contain a clear sentence saying it applies to companies with no office in the country, and it sets no size or revenue threshold. What it does say is that whoever owns or operates the data must store it in a database inside Kazakhstan, which in practice pulls foreign services that handle Kazakh customers into scope. We found no requirement to appoint a local representative.Medium confidence
Can the data leave the country?: Yes, a copy can leave, but the original has to stay. Kazakh law requires personal data to sit in a database on Kazakh soil, and separately allows sending it abroad when the destination country protects it to the same standard, or when the person has clearly agreed. That is the general rule. Four areas are stricter and in those the data, or the machine holding it, simply cannot leave.High confidence
What do I have to do to send it abroad?: Before data goes abroad you need one of two things: proof that the destination country protects personal data to the Kazakh standard, or the clear agreement of the person concerned. There is no government form to file and no permit to obtain. The catch is that Kazakhstan has not published a list of approved countries, so the judgement is yours to make and yours to defend.Medium confidence
Who enforces this — and are they actually working?: The Ministry of Artificial Intelligence and Digital Development is the authority, working through its Information Security Committee. It is real, staffed and busy: it runs inspections, brings administrative cases and hands files to the police. The fines are small by international standards, in the low tens of thousands of dollars at most. Firms inside the Astana International Financial Centre answer instead to that centre's own Commissioner of Data Protection.Medium confidence
How long must I keep it, and when must I delete it?: There is a floor and a ceiling, and they are set in different places. The clearest floor is in payments: a payment service provider must keep the information identifying who sent money and who received it for five years. The ceiling comes from the privacy law, which says data may be kept only until the purpose it was collected for has been achieved. Since July 2026 people can also ask for their data to be deleted or anonymised.Medium confidence
What happens when something goes wrong?: There are at least two clocks and neither is stated in hours. Under the national privacy law you must tell the authority as soon as you detect a breach of personal data security, and give it the contact details of the person in your organisation who is responsible for data processing. Inside the Astana International Financial Centre the duty is to tell the Commissioner as soon as practicable, and to tell affected people too when the risk to them is high.Medium confidence
What's the trap?: Five things that are not in the summary. Your website is caught: a .KZ or .ҚАЗ address must be hosted on machines inside Kazakhstan, whatever the site is for. Telecoms operators must keep subscriber records locally and pay for the interception equipment themselves. Gambling servers must sit at the operator's own premises in Kazakhstan. The financial centre in Astana is a legal island with its own regulator and no local storage duty. And the official English translations of Kazakh laws lag behind the Russian originals, so a fine you read as small may already have been multiplied.Medium confidence
What's about to change?: The big change has already landed. Kazakhstan's Digital Code was signed on 9 January 2026 and took effect on 12 July 2026, and the government says a law on artificial intelligence and a law on digital assets were adopted alongside it. The Digital Code gives people the right to have their data deleted, made anonymous or held back from processing, limits the use of face and fingerprint data, and lets people challenge decisions taken by automated systems. The next twelve months will be about the detailed rules underneath it.Medium confidence
Hardest industry wall: All industries — Заң «Дербес деректер және оларды қорғау туралы» / Закон «О персональных данных и их защите»
All industries — Цифровой кодекс Республики Казахстан / Цифрлық кодекс
All industries — Единые требования в области информационно-коммуникационных технологий и обеспечения информационной безопасности
Telecoms — Закон Республики Казахстан «О связи»
Online gaming — Закон Республики Казахстан «Об игорном бизнесе»

AlgeriaChecked 18 August 2026

Yes, with paperworkWork: HighEnforcement: Waking up

In one paragraph: Data can leave Algeria, but not freely. Every transfer abroad needs the national data protection authority's permission unless a listed exception applies, and breaking that rule is a crime carrying prison. Since July 2025 every organisation must have a data protection officer, a processing register and an automatic log of every operation. The regulator is staffed but has issued no known decisions.
The catch: The national rule is already strict, and three areas are stricter still. Online shops must run their site on servers inside Algeria under a .com.dz address. Electronic trust services, such as digital signatures and electronic identity, must host all the data they collect inside Algeria. Public bodies must exchange data only over a state-run network that is deliberately kept separate from the internet. Banking, insurance and securities have no storage rule that we could find, but the central bank's own website could not be reached, so treat that as unchecked rather than settled.
