Data Protection Update in Kazakhstan: Q3 2026

Kazakhstan data protection 2026 has entered a new phase of active enforcement and legislative refinement. The country';s framework, anchored in the Law on Personal Data and Its Protection, continues to evolve as regulators close gaps between formal requirements and day-to-day business practice. For international companies operating in Kazakhstan - whether through local subsidiaries, cross-border data flows or digital services directed at Kazakhstani users - the current period brings concrete compliance obligations, tighter scrutiny and rising penalties. This guide covers the key regulatory changes, enforcement signals, cross-border data transfer rules, sector-specific requirements, and the practical steps businesses should take before the end of the third quarter.

Kazakhstan';s primary data protection instrument is the Law on Personal Data and Its Protection. This law establishes the definitions, legal bases for processing, data subject rights, and the obligations of data owners and operators. It is supplemented by secondary regulations issued by the Ministry of Digital Development, Innovations and Aerospace Industry, which acts as the principal supervisory authority for personal data matters.

The Committee for Information Security, operating within the Ministry, handles inspections, receives notifications of data breaches, and issues binding instructions to non-compliant organisations. Alongside this body, sector regulators - including the Agency for Regulation and Development of the Financial Market for financial institutions and the Ministry of Healthcare for medical data - exercise parallel oversight within their domains.

A non-obvious requirement for many foreign businesses is that Kazakhstan';s framework applies not only to entities registered in the country but also to any organisation that processes personal data of Kazakhstani residents, regardless of where the processing takes place. This extraterritorial reach mirrors approaches seen in other jurisdictions and is increasingly being applied in practice.

The Civil Code and the Code of Administrative Offences provide the enforcement teeth. Administrative liability for violations has been progressively tightened through recent amendments, and the current penalty schedule reflects a clear legislative intent to make non-compliance commercially painful rather than merely inconvenient.

The most significant recent development is the set of amendments to the Law on Personal Data and Its Protection that came into force in the current regulatory cycle. These amendments address three areas that had previously created uncertainty for operators: the definition of consent, the rules on automated decision-making, and the obligations of data processors acting on behalf of data owners.

On consent, the amendments clarify that consent must be specific, informed and freely given. Pre-ticked boxes, bundled consent and consent obtained as a condition of service access are now explicitly non-compliant. Businesses that relied on broad, general consent language in their privacy policies or terms of service must review and update those documents. In practice, this affects e-commerce platforms, mobile application providers and any service that collects user data at registration.

The automated decision-making provisions introduce a right for data subjects to request human review of decisions made solely by automated means where those decisions produce legal or similarly significant effects. This is relevant for financial services firms using algorithmic credit scoring, insurers using automated underwriting and HR technology platforms conducting automated candidate screening. Operators in these sectors must now establish a documented process for handling such requests.

The processor obligations amendments require that data owners enter into written agreements with any third party that processes personal data on their behalf. These agreements must specify the scope of processing, the security measures to be applied and the processor';s obligations in the event of a breach. Many international companies use cloud service providers, payroll processors or marketing platforms that handle Kazakhstani personal data. Each of those relationships now requires a compliant data processing agreement.

A further regulatory development is the updated guidance on data localisation. Kazakhstan requires that personal data of its citizens be stored on servers physically located within Kazakhstan. The updated guidance clarifies that this obligation applies at the point of initial collection and that subsequent transfers abroad are permissible only under specific conditions. Regulators have signalled that they will scrutinise cloud-first architectures where the primary database is hosted outside the country.

Cross-border transfer of personal data remains one of the most operationally complex areas of Kazakhstan data protection 2026. The law permits transfers to foreign states that provide an adequate level of protection, as determined by the Ministry of Digital Development. In the absence of an adequacy finding, transfers are permissible only with the explicit consent of the data subject or on the basis of an international treaty to which Kazakhstan is a party.

In practice, the list of countries recognised as providing adequate protection is limited and does not include many jurisdictions where multinational companies routinely process data. This means that for most cross-border transfers, businesses must either obtain valid individual consent from each data subject or rely on contractual mechanisms. The Ministry has not yet published a standard set of contractual clauses equivalent to the standard contractual clauses used in other jurisdictions, which creates a drafting burden for companies seeking to establish a contractual basis for transfers.

