Kazakhstan

The Law on Personal Data and its Protection (No. 94-V of 21 May 2013) defines duties by reference to the 'owner' and 'operator' of a database rather than by territory. There is no article equivalent to Article 3 of the European General Data Protection Regulation setting out extraterritorial reach, and no registration or filing duty for foreign controllers that we could locate. The law does require a legal entity to appoint an internal person responsible for organising the processing of personal data (Article 25), which is a named-person duty but not a local-representative duty. Because the reach question is answered by practice rather than by clear text, confidence is medium: the honest position is that the storage duty binds anyone who wants to serve Kazakh customers lawfully, but a foreign company with no assets in Kazakhstan is hard for the regulator to reach directly.

General rating: mirror. A local copy is compulsory; an outbound copy is permitted with a lawful basis. Sector overrides found: - Telecoms (rated closed): operators must collect and store 'official information' — the service records about subscribers and their communications — and that storage must happen on Kazakh territory. Operators must also pay for the equipment that lets the security services carry out interception. - Gambling and betting (rated closed): the server of the operator's hardware and software complex must be physically at the operator's premises in Kazakhstan, and the servers of the single national accounting system must be on Kazakh territory. - Websites on the national domain (rated closed): any internet resource with a registered .KZ or .ҚАЗ name must be hosted on equipment located in Kazakhstan. - Government and critical infrastructure (rated mirror, medium confidence): the information security authority runs a single national backup platform for the electronic information resources of critically important objects, and sets how often they must be backed up into it. One override runs the other way. Firms registered in the Astana International Financial Centre, a special legal zone in the capital, are governed by that centre's own data protection regulations, which are modelled on European law and contain no requirement to keep data in Kazakhstan. For those firms the rating is conditional, not mirror. Banking, insurance, securities, health and mapping: no dedicated storage-location instrument was located on a government site on 18 August 2026. Those sectors still carry the general local-storage duty plus their own secrecy rules. Treat the absence as unverified rather than as an absence of rules — see the unconfirmed list.

The model is closest to an allowlist that nobody has populated. Article 16 of the Law on Personal Data permits cross-border transfer only where the receiving state ensures protection of personal data in line with that law. The exceptions are narrow: the person's consent, a ratified international treaty, a Kazakh law requiring the transfer to protect the constitutional order, public order or people's rights and health, and the case where consent cannot be obtained but the transfer protects constitutional rights. The same article ends by saying transfers may be prohibited or limited by other Kazakh laws — a standing power to close the door. We found no official register of countries assessed as adequate, so in practice most organisations rely on consent. Consent is a fragile basis for routine bulk transfers because it can be withdrawn. Inside the Astana International Financial Centre the mechanism is different and better documented. A destination is adequate if it is listed in the centre's rules or approved in writing by its Commissioner of Data Protection. Without that, a transfer needs the Commissioner's permit, the person's written consent, or another listed ground, and the Commissioner may publish standard contract wording for transfers.

The ministry was previously called the Ministry of Digital Development, Innovations and Aerospace Industry; it was renamed and is headed by a deputy prime minister, which is a signal of political weight. Observable enforcement: the Information Security Committee, the National Security Committee and the State Technical Service ran a joint unscheduled inspection after a leak said to affect 16 million people in July 2025, and referred the material to law enforcement for criminal proceedings. Official figures reported in August 2024 recorded 65 administrative cases about personal data in the first seven months of that year, up about 76 percent on the year before. That is a working regulator with modest tools, so the rating is active rather than aggressive. The penalties themselves sit in the Code on Administrative Offences, Article 79, which fines unlawful collection or processing of personal data and failure to take protection measures, with the amount scaled by the size of the business. The English text on the official legal database still shows the older scale of 10 to 200 monthly calculation index units; press reporting of amendments that took effect on 13 March 2025 puts the current ceiling far higher, at roughly 7.9 million tenge, about 15,000 US dollars. Treat the exact number as unsettled and see the unconfirmed list. The Astana International Financial Centre's Commissioner of Data Protection issues transfer permits, keeps a register of participant notifications and reviews complaints. We could not find a named commissioner or any published decisions, so that office is best described as functioning but quiet.

