Data Protection Update in Kazakhstan: Q4 2025

Kazakhstan data protection 2025 entered a new phase in the final quarter, as regulators intensified enforcement and amended core obligations for both local and foreign operators. Businesses collecting, processing or transferring personal data of Kazakhstani residents must now navigate a tighter compliance framework under the Law on Personal Data and Its Protection, as amended. This guide covers the principal legislative changes, enforcement actions, cross-border transfer rules, practical obligations for companies, and the steps needed to stay compliant.

The foundational statute governing personal data in Kazakhstan is the Law on Personal Data and Its Protection (the "Personal Data Law"). Amendments that came into force in Q4 introduced several structural changes that affect how organisations must handle data subject rights and consent.

The most significant amendment concerns the definition of "personal data operators." The revised text broadens the category of entities treated as operators, capturing not only companies that collect data directly but also those that receive it from third parties for processing purposes. This change has immediate practical consequences for data processors acting under service agreements - they now carry direct regulatory obligations rather than relying solely on the contracting party';s compliance.

A second amendment tightened the consent requirements for processing sensitive categories of personal data, including health information, biometric data and financial records. Written consent - whether in paper or verifiable electronic form - is now mandatory for these categories without exception. Implied or behavioural consent, previously tolerated in some interpretations, is no longer sufficient under the updated text.

The amendments also introduced a formal data breach notification obligation. Operators must notify the Committee for Information Security under the Ministry of Digital Development, Innovations and Aerospace Industry (the "Committee") within 72 hours of becoming aware of a breach that poses a risk to data subjects. A separate notification to affected individuals must follow within a reasonable period. This aligns Kazakhstan';s framework more closely with international standards, though the specific thresholds for "risk" remain subject to regulatory guidance.

The Committee for Information Security is the primary supervisory authority for personal data matters. In Q4, the Committee signalled a shift from advisory engagement toward active enforcement, conducting a series of inspections across the financial services, e-commerce and healthcare sectors.

Enforcement actions in the period focused on three recurring violations. First, operators were found processing personal data without a valid legal basis - most commonly relying on outdated consent forms that did not meet the specificity requirements of the Personal Data Law. Second, several companies had failed to register their personal data databases with the authorised body as required under the Law. Third, cross-border data transfers were conducted without the contractual safeguards or recipient-country adequacy assessments the Law requires.

Penalties under the Code of Administrative Offences of Kazakhstan apply on a tiered basis. Minor procedural violations attract relatively modest fines, while systematic or large-scale breaches can result in substantially higher penalties and, in serious cases, suspension of data processing activities. The Committee has indicated that repeat violations will be treated as aggravating factors, and recent enforcement decisions reflect this approach.

A non-obvious requirement that many foreign-owned businesses overlook is the obligation to appoint a local representative or data protection contact point if the operator is established outside Kazakhstan but processes data of Kazakhstani residents. The Q4 amendments clarified this obligation and the Committee has begun requesting evidence of such appointments during inspections.

Cross-border transfer of personal data remains one of the most operationally complex areas of Kazakhstani data protection law. The Personal Data Law permits transfers to foreign states that provide an adequate level of protection, as determined by the authorised body. For transfers to countries not on the adequacy list, operators must rely on contractual mechanisms - specifically, agreements that incorporate the data protection standards prescribed by Kazakhstani law.

In Q4, the Committee published updated guidance on the contractual clauses required for transfers to non-adequate jurisdictions. The guidance specifies that transfer agreements must address, at minimum: the purpose and scope of processing, the categories of data transferred, the security measures applied by the recipient, the data subject rights available in the recipient jurisdiction, and the mechanism for resolving disputes. Operators using legacy transfer agreements should review them against this updated standard.

A common mistake among international groups is to rely on intra-group data transfer agreements drafted for EU or other jurisdictions without adapting them to Kazakhstani requirements. The Committee has made clear that such agreements do not automatically satisfy local law, even where they are substantively similar. Localisation - both linguistic and substantive - is expected.

The localisation obligation for certain categories of data also remains in force. Personal data of Kazakhstani citizens must be initially collected and stored on servers located within Kazakhstan before any cross-border transfer. This requirement, established in the original Personal Data Law, was not relaxed by the Q4 amendments and continues to be enforced actively.

If your organisation is restructuring its data flows or reviewing transfer agreements, contact info@vlolawfirm.com. We can assist with documents and filings to bring your cross-border arrangements into compliance.

Beyond the headline amendments, Q4 brought several practical changes that affect day-to-day compliance operations.

Database registration. The obligation to register personal data databases with the authorised body predates the Q4 amendments, but the Committee has updated its registration portal and introduced new data fields that operators must complete. Companies that registered databases under the previous system should verify whether their registrations remain valid or require updating.

Privacy notices. The updated consent requirements effectively require operators to revise their privacy notices and consent forms. A compliant notice must now specify, in plain language: the identity of the operator, the legal basis for processing, the categories of data collected, the purposes of processing, the retention period, the data subject';s rights and how to exercise them, and whether data will be transferred abroad. Notices that omit any of these elements are non-compliant.