A common mistake made by foreign founders and multinationals is to assume that data stored in a regional cloud hub - for example, a data centre serving Central Asia - automatically satisfies the localisation requirement. It does not. The physical location of the server must be within Kazakhstan';s territory, and the operator must be able to demonstrate this to regulators upon request.

Practical scenario one: a European software-as-a-service company provides a human resources platform to a Kazakhstani employer. Employee data - including names, identification numbers, salary information and performance records - is processed on servers located in Germany. Under current rules, this arrangement requires either explicit employee consent for the transfer or a bilateral treaty basis. Neither is straightforward. The company should consider deploying a local data residency option or working with a Kazakhstani cloud provider to host the relevant data locally.

Practical scenario two: a Kazakhstani bank uses a global fraud detection system operated by its parent company abroad. Transaction data, including personal identifiers, is transmitted in real time. The financial sector regulator has issued guidance requiring that such arrangements be documented, that data minimisation principles be applied and that the bank retain primary responsibility for the security of transferred data. The bank must ensure its cross-border data processing agreement with the parent reflects these requirements.

If your organisation is navigating cross-border transfer compliance or restructuring data flows to meet localisation requirements, contact info@vlolawfirm.com. We can assist with documents and filings.

The Committee for Information Security has increased the frequency and depth of its inspections in the current period. Inspections are now being conducted on both a scheduled and unscheduled basis, with unscheduled inspections typically triggered by data subject complaints or reports of security incidents.

The most common violations identified in recent inspections fall into four categories. First, failure to register as a data owner or operator with the authorised body, which remains a formal requirement under the law. Second, absence of a privacy policy or use of a policy that does not meet the content requirements specified in the regulations. Third, inadequate security measures, particularly the absence of documented information security policies and failure to conduct periodic risk assessments. Fourth, non-compliance with data subject access and deletion requests, including failure to respond within the statutory timeframe.

The statutory timeframe for responding to data subject requests is thirty calendar days from receipt. Regulators have noted that many organisations treat this as a soft deadline. It is not. Failure to respond within thirty days is itself a violation, independent of whether the underlying request is ultimately fulfilled.

Penalties under the Code of Administrative Offences have been increased through recent amendments. The penalty scale distinguishes between first-time violations and repeat violations, and between violations by individuals, officials and legal entities. Legal entities face the highest penalty levels, and the current schedule makes repeated non-compliance significantly more expensive than initial violations. Regulators have also begun applying penalties on a per-violation basis rather than issuing a single penalty for a cluster of related violations found during a single inspection.

Many underestimate the reputational dimension of enforcement. The Committee publishes information about enforcement actions, and inclusion on the public register of violators can affect relationships with Kazakhstani counterparties, government procurement eligibility and the ability to obtain certain licences.

Financial institutions operating in Kazakhstan face a dual compliance burden. They must satisfy both the general personal data law and the specific requirements issued by the Agency for Regulation and Development of the Financial Market. Recent guidance from the Agency addresses the use of biometric data in customer identification, the retention of transaction records and the obligations of banks when sharing data with credit bureaux. Banks and payment service providers should treat the Agency';s guidance as binding and ensure their internal policies are aligned with both regulatory layers.

Healthcare organisations and medical data processors face similarly layered requirements. The Ministry of Healthcare has issued regulations on the processing of medical records in electronic form, including requirements for encryption, access controls and audit logging. A non-obvious requirement is that patient consent for processing medical data must be documented separately from general treatment consent. Many healthcare providers obtain a single consent form at registration; this approach does not satisfy the separate documentation requirement for data processing purposes.

Technology companies - including app developers, digital platforms and online marketplaces - are subject to the general law but face particular scrutiny in two areas. First, the collection of data from minors. The law requires parental or guardian consent for the processing of personal data of individuals under the age of eighteen. Platforms that do not have a robust age verification mechanism are exposed to enforcement risk. Second, the use of cookies and tracking technologies. Regulators have signalled that passive data collection through tracking technologies requires the same quality of consent as active data collection through forms.