Verified floors: five years for payment sender and beneficiary identification data under the Law on Payments and Payment Systems; at least seven days of video recordings at cash desks and gaming positions under the Law on Gambling Business. Telecoms operators must keep the service information about subscribers and their communications, and must keep it inside Kazakhstan, but we could not verify the retention period from an official source. Verified ceiling: the Law on Personal Data sets the storage period by reference to the date the collection and processing purposes are achieved, unless another law says otherwise. The new Digital Code, in force since July 2026, adds an individual right to demand deletion, anonymisation or restriction of processing. How a conflict resolves: the privacy law defers expressly to other laws that set their own periods, so a specific statutory retention duty beats the general delete-when-done rule. We did not verify the general tax and accounting retention periods from a government source; do not assume the common five-year figure without checking.

The national duty sits in Article 25 of the Law on Personal Data: notify the competent authority from the moment the personal data security breach is detected, naming the person responsible for organising the processing of personal data. The official English translation does not express this as a fixed number of hours, and we could not confirm from a government source whether an implementing order sets a specific deadline. Plan to notify inside one working day. The financial centre regime is clearer in structure: notify the Commissioner as soon as practicable (section 19-1) and notify the individuals as soon as practicable where there is a high risk to them (section 19-2). A third clock probably exists for cyber incidents affecting critical information infrastructure, reported through the state technical service and the national computer emergency response team, but we could not verify its deadline from an official source on 18 August 2026. Assume it exists and confirm before you need it.

1. Domain-name hosting. Paragraph 62-1 of the Uniform Requirements approved by Government Decree No. 832 requires any internet resource on the .KZ or .ҚАЗ national domains to run on hardware located in Kazakhstan. Marketing teams register national domains without asking infrastructure teams; this is where that bill lands. 2. Telecoms. Article 15 of the Law on Communications puts two duties together: store the service information about subscribers and their communications inside Kazakhstan, and fund, from your own or borrowed money, the equipment that allows the authorities to carry out investigative and counter-intelligence measures on your network. 3. Gambling. The server of the operator's system must be at the operator's location in Kazakhstan, and the servers of the single accounting system introduced in July 2024 must also be on Kazakh territory. Remote hosting is not an option. 4. The Astana International Financial Centre. Firms registered there follow the centre's own data protection regulations, not the national law, and those regulations contain no requirement to keep data in Kazakhstan. They also, until the centre's board makes rules on the point, place no cap at all on the fines the Commissioner can impose. A rule with no ceiling is not a soft rule. 5. Translation lag. The state legal database publishes English translations that trail the Russian text. On 18 August 2026 the English version of the personal data law showed amendments only to June 2024, and the English text of the fines article showed a scale that press reporting says was raised in March 2025. Always price risk from the Russian text.

What to watch, in order of how fast it can change your life. Dormant switches that need no consultation. First, the closing words of Article 16 of the personal data law let other Kazakh laws prohibit or restrict transfers outright; that is a standing power to shut the door on a named destination or data type. Second, the same law lets the government set the manner in which telecoms operators collect and store service information, so the scope of what must stay in the country can be widened by ministerial order. Third, the financial centre's Commissioner can approve or de-approve a destination jurisdiction in writing, with no public process attached. Pending detail. The Digital Code is a framework: its subordinate rules, including anything on data localisation, cross-border transfer and artificial intelligence oversight, are still being issued. We could not locate the official consolidated text of the Digital Code on a government site, so its exact effect on the 2013 personal data law — amended, layered over, or partly replaced — is not yet established here. This is the single most important thing to re-check at the next refresh. Also in motion: a state-backed hyperscale data centre programme, the 'Data Center Valley' in the Pavlodar region, with a target capacity of at least one gigawatt. Cheap domestic capacity makes a strict local-storage rule easier for the government to defend and harder to argue against.