Does this apply to me?: Yes, it can reach a company with no office in Algeria, but the trigger is equipment, not customers. You are covered if you are set up in Algeria, or if you use any means of processing located in Algeria, such as servers or devices. In that second case you must tell the regulator the name of a representative based in Algeria, and that person takes on your rights and duties. There is no size or revenue threshold to fall below.High confidence
Can the data leave the country?: Yes, with permission or a listed excuse. The starting rule is that you may only send personal data to another country if the national data protection authority allows it and that country protects privacy well enough. There is a short list of exceptions that most businesses will rely on instead, such as the person's express consent or a transfer that is needed to carry out their contract. Two things are banned outright: transfers that could harm public safety or the state's vital interests, and any processing of sensitive data such as health, religion, politics or trade union membership unless a narrow exception applies.High confidence
What do I have to do to send it abroad?: The model is case by case. Before data goes abroad you need the national data protection authority to authorise it, and the destination country must protect privacy well enough in the authority's judgement. There is no published list of approved countries and no official standard contract you can sign instead. In practice most companies rely on the written exceptions: the person's express consent, a transfer needed for their contract, a court claim, saving someone's life, an important public interest, an international mutual legal assistance request, medical care, or a treaty Algeria has signed.High confidence
Who enforces this — and are they actually working?: The national data protection authority, and it does exist in real life. Fifteen members, including a president, were appointed by presidential decree on 18 May 2022 for five years, a new president was appointed in October 2023, and the authority has its own staff, pay scales, an executive secretariat, an official bulletin and internal committees. Its president was still signing published decisions in August 2025. What is missing is enforcement: in four years the official gazette shows only housekeeping texts from the authority, and no fine, order or filing procedure. Treat it as awake but not yet biting.High confidence
How long must I keep it, and when must I delete it?: There is a floor and a ceiling, and the floor is the one people miss. Accounting books and the paperwork behind them must be kept for ten years after the end of each financial year. Telephone and internet providers must keep the data that identifies users and their connections for one year. Online sellers must keep records of every transaction and send them to the national trade register centre. The ceiling is that personal data must not be kept in a form that identifies people for longer than the purpose needs, and keeping it too long is a crime.High confidence
What happens when something goes wrong?: There is no seventy-two hour clock here, and the five-day deadline people quote is not for ordinary businesses. If you provide a service over a public electronic communications network and data is destroyed, lost, altered, disclosed or accessed without permission, you must warn the authority and the affected person straight away, with no fixed number of hours. Failing to do that is a crime punishable by one to three years in prison. The five-day deadline added in July 2025 applies to police, prosecutors, courts and prison services, not to a normal company.High confidence
What's the trap?: Five things that cost people their weekend. One: this is a criminal regime. Sending data abroad in breach of the rule is punished by one to five years in prison and a fine of up to one million dinars, roughly seven thousand seven hundred US dollars, and prison can attach to individuals. Two: since 24 July 2025 every organisation must appoint a data protection officer, keep a written register of processing and keep an automatic log recording every collection, consultation, disclosure and deletion, with no exemption for small companies. Three: sensitive data is banned by default, and consent must be express, so silence or a pre-ticked box is worth nothing. Four: anything to do with national defence and security now sits completely outside the law, so there is no privacy protection to point to there. Five: a 2021 ordinance makes it a crime to disclose classified administrative documents, it reaches acts committed outside Algeria against the Algerian state, and it can force any person to hand over stored data.High confidence
What's about to change?: Three things to watch in the next twelve months. The five-year terms of the data protection authority's members, appointed on 18 May 2022, run out in May 2027, so appointments are due. The regional inspection and audit units created for the authority in July 2025 still need an implementing regulation before inspectors can appear at your door. And the rules that switch on the new government data framework, two reference documents on classifying data and cataloguing data sources, can be published by a single decision of the High Commission for Digitalisation, at which point every public body and every company running a public service must classify and catalogue its data.High confidence
Hardest industry wall: Telecoms — Loi n° 26-02 fixant les regles generales relatives aux services de confiance pour les transactions electroniques et a l'identification electronique
E-commerce — Loi n° 18-05 relative au commerce electronique
Government — Decret presidentiel n° 25-320 portant mise en place d'un dispositif national de gouvernance des donnees

The same eight topics answered for each selected country
Question	KazakhstanChecked 18 August 2026	AlgeriaChecked 18 August 2026
The three ratings	A copy must stay Work: High Enforcement: Active	Yes, with paperwork Work: High Enforcement: Waking up
In one paragraph	Kazakhstan says a copy of personal data must live inside the country. The law is blunt: personal data has to be kept in a database located on Kazakh territory. You may still send data abroad, but only if the receiving country protects it as well as Kazakh law does, or if the person has agreed. Some industries go further and allow no copy abroad at all.	Data can leave Algeria, but not freely. Every transfer abroad needs the national data protection authority's permission unless a listed exception applies, and breaking that rule is a crime carrying prison. Since July 2025 every organisation must have a data protection officer, a processing register and an automatic log of every operation. The regulator is staffed but has issued no known decisions.