In practice, founders should consider conducting a data mapping exercise as a first step. Understanding what data is collected, where it is stored, who processes it and on what legal basis is a prerequisite for identifying compliance gaps. Many organisations discover during such exercises that they are processing categories of data they were not aware of, or that they lack a documented legal basis for processing they have been conducting for years.

Businesses operating in Kazakhstan should treat the current quarter as a structured compliance review period. The following areas warrant priority attention.

Privacy policy and consent mechanisms should be reviewed against the updated consent requirements. Policies that rely on broad or bundled consent language must be revised. Consent collection mechanisms - including website forms, app registration flows and paper forms - should be audited to confirm they meet the specificity and freedom requirements now in force.

Data processing agreements with third-party processors should be identified and reviewed. Where agreements do not exist, they must be put in place. Where existing agreements predate the recent amendments, they should be updated to reflect the new processor obligation requirements.

Data localisation compliance should be verified. Operators should confirm the physical location of servers holding Kazakhstani personal data and document that confirmation. Where data is held outside Kazakhstan, the legal basis for the cross-border transfer must be identified and documented.

Registration with the authorised body should be confirmed. The registration requirement applies to data owners and operators meeting certain thresholds, and failure to register remains one of the most commonly cited violations in inspections.

Incident response procedures should be reviewed. The law requires notification of the Committee for Information Security within seventy-two hours of discovering a personal data breach. Many organisations lack a documented incident response procedure that would enable them to meet this deadline in practice.

Staff training on data protection obligations is a practical requirement that regulators look for during inspections. Training records should be maintained and updated to reflect the recent regulatory changes.

What is the deadline for responding to a data subject';s request to access or delete their personal data in Kazakhstan?

The statutory deadline is thirty calendar days from the date the request is received. This applies to both access requests and deletion requests. The clock starts from receipt, not from the date the organisation acknowledges the request. If the organisation requires additional time to verify the identity of the requester or to locate the relevant data, it should communicate this to the data subject promptly, but the thirty-day period is not automatically extended by such communication. Failure to respond within the deadline is an independent violation under the Code of Administrative Offences, regardless of whether the organisation ultimately complies with the substance of the request.

How much can a company expect to spend on bringing its data protection practices into compliance with current Kazakhstan requirements?

Compliance costs vary significantly depending on the size of the organisation, the volume and sensitivity of data processed, and the current state of its data governance practices. For a small to medium-sized business with straightforward data processing activities, the primary costs are professional fees for legal review and policy drafting, which typically start from the low thousands of USD, plus any technical costs associated with implementing security measures or adjusting data storage arrangements. Larger organisations with complex data flows, multiple processors and cross-border transfer arrangements should budget considerably more. Ongoing compliance costs - including annual reviews, staff training and incident response readiness - are a recurring item that should be factored into operational budgets.

Does a foreign company with no legal entity in Kazakhstan need to comply with Kazakhstani data protection law if it processes data of Kazakhstani residents?

Yes, in principle. The law';s application is not limited to entities registered in Kazakhstan. Any organisation that processes personal data of Kazakhstani residents is subject to the law';s requirements, including the localisation obligation, the consent requirements and the data subject rights provisions. The practical enforcement of these requirements against foreign entities without a local presence is more complex, but regulators have signalled an intent to pursue cross-border enforcement where possible, including through cooperation with foreign counterparts. Foreign companies that direct services at Kazakhstani users or that collect data from Kazakhstani residents should treat compliance as a genuine obligation rather than a theoretical risk.

Kazakhstan';s data protection landscape is becoming more demanding and more actively enforced. The recent legislative amendments, updated regulatory guidance and increased inspection activity create a clear compliance imperative for businesses operating in or directing services at Kazakhstan. Organisations that have not reviewed their data governance practices against the current framework face meaningful legal and reputational exposure.

VLO Law Firms advises international clients on data protection matters in Kazakhstan. We can assist with compliance assessments, privacy policy drafting, data processing agreements, cross-border transfer structuring and regulatory notifications. To request a consultation, contact: info@vlolawfirm.com