Data protection & privacy law in Kazakhstan (2026)

Legal framework

Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 'On Personal Data and Its Protection' (as amended through Law No. 211-VIII of 16 July 2025); supervised by the Ministry of Digital Development, Innovations and Aerospace Industry

Key points: data & privacy in Kazakhstan

1. 01Primary legislation

   Law No. 94-V of 21 May 2013 'On Personal Data and Its Protection' is the principal statute, covering collection, processing, storage, and cross-border transfer of personal data. The most recent amendment is Law No. 211-VIII of 16 July 2025, which enters into force 60 calendar days after first official publication.

   adilet.zan.kz dlapiperdataprotection.com

2. 02Supervisory authority

   The Ministry of Digital Development, Innovations and Aerospace Industry (MDDIAI) is the designated data protection authority. It issues guidance, performs compliance oversight, and since the 2024 amendments may conduct unscheduled inspections. The Prosecutor's Office retains parallel supervisory powers.

   dlapiperdataprotection.com gratanet.com

3. 032024 breach notification obligation

   Effective 1 July 2024, owners and operators of personal data must notify the MDDIAI within one working day of detecting a personal data security breach, including the contact details of the data processing officer. Collecting and processing physical copies of identity documents was simultaneously prohibited.

   gratanet.com dentons.com

4. 04Data localization

   Operators must maintain databases containing 'restricted personal data' on servers physically located in Kazakhstan. Cross-border transfers are permitted only to countries ensuring adequate protection, or based on data-subject consent, an international treaty, or specific public-interest grounds.

   dlapiperdataprotection.com morganlewis.com

5. 05Consent and lawful bases

   Consent of the data subject is the primary lawful basis for processing. It must be given in written or electronic form. Other permitted bases include performance of a contract, legal obligations, and protection of vital interests, but the law is less detailed on alternative bases than the GDPR.

   adilet.zan.kz morganlewis.com

6. 06AIFC parallel GDPR-aligned regime

   Entities registered in the Astana International Financial Centre are subject to the AIFC Data Protection Regulations and Rules, a separate framework closely modelled on the GDPR, including data-minimisation, purpose-limitation, storage-limitation principles, and rights to erasure and rectification. A dedicated AIFC Commissioner for Data Protection handles complaints within the AIFC.

   aifc.kz chambers.com

Timeline of decisions

1. 21 May 2013Law · official
   Law on Personal Data and Its Protection (No. 94-V) enacted

   Kazakhstan enacted its primary personal data law establishing rules for collection, processing, and storage of personal data by public and private entities, classifying electronic databases containing personal data as confidential and limiting processing to declared purposes; it forms the cornerstone of the country's data-security framework and has been amended multiple times, most significantly in 2021 and 2023.

   Adilet — Kazakhstan Legal Information System

Sources

1. 1.adilet.zan.kz/eng/docs/Z1300000094
2. 2.dlapiperdataprotection.com/index.html?t=law&c=KZ
3. 3.gratanet.com/publications/persona-data-protection-state-oversight-and-legislative-
4. 4.dentons.com/en/insights/alerts/2023/november/23/on-amendments-to-the-law-on-perso
5. 5.morganlewis.com/-/media/files/publication/outside-publication/article/2024/data-local
6. 6.aifc.kz/legal-framework/
7. 7.chambers.com/articles/kazakhstan-legal-regulation-of-personal-data-protection-in-t
8. 8.dlapiperdataprotection.com/?t=authority&c=KZ
9. 9.dlapiperdataprotection.com/?t=transfer&c=KZ
10. 10.morganlewis.com/-/media/files/publication/outside-publication/article/2023/data-prote