Data subject rights. The Personal Data Law grants individuals the right to access, correct and delete their personal data. The Q4 amendments introduced a clearer timeline for responding to access requests: operators must respond within 15 calendar days of receiving a request. Failure to respond within this period is itself a violation, irrespective of whether the underlying data is handled correctly.

Internal documentation. In practice, founders and compliance officers should consider maintaining a record of processing activities, even though the Personal Data Law does not yet mandate this in the same form as, for example, the EU General Data Protection Regulation. The Committee has requested such records during inspections as evidence of a systematic compliance approach, and their absence has been treated as an indicator of inadequate internal controls.

Scenario one - a fintech operator. A fintech company processing payment and identity data for Kazakhstani users must now ensure that its consent forms separately address each sensitive data category, that its databases are registered and up to date, and that any transfer of data to a parent company abroad is covered by a compliant transfer agreement. The 72-hour breach notification clock applies from the moment the company';s security team becomes aware of an incident, not from when a formal internal investigation concludes.

Scenario two - a foreign e-commerce platform. An international e-commerce business with no physical presence in Kazakhstan but with Kazakhstani customers must appoint a local representative, store initial data on Kazakhstani servers, and ensure its privacy notice is available in Kazakh or Russian and meets the updated content requirements. The platform cannot rely on its EU or US privacy policy as a substitute.

The Q4 period saw the Committee issue sector-specific guidance for healthcare and financial services, two industries where personal data processing is particularly intensive.

In healthcare, the guidance addressed the intersection of the Personal Data Law with the Code of the Republic of Kazakhstan on Public Health and the Healthcare System. It confirmed that medical data constitutes sensitive personal data under the Personal Data Law and that healthcare providers must obtain explicit written consent before sharing patient data with third parties, including insurance companies and research institutions. The guidance also addressed telemedicine platforms, which must comply with both data protection and healthcare licensing requirements.

In financial services, the Committee coordinated with the Agency of the Republic of Kazakhstan for Regulation and Development of the Financial Market to address data sharing between banks, insurance companies and credit bureaus. The guidance clarified that data sharing within regulated financial groups is permissible under a legitimate interest basis, but only where the sharing is proportionate and the data subject has been informed. Automated credit scoring using personal data must be disclosed to applicants, and individuals have the right to request human review of automated decisions.

An emerging theme across sectors is the use of artificial intelligence and machine learning tools that process personal data. The Committee has not yet issued comprehensive AI-specific guidance, but its Q4 statements indicate that AI systems processing personal data will be assessed under the existing Personal Data Law framework, with particular scrutiny on transparency, purpose limitation and the rights of data subjects to understand and contest automated outcomes. Operators deploying such systems should document their AI processing activities now, in anticipation of more detailed requirements.

Many underestimate the compliance burden associated with third-party vendors. Where an operator engages a cloud provider, analytics platform or marketing tool that processes personal data on its behalf, the operator remains responsible for that processing. The Q4 amendments did not change this principle, but enforcement actions have highlighted that operators frequently lack adequate contractual controls over their vendors. Data processing agreements with all material vendors should be reviewed and updated.

Does the 72-hour breach notification requirement apply to all data breaches, or only serious ones?

The obligation applies to breaches that pose a risk to the rights and freedoms of data subjects - for example, breaches involving sensitive data, financial information or large volumes of records. Operators must make a rapid risk assessment when a breach is discovered. In practice, it is safer to notify the Committee and then withdraw or supplement the notification if the risk assessment concludes the breach is low-risk, rather than to delay notification while conducting a full investigation. The Committee has indicated it will consider the quality and speed of notification when determining enforcement responses. Operators should have an incident response procedure in place before a breach occurs.

How much does it cost to bring a company into compliance with the updated requirements?

Compliance costs vary considerably depending on the size of the organisation, the volume and sensitivity of data processed, and the current state of documentation. For a small or medium-sized business, the primary costs are legal advisory fees for reviewing and updating privacy notices, consent forms and vendor agreements, plus any technical costs for adjusting data storage arrangements to meet localisation requirements. Professional fees for a compliance review and documentation update typically start from the low thousands of USD. Ongoing costs include periodic reviews, staff training and database registration maintenance. Larger organisations with complex data flows or multiple jurisdictions will face higher costs.

Can a foreign company appoint a non-resident as its local representative in Kazakhstan?

No. The local representative must be a person or entity with a physical presence in Kazakhstan, capable of receiving communications from the Committee and responding to data subject requests within the statutory timeframes. A foreign parent company or a representative based in another jurisdiction does not satisfy this requirement. In practice, operators typically appoint either a local subsidiary, a branch, or an authorised individual resident in Kazakhstan. The representative';s contact details must be disclosed in the operator';s privacy notice and, where applicable, in the database registration.

Kazakhstan';s data protection framework has become materially more demanding, and Q4 brought concrete changes that require action from both local and foreign operators. The combination of broader operator definitions, stricter consent rules, a formal breach notification obligation and active enforcement means that a compliance review is no longer optional for businesses processing personal data of Kazakhstani residents.

VLO Law Firms advises international clients on data protection matters in Kazakhstan. We can assist with compliance audits, privacy notice drafting, database registration, cross-border transfer agreements and breach notification procedures. To request a consultation, contact: info@vlolawfirm.com