Kazakhstan regulates data in two layers. First, a localisation rule requires personal data of individuals to be stored in a database located in Kazakhstan. Second, transfer conditions govern when data can leave the country, generally requiring an adequate level of protection abroad, the data subject’s consent, or another statutory ground. In 2026 the country also redefined “personal data”, created new state registers for data processors and tightened penalties. A proposed decree that would relax localisation and open the way to standard contractual clauses was under discussion in May 2026, but we have not been able to confirm that it has been adopted.
This guide explains the framework as it stands, what the 2026 reforms changed, and how foreign businesses can structure data flows with a Kazakh nexus.
Key takeaways
- Store first, transfer second. Under Article 12(2) of the Law on Personal Data and Its Protection (No. 94-V of 21 May 2013), the owner, operator and third parties must keep personal data in a database located in Kazakhstan. Cross-border transfer rules apply on top of that.
- Transfers are permitted on defined grounds. These centre on countries that ensure adequate protection, the data subject’s consent, and cases provided by treaty or statute. Kazakhstan has not, as far as we know, approved standard contractual clauses or binding corporate rules as a transfer tool.
- The 2026 reforms widened the net. A new identifier-based definition of personal data took effect on 11 July 2026, and the main amendments of Law No. 326-VIII (24 June 2026) took effect on 25 August 2026.
- Foreign companies are in scope. The law applies to organisations processing the personal data of Kazakh residents, and regulators have signalled an intention to enforce against foreign controllers.
- Registration and notification are coming into play. A register of persons processing personal data classifies controllers by the number of data subjects, with extra obligations for large ones.
- The AIFC has a different regime, with its own data protection rules and, according to practitioners, fewer localisation constraints.
- Architecture decisions matter more than contracts. Where data sits, which entity controls it and what is replicated abroad usually decide compliance.
The legal map
| Instrument | Why it matters |
| Law on Personal Data and Its Protection, No. 94-V (2013) | Core statute: definitions, consent, localisation (Article 12(2)), cross-border transfer and data subject rights |
| Digital Code, No. 255-VIII (9 January 2026) | Broad digital-law code. Per commentators, it requires owners of “digital resources” to follow the personal data rules and contains Articles 30–31 restricting cross-border transfer of “digital data products” |
| Law No. 256-VIII (9 January 2026), in force 11 July 2026 | Introduced the new definition of personal data based on identifiers; reported to repeal the Informatization Law’s Article 36 while carrying the personal data requirements across to a wider range of digital objects |
| Law No. 326-VIII (24 June 2026), main provisions in force 25 August 2026 | New definitions (automated processing, anonymisation, masking, hashing, breach), rules on automated processing and public-source data, registers, higher fines |
| Ministerial Order of 22 June 2026, in force 12 July 2026 | Updated rules on personal data protection measures for controllers, processors and third parties |
| Law on Artificial Intelligence, No. 230-VIII (17 November 2025) | Requires AI-related activity to comply with the personal data rules |
| Law on Informatization (2015) | Localisation and security requirements for state bodies and critical information infrastructure |
| AIFC Data Protection Regulations | Separate regime within the Astana International Financial Centre |
What counts as personal data after July 2026
Until mid-2026, personal data was defined as data, including biometric data, relating to an identified or identifiable individual, recorded on any medium. From 11 July 2026 the definition is built around personal data identifiers: information, or a set of information, relating to a data subject and supplemented by one or more identifiers. Practitioner summaries list identifiers such as full name, the individual identification number (IIN), a facial image and a facial biometric vector or its derivatives.
Three practical consequences:
- Review your data inventory. Some datasets previously treated as personal may be re-assessed under the new definition, and others may need to be brought in. Do not assume pseudonymised or hashed data falls outside the law until you have checked it against the new definitions of anonymisation, masking and hashing introduced in August 2026.
- Restricted-access data is treated more strictly. Biometric and health data are in a higher-risk category. For registration purposes, a controller processing such data is moved up one size category.
- Data subject requests have teeth. Commentators on the 2026 rules note that personal data must be blocked promptly when a data subject requests it. Build a process that can actually do this.
The localisation rule
Article 12(2) requires the owner and/or operator, as well as third parties, to store personal data in a database located in Kazakhstan. Practitioner commentary draws several conclusions:
- The primary database must be physically in Kazakhstan. A foreign cloud region accessible from Kazakhstan does not satisfy the rule unless the servers are located there.
- Parallel storage is contested. Commentary on the current approach is that keeping a mirror of the database abroad does not cure the obligation, and that offshore backups can be permitted only if they comply with the transfer rules. This area lacks clear regulatory guidance.
- It is not limited to Kazakh companies. The rule applies to organisations processing personal data of Kazakh residents, including foreign companies and those using local infrastructure.
- Anonymised data is outside the rule, but only where it is irreversibly anonymised, which is a high bar.
- Other regimes add to it. The Informatization Law and the Digital Code extend localisation-style requirements to state bodies, critical infrastructure and a wider range of digital objects, and sector rules (for example in telecommunications) may impose their own storage limits.
The American Chamber of Commerce in Kazakhstan has argued that the rules lack a distinction between sensitive data that must stay in the country, data that can be processed abroad, and data where hybrid or parallel storage is acceptable, and that this uncertainty causes many organisations to over-interpret the law. That is a useful picture of the market: compliance is possible, but it requires conservative, documented decisions.
