Kazakhstan

The Law on Personal Data and its Protection (No. 94-V of 21 May 2013) sets duties for the 'owner' and the 'operator' of a database. It does not set them by territory. There is no article like Article 3 of the European General Data Protection Regulation. That article says plainly that European law applies even if you have no office in Europe. We found no registration or filing duty for foreign companies either. The law does require a company to appoint someone inside the business to organise how personal data is used (Article 25). That is a named-person duty, not a local-representative duty. The reach question is answered by how the law is applied, not by clear text, so our confidence is medium. The honest position: the storage duty binds anyone who wants to serve Kazakh customers lawfully. But a foreign company with no assets in Kazakhstan is hard for the regulator to reach directly.

General rating: mirror. You must keep a local copy. You may keep a copy abroad if you have a lawful basis. Industry overrides we found: - Telecoms (rated closed): operators must collect and store 'official information'. That means the service records about subscribers and their communications. The storage must happen on Kazakh territory. Operators must also pay for the equipment that lets the security services listen in. - Gambling and betting (rated closed): the server of the operator's hardware and software system must sit physically at the operator's premises in Kazakhstan. The servers of the single national accounting system must be on Kazakh territory. - Websites on the national domain (rated closed). Any internet resource with a registered .KZ or .ҚАЗ name must be hosted on equipment located in Kazakhstan. - Government and critical infrastructure (rated mirror, medium confidence). The information security authority runs a single national backup platform. It holds the electronic information resources of critically important objects. It also sets how often they must be backed up into it. One override runs the other way. Firms registered in the Astana International Financial Centre, a special legal zone in the capital, follow that centre's own data protection rules. Those rules are modelled on European law and do not require data to stay in Kazakhstan. For those firms the rating is conditional, not mirror. Banking, insurance, securities, health and mapping: we found no dedicated rule about where data must sit on a government site on 18 August 2026. These industries still carry the general local-storage duty plus their own secrecy rules. Treat that as unchecked, not as proof there are no rules. See the unconfirmed list.

The model is closest to a list of approved countries that nobody has filled in. Article 16 of the Law on Personal Data allows sending data abroad only where the receiving state protects personal data in line with that law. The exceptions are narrow. The person's consent. A ratified international treaty. A Kazakh law requiring the transfer to protect the constitutional order, public order, or people's rights and health. And the case where you cannot get consent but the transfer protects constitutional rights. The same article ends by saying other Kazakh laws may ban or limit transfers. That is a standing power to close the door. We found no official register of countries judged to protect data well enough. So most organisations rely on consent. Consent is a fragile basis for routine bulk transfers, because the person can withdraw it. Inside the Astana International Financial Centre the method is different and better documented. A destination counts as safe if the centre's rules list it, or if its Commissioner of Data Protection approves it in writing. Without that, a transfer needs the Commissioner's permit, the person's written consent, or another listed ground. The Commissioner may also publish standard contract wording for transfers.

The ministry was previously called the Ministry of Digital Development, Innovations and Aerospace Industry. It was renamed, and a deputy prime minister heads it. That signals political weight. Here is what you can observe. In July 2025 a leak was said to affect 16 million people. The Information Security Committee, the National Security Committee and the State Technical Service ran a joint unscheduled inspection. They referred the material to law enforcement for criminal proceedings. Official figures reported in August 2024 recorded 65 administrative cases about personal data in the first seven months of that year. That was up about 76 percent on the year before. This is a working regulator with modest tools, so the rating is active rather than aggressive. The penalties sit in Article 79 of the Code on Administrative Offences. It fines you for collecting or using personal data unlawfully, and for failing to take protective measures. The amount scales with the size of your business. The English text on the official legal database still shows the older scale of 10 to 200 monthly calculation index units. Press reporting of amendments that took effect on 13 March 2025 puts the current ceiling far higher. It gives roughly 7.9 million tenge, about 15,000 US dollars. Treat the exact number as unsettled and see the unconfirmed list. The Astana International Financial Centre's Commissioner of Data Protection issues transfer permits, keeps a register of participant notifications and reviews complaints. We found no named commissioner and no published decisions. That office is best described as working but quiet.