The catch	The 'keep a copy here, send a copy out' rule is the general position. It is not the whole picture. Telecoms operators must keep their subscriber and connection records in Kazakhstan. Gambling operators must run their servers in Kazakhstan. Any website using a .KZ or .ҚАЗ address must be hosted on equipment in Kazakhstan. And firms registered inside the Astana International Financial Centre live under a completely different, European-style rulebook with its own regulator and no local storage duty at all.	The national rule is already strict, and three areas are stricter still. Online shops must run their site on servers inside Algeria under a .com.dz address. Electronic trust services, such as digital signatures and electronic identity, must host all the data they collect inside Algeria. Public bodies must exchange data only over a state-run network that is deliberately kept separate from the internet. Banking, insurance and securities have no storage rule that we could find, but the central bank's own website could not be reached, so treat that as unchecked rather than settled.
Does this apply to me?	Almost certainly yes, but the law is vague about it. Kazakhstan's personal data law does not contain a clear sentence saying it applies to companies with no office in the country, and it sets no size or revenue threshold. What it does say is that whoever owns or operates the data must store it in a database inside Kazakhstan, which in practice pulls foreign services that handle Kazakh customers into scope. We found no requirement to appoint a local representative.Medium confidence	Yes, it can reach a company with no office in Algeria, but the trigger is equipment, not customers. You are covered if you are set up in Algeria, or if you use any means of processing located in Algeria, such as servers or devices. In that second case you must tell the regulator the name of a representative based in Algeria, and that person takes on your rights and duties. There is no size or revenue threshold to fall below.High confidence
Can the data leave the country?	Yes, a copy can leave, but the original has to stay. Kazakh law requires personal data to sit in a database on Kazakh soil, and separately allows sending it abroad when the destination country protects it to the same standard, or when the person has clearly agreed. That is the general rule. Four areas are stricter and in those the data, or the machine holding it, simply cannot leave.High confidence	Yes, with permission or a listed excuse. The starting rule is that you may only send personal data to another country if the national data protection authority allows it and that country protects privacy well enough. There is a short list of exceptions that most businesses will rely on instead, such as the person's express consent or a transfer that is needed to carry out their contract. Two things are banned outright: transfers that could harm public safety or the state's vital interests, and any processing of sensitive data such as health, religion, politics or trade union membership unless a narrow exception applies.High confidence
What do I have to do to send it abroad?	Before data goes abroad you need one of two things: proof that the destination country protects personal data to the Kazakh standard, or the clear agreement of the person concerned. There is no government form to file and no permit to obtain. The catch is that Kazakhstan has not published a list of approved countries, so the judgement is yours to make and yours to defend.Medium confidence	The model is case by case. Before data goes abroad you need the national data protection authority to authorise it, and the destination country must protect privacy well enough in the authority's judgement. There is no published list of approved countries and no official standard contract you can sign instead. In practice most companies rely on the written exceptions: the person's express consent, a transfer needed for their contract, a court claim, saving someone's life, an important public interest, an international mutual legal assistance request, medical care, or a treaty Algeria has signed.High confidence
Who enforces this — and are they actually working?	The Ministry of Artificial Intelligence and Digital Development is the authority, working through its Information Security Committee. It is real, staffed and busy: it runs inspections, brings administrative cases and hands files to the police. The fines are small by international standards, in the low tens of thousands of dollars at most. Firms inside the Astana International Financial Centre answer instead to that centre's own Commissioner of Data Protection.Medium confidence	The national data protection authority, and it does exist in real life. Fifteen members, including a president, were appointed by presidential decree on 18 May 2022 for five years, a new president was appointed in October 2023, and the authority has its own staff, pay scales, an executive secretariat, an official bulletin and internal committees. Its president was still signing published decisions in August 2025. What is missing is enforcement: in four years the official gazette shows only housekeeping texts from the authority, and no fine, order or filing procedure. Treat it as awake but not yet biting.High confidence
