Data Protection Update in Kazakhstan: Q2 2026

Kazakhstan data protection 2026 is entering a more demanding phase. The country';s regulatory framework, anchored in the Law on Personal Data and Its Protection, has seen a series of amendments and enforcement actions that directly affect how businesses collect, store, process and transfer personal data. Companies operating in Kazakhstan - whether local entities or foreign businesses with a local presence - face tighter obligations, shorter response windows and growing scrutiny from the Committee for Information Security under the Ministry of Digital Development, Innovations and Aerospace Industry. This guide covers the key legislative developments of the current quarter, the enforcement landscape, cross-border transfer requirements, sector-specific obligations, and the practical steps businesses should take now.

The foundational instrument governing personal data in Kazakhstan remains the Law on Personal Data and Its Protection (the Personal Data Law). Recent amendments have expanded the definition of personal data to capture a broader range of identifiers, including biometric data, location data and behavioural profiles generated through digital services. This expansion has practical consequences: businesses that previously treated certain data sets as non-personal must now reassess their classification and apply the full suite of protective obligations.

A significant amendment introduced in the current legislative cycle concerns the legal bases for processing. Operators - the term the Personal Data Law uses for entities that determine the purposes and means of processing - must now document a specific legal basis for each processing activity. Consent remains the most commonly used basis, but it must be freely given, specific, informed and unambiguous. Pre-ticked boxes and bundled consent clauses embedded in general terms and conditions no longer satisfy the standard. Operators relying on consent must be able to demonstrate, on request from the regulator, that consent was obtained in the prescribed manner.

The amendments also introduce a requirement for operators to maintain a register of processing activities. This register must describe the categories of data subjects, the types of personal data processed, the purposes of processing, the retention periods and the recipients of data, including any cross-border transfers. The register is not a public document, but it must be made available to the Committee for Information Security during inspections. Many foreign-owned businesses operating through Kazakhstani subsidiaries have underestimated this requirement, treating it as a formality rather than a living compliance document.

A non-obvious requirement is that the register must be updated within a defined period whenever a material change occurs in processing activities. Failure to maintain an accurate register has been cited in recent enforcement actions as an aggravating factor when calculating administrative penalties.

Cross-border transfer of personal data is one of the most operationally sensitive areas of Kazakhstan data protection 2026. The Personal Data Law permits transfers to foreign states only if those states ensure an adequate level of protection for personal data. The Committee for Information Security maintains a list of countries considered to provide adequate protection. Transfers to countries not on this list require either the explicit consent of the data subject or the conclusion of a contract that incorporates data protection clauses approved by the regulator.

In practice, many multinational businesses rely on intra-group data flows that pass through servers or processing centres located outside Kazakhstan. These flows are subject to the same transfer restrictions as any other cross-border transfer. A common mistake is to assume that data moving between affiliates of the same corporate group is exempt from transfer rules. It is not. Each transfer must have a documented legal basis, and the receiving entity must be bound by obligations equivalent to those imposed on the Kazakhstani operator.

The localisation requirement adds a further layer of complexity. Under the Personal Data Law, personal data of Kazakhstani citizens must be collected, processed and stored using databases physically located in Kazakhstan. This obligation applies to the primary database. Secondary copies may be held abroad, but the primary record must remain on Kazakhstani territory. Cloud service providers and SaaS platforms that store data exclusively on foreign servers are in breach of this requirement, regardless of where their contractual counterparty is incorporated.

Consider a practical scenario: a European e-commerce platform serving Kazakhstani consumers stores all customer data on servers in Germany. Under current rules, that platform must either establish a local data centre, engage a Kazakhstani cloud provider, or migrate the relevant data to a compliant local infrastructure. The cost and lead time for such migration should not be underestimated - businesses in this position typically require several months and meaningful capital expenditure to achieve compliance.

A second scenario involves a Kazakhstani bank sharing customer data with a foreign parent for consolidated risk management. The bank must ensure that the transfer is covered by a valid legal basis, that the parent is bound by appropriate contractual obligations, and that the primary database remains in Kazakhstan. The bank';s compliance team must document each of these elements in the processing register.

The Committee for Information Security has increased the frequency and depth of inspections in recent periods. Enforcement activity has focused on three areas: unlawful cross-border transfers, inadequate consent mechanisms, and failure to respond to data subject requests within the statutory timeframe.

The Personal Data Law grants data subjects the right to access their personal data, to request correction of inaccurate data, and to demand deletion of data processed without a valid legal basis. Operators must respond to access requests within five working days and to deletion requests within three working days. These are short windows by international standards, and many businesses - particularly those without dedicated data protection functions - have struggled to meet them consistently.

Administrative penalties for violations of the Personal Data Law are imposed under the Code of Administrative Offences of the Republic of Kazakhstan. Penalties vary by the nature and severity of the violation. Repeated violations or violations involving sensitive categories of data attract higher penalties. The Committee has also begun issuing public notices identifying non-compliant operators, which carries reputational consequences beyond the financial penalty itself.

A common mistake among foreign businesses is to treat Kazakhstani data protection enforcement as less rigorous than European equivalents and to deprioritise compliance accordingly. Recent enforcement actions suggest this assumption is no longer safe. The regulator has demonstrated willingness to investigate complaints from data subjects and to initiate inspections on its own initiative, without waiting for a complaint to trigger the process.

If your business has received an inspection notice or a data subject complaint, prompt engagement with the regulator is advisable. We can assist with preparing responses and coordinating with the Committee for Information Security. Contact info@vlolawfirm.com for a consultation.