Confirmed floors: five years for payment sender and beneficiary identification data under the Law on Payments and Payment Systems. At least seven days of video recordings at cash desks and gaming positions under the Law on Gambling Business. Telecoms operators must keep the service information about subscribers and their communications, and must keep it inside Kazakhstan. We could not confirm how long for from an official source. Confirmed ceiling. The Law on Personal Data ties the storage period to the date you achieve what you collected the data for. Another law can say otherwise. The new Digital Code has been in force since July 2026. It adds a right for people to demand deletion, anonymisation, or a stop on further use of their data. How a conflict resolves: the privacy law defers to other laws that set their own periods. So a specific legal keeping duty beats the general delete-when-done rule. We did not confirm the general tax and accounting keeping periods from a government source. Do not assume the common five-year figure without checking.

The national duty sits in Article 25 of the Law on Personal Data. You notify the competent authority from the moment you detect the personal data security breach. You name the person responsible for organising how personal data is used. The official English translation does not set a fixed number of hours. We could not confirm from a government source whether a separate order sets a deadline. Plan to notify within one working day. The financial centre's rules are clearer in structure. Tell the Commissioner as soon as practicable (section 19-1). Tell the individuals as soon as practicable where there is a high risk to them (section 19-2). A third clock probably exists for cyber incidents affecting critical information infrastructure. Those are reported through the state technical service and the national computer emergency response team. We could not confirm its deadline from an official source on 18 August 2026. Assume it exists and confirm it before you need it.

1. Domain-name hosting. Paragraph 62-1 of the Uniform Requirements approved by Government Decree No. 832 requires any internet resource on the .KZ or .ҚАЗ national domains to run on hardware located in Kazakhstan. Marketing teams register national domains without asking the infrastructure team. That is where this bill lands. 2. Telecoms. Article 15 of the Law on Communications puts two duties together. Store the service information about subscribers and their communications inside Kazakhstan. And pay, from your own or borrowed money, for the equipment that lets the authorities run investigative and counter-intelligence measures on your network. 3. Gambling. The server of the operator's system must be at the operator's own location in Kazakhstan. The servers of the single accounting system introduced in July 2024 must also be on Kazakh territory. Remote hosting is not an option. 4. The Astana International Financial Centre. Firms registered there follow the centre's own data protection rules, not the national law. Those rules do not require data to stay in Kazakhstan. They also place no cap at all on the fines the Commissioner can impose, until the centre's board makes rules on the point. A rule with no ceiling is not a soft rule. 5. Translation lag. The state legal database publishes English translations that trail the Russian text. On 18 August 2026 the English version of the personal data law showed amendments only to June 2024. The English text of the fines article showed a scale that press reporting says was raised in March 2025. Always price your risk from the Russian text.

What to watch, in order of how fast it can change your life. Unused powers that need no consultation. First, the closing words of Article 16 of the personal data law let other Kazakh laws ban or restrict transfers outright. That is a standing power to shut the door on a named country or a named type of data. Second, the same law lets the government set how telecoms operators collect and store service information. So a ministerial order can widen what must stay in the country. Third, the financial centre's Commissioner can approve a destination country in writing, or withdraw that approval, with no public process attached. Pending detail. The Digital Code is an outline. The detailed rules underneath it are still being issued. That includes anything on keeping data in the country, on sending data abroad, and on overseeing artificial intelligence. We could not find the official consolidated text of the Digital Code on a government site. So its exact effect on the 2013 personal data law is not settled here. It may have amended that law, layered over it, or partly replaced it. This is the single most important thing to re-check next time. Also in motion: a state-backed hyperscale data centre programme called 'Data Center Valley', in the Pavlodar region. Its target capacity is at least one gigawatt. Cheap home-grown capacity makes a strict local-storage rule easier for the government to defend and harder to argue against.