How long must I keep it, and when must I delete it?	There is a floor and a ceiling, and they are set in different places. The clearest floor is in payments: a payment service provider must keep the information identifying who sent money and who received it for five years. The ceiling comes from the privacy law, which says data may be kept only until the purpose it was collected for has been achieved. Since July 2026 people can also ask for their data to be deleted or anonymised.Medium confidence	There is a floor and a ceiling, and the floor is the one people miss. Accounting books and the paperwork behind them must be kept for ten years after the end of each financial year. Telephone and internet providers must keep the data that identifies users and their connections for one year. Online sellers must keep records of every transaction and send them to the national trade register centre. The ceiling is that personal data must not be kept in a form that identifies people for longer than the purpose needs, and keeping it too long is a crime.High confidence
What happens when something goes wrong?	There are at least two clocks and neither is stated in hours. Under the national privacy law you must tell the authority as soon as you detect a breach of personal data security, and give it the contact details of the person in your organisation who is responsible for data processing. Inside the Astana International Financial Centre the duty is to tell the Commissioner as soon as practicable, and to tell affected people too when the risk to them is high.Medium confidence	There is no seventy-two hour clock here, and the five-day deadline people quote is not for ordinary businesses. If you provide a service over a public electronic communications network and data is destroyed, lost, altered, disclosed or accessed without permission, you must warn the authority and the affected person straight away, with no fixed number of hours. Failing to do that is a crime punishable by one to three years in prison. The five-day deadline added in July 2025 applies to police, prosecutors, courts and prison services, not to a normal company.High confidence
What's the trap?	Five things that are not in the summary. Your website is caught: a .KZ or .ҚАЗ address must be hosted on machines inside Kazakhstan, whatever the site is for. Telecoms operators must keep subscriber records locally and pay for the interception equipment themselves. Gambling servers must sit at the operator's own premises in Kazakhstan. The financial centre in Astana is a legal island with its own regulator and no local storage duty. And the official English translations of Kazakh laws lag behind the Russian originals, so a fine you read as small may already have been multiplied.Medium confidence	Five things that cost people their weekend. One: this is a criminal regime. Sending data abroad in breach of the rule is punished by one to five years in prison and a fine of up to one million dinars, roughly seven thousand seven hundred US dollars, and prison can attach to individuals. Two: since 24 July 2025 every organisation must appoint a data protection officer, keep a written register of processing and keep an automatic log recording every collection, consultation, disclosure and deletion, with no exemption for small companies. Three: sensitive data is banned by default, and consent must be express, so silence or a pre-ticked box is worth nothing. Four: anything to do with national defence and security now sits completely outside the law, so there is no privacy protection to point to there. Five: a 2021 ordinance makes it a crime to disclose classified administrative documents, it reaches acts committed outside Algeria against the Algerian state, and it can force any person to hand over stored data.High confidence
What's about to change?	The big change has already landed. Kazakhstan's Digital Code was signed on 9 January 2026 and took effect on 12 July 2026, and the government says a law on artificial intelligence and a law on digital assets were adopted alongside it. The Digital Code gives people the right to have their data deleted, made anonymous or held back from processing, limits the use of face and fingerprint data, and lets people challenge decisions taken by automated systems. The next twelve months will be about the detailed rules underneath it.Medium confidence	Three things to watch in the next twelve months. The five-year terms of the data protection authority's members, appointed on 18 May 2022, run out in May 2027, so appointments are due. The regional inspection and audit units created for the authority in July 2025 still need an implementing regulation before inspectors can appear at your door. And the rules that switch on the new government data framework, two reference documents on classifying data and cataloguing data sources, can be published by a single decision of the High Commission for Digitalisation, at which point every public body and every company running a public service must classify and catalogue its data.High confidence
Hardest industry wall	All industries — Заң «Дербес деректер және оларды қорғау туралы» / Закон «О персональных данных и их защите» All industries — Цифровой кодекс Республики Казахстан / Цифрлық кодекс All industries — Единые требования в области информационно-коммуникационных технологий и обеспечения информационной безопасности Telecoms — Закон Республики Казахстан «О связи» Online gaming — Закон Республики Казахстан «Об игорном бизнесе»	Telecoms — Loi n° 26-02 fixant les regles generales relatives aux services de confiance pour les transactions electroniques et a l'identification electronique E-commerce — Loi n° 18-05 relative au commerce electronique Government — Decret presidentiel n° 25-320 portant mise en place d'un dispositif national de gouvernance des donnees