Certain sectors face additional obligations under Kazakhstani law. Financial institutions, healthcare providers, telecommunications operators and entities processing biometric data are subject to sector-specific regulations that layer on top of the general Personal Data Law framework.

Healthcare providers must comply with the Law on the Protection of Citizens'; Health, which imposes strict confidentiality obligations on medical data. Medical data is classified as sensitive personal data under the Personal Data Law, meaning that processing requires explicit consent or falls within a narrow set of statutory exceptions. Healthcare operators must also implement technical and organisational measures proportionate to the sensitivity of the data, including access controls, encryption and audit logging.

Telecommunications operators are subject to oversight by the Committee for Information Security and by the Ministry of Digital Development more broadly. They must retain certain categories of traffic and subscriber data for defined periods and must provide access to this data to authorised state bodies in accordance with the Law on Communications. The intersection of data retention obligations and data protection rights creates compliance complexity that requires careful legal mapping.

Biometric data - including facial recognition data, fingerprint records and voice prints - is treated as a special category requiring heightened protection. Operators processing biometric data must obtain explicit, purpose-specific consent and must implement security measures that go beyond the baseline requirements applicable to ordinary personal data. The use of biometric data for employee monitoring or access control has attracted particular regulatory attention in recent periods.

Entities operating in the financial sector must align their data protection practices with the requirements of the National Bank of Kazakhstan, which has issued guidance on data governance for banks and payment service providers. This guidance addresses data classification, incident response and the obligations of financial institutions when engaging third-party data processors.

Businesses that have not yet conducted a structured review of their data protection practices in Kazakhstan should treat this as a priority. The following areas warrant immediate attention.

First, map all personal data flows. Identify what personal data is collected, from whom, for what purpose, on what legal basis, where it is stored, how long it is retained, and to whom it is disclosed. This mapping exercise is the foundation of the processing register required under the amended Personal Data Law.

Second, review consent mechanisms. Audit all points at which personal data is collected from individuals - website forms, mobile applications, paper forms, verbal collection - and verify that consent is obtained in a manner that meets the current standard. Update privacy notices to reflect the expanded definition of personal data and the specific purposes for which data is used.

Third, assess cross-border transfer arrangements. Identify all instances in which personal data leaves Kazakhstan, whether to a foreign parent, a cloud provider, a marketing platform or any other recipient. For each transfer, confirm that a valid legal basis exists and that the primary database for Kazakhstani citizens'; data is located in Kazakhstan.

Fourth, establish a data subject request process. Designate a responsible function for receiving and responding to access, correction and deletion requests. Implement a workflow that can reliably meet the five-day and three-day response windows. Test the workflow before an actual request arrives.

Fifth, review contracts with data processors. Under the Personal Data Law, operators that engage third parties to process personal data on their behalf must conclude a written agreement that imposes data protection obligations on the processor. Review existing vendor contracts and update them where necessary.

In practice, founders and compliance officers should consider appointing a dedicated data protection contact - whether an internal officer or an external adviser - who can monitor regulatory developments and coordinate the business';s response to inspections and data subject requests.

Many underestimate the time required to build a compliant data protection programme from scratch. A realistic timeline for a medium-sized business to achieve baseline compliance is three to six months, assuming adequate resources and management commitment.

Does the data localisation requirement apply to foreign companies with no legal entity in Kazakhstan?

The localisation requirement under the Personal Data Law applies to operators that collect personal data of Kazakhstani citizens, regardless of where the operator is incorporated. A foreign company that collects data directly from Kazakhstani residents through a website or application is, in principle, subject to the localisation obligation. Enforcement against purely foreign entities without a local presence is more complex in practice, but the legal obligation exists. Foreign businesses that have a local subsidiary, a representative office, or a local payment processing arrangement are at greater practical risk of enforcement and should treat localisation as a binding requirement.

What are the consequences of failing to respond to a data subject request on time?

Failure to respond to an access request within five working days or to a deletion request within three working days constitutes a violation of the Personal Data Law and may result in an administrative penalty under the Code of Administrative Offences. Beyond the financial penalty, a data subject who does not receive a timely response may file a complaint with the Committee for Information Security, which can trigger a formal inspection. Repeated failures to meet response deadlines are treated as an aggravating factor and may result in higher penalties. Businesses should therefore treat data subject request management as an operational priority rather than an administrative afterthought.

Is consent always required to process personal data in Kazakhstan, or are there other valid legal bases?

Consent is the most commonly used legal basis under the Personal Data Law, but it is not the only one. Processing is also permitted without consent in a number of circumstances, including where it is necessary for the performance of a contract to which the data subject is a party, where it is required by Kazakhstani law, or where it is necessary to protect the vital interests of the data subject. Operators relying on a legal basis other than consent must document that basis clearly in their processing register. In practice, many businesses default to consent even where another legal basis would be more appropriate, which creates problems when consent is later withdrawn. A careful analysis of the available legal bases for each processing activity is therefore advisable.

Kazakhstan';s data protection framework is becoming materially more demanding. The combination of expanded definitions, stricter consent requirements, active enforcement and short response windows means that businesses can no longer treat compliance as a background matter. The current quarter has brought changes that require concrete operational responses, not just policy updates.

VLO Law Firms advises international clients on data protection matters in Kazakhstan. We can assist with processing register preparation, consent mechanism review, cross-border transfer analysis, data subject request workflows, and regulatory engagement. To request a consultation, contact: info@vlolawfirm.com