The transfer rules: when data can leave
Cross-border transfer of personal data is permitted where the destination country ensures protection of personal data. Where it does not, transfer is possible only in limited cases, which practitioner summaries describe as:
- With the data subject’s consent to the cross-border transfer
- Where an international treaty ratified by Kazakhstan provides for it
- Where Kazakh law allows it to protect interests such as constitutional order, public order, the rights and freedoms of individuals, or public health and morals
- Where obtaining consent is impossible and the transfer is needed to protect the life or health of the person
Kazakh law can also prohibit transfers in particular cases.
| Transfer route | How it works | Practical comment |
| Adequate jurisdiction | Transfer to a country the authority treats as ensuring protection | Confirm which countries are accepted and keep a record of your assessment. Do not assume that GDPR adequacy or any other country’s list applies |
| Consent | Specific consent of the data subject to transfer, with information about the destination | The workhorse for customer data. Draft consent clearly, name the transfer and keep proof |
| Treaty or statutory ground | Transfers required by treaty or law | Rarely suitable for routine commercial flows |
| Contract-based tools (SCCs, BCRs) | Standard contractual clauses or binding corporate rules | Practitioner sources report that the authority has not approved standard forms. A draft decree discussed in May 2026 would introduce them for most personal data, but we could not confirm it is in force. Treat contract-only transfers as unprotected until the law says otherwise |
| Localise, then replicate selectively | Primary database in Kazakhstan, with only lawful, documented flows abroad | Often the lowest-risk model for large operators |
The law also requires operators to inform data subjects whether personal data may be transferred to third parties and whether cross-border transfer takes place, so your privacy notice and consent text must match your actual data flows.
Beyond personal data
The framework is not only about individuals’ data:
- Digital data products. According to the American Chamber of Commerce’s analysis, Articles 30 and 31 of the Digital Code impose additional restrictions on cross-border transfer of “digital data products”, including the outcomes of data processing. The practical scope of this concept is still developing, so treat analytics outputs and derived datasets with caution.
- Critical information infrastructure and state systems. Stricter localisation and security rules apply to government bodies, quasi-state entities and operators of critical infrastructure.
- Telecommunications and online services. Sector rules may require user data to be held in Kazakhstan, so check any communications or platform licences that apply to you.
- Financial and banking secrecy, and rules for regulated entities such as banks, payment providers and digital-asset operators, add their own confidentiality and outsourcing requirements
- 6. New 2026 obligations for controllers and processors
Based on the 2026 reforms as summarised by law firms and advisers:
- Register of persons processing personal data. Controllers are classified by the number of unique data subjects: small (under 10,000), medium (10,000 to under 500,000) and large (500,000 or more). Large controllers must notify the authority when they start and stop processing. Processing biometric or health data raises the category by one level.
- Register of personal data security breaches, maintained by the authority from public sources and state cybersecurity entities.
- Automated processing. Where automated processing creates, changes or ends a person’s rights or legitimate interests, it requires consent or a statutory basis, and the individual may seek information and object.
- Public-source data. Personal data placed by an individual in a publicly accessible source is not treated as unconditional consent to further processing. Scraping and enrichment practices need review.
- Security measures. Updated rules include additional measures for restricted-access data, such as encrypted transmission and cryptographic protection of stored data.
- Higher fines. Reported fines for certain personal data violations can reach 2,000 monthly calculation indices (MCI), and 1,000 MCI for certain cybersecurity breaches.
If you operate a product in Kazakhstan, check whether you need to be on the register, confirm your category, and review the security measures that apply to your data.
The AIFC: a parallel regime
The Astana International Financial Centre has its own data protection regulations, broadly modelled on European principles, with an independent commissioner and separate mechanisms for international transfers. Practitioners describe the AIFC as offering fewer localisation constraints than the rest of Kazakhstan, which is one reason some digital platforms structure through it.
There are limits. The AIFC regime applies to AIFC participants and to the processing connected with them. An AIFC entity that serves onshore customers, or that exchanges data with onshore group companies, can still be affected by Kazakhstan’s general rules. Treat the AIFC as a structuring option, not a way to avoid the national law for onshore data.
Architecture options for foreign businesses
| Model | How it works | Best for | Watch-outs |
| Local primary database, global analytics on anonymised data | Personal data stored in Kazakhstan; only irreversibly anonymised or aggregated data leaves | SaaS, e-commerce, fintech | Anonymisation must be robust; document the method |
| Local data centre or local cloud region | Host the personal-data layer with a provider whose servers are in Kazakhstan | Platforms with large user bases | Vendor due diligence; performance and cost |
| Consent-based cross-border transfer | Explicit consent to named transfers, with local primary storage | Customer data with a clear relationship | Consent must be specific, informed and provable |
| Minimise collection | Do not collect Kazakh personal data you do not need | Marketing, analytics, lead generation | Commercial trade-offs |
| AIFC structure | Use an AIFC entity for qualifying activities | Financial and digital-asset businesses | Onshore users and group flows remain exposed |
| Offshore only, no local presence | Serve Kazakh users from abroad | Limited-scope services | Highest enforcement and reputational risk, since the law applies to processing of residents’ data |
Contracts and governance that support compliance
- Map the data. Build a record of what personal data you hold on Kazakh residents, where it is stored, who can access it and where it flows.
- Align notices and consents with real data flows, including the countries of destination and the identity of recipients.
- Vendor and cloud contracts. Require processors and sub-processors to disclose server locations, restrict onward transfers, support data subject requests and notify breaches promptly.
- Intra-group agreements. Because standard contractual clauses are not a safe harbour, intra-group sharing needs a lawful basis for each flow, supported by local storage design.
- Access controls. Remote access by foreign staff to a Kazakh database can itself be a cross-border transfer, so restrict and log it.
- Incident response. Prepare for breach notification and for the new breach register.
- Data subject rights. Build processes to handle access, correction, objection and blocking requests promptly.
How it plays out by sector
| Sector | Typical data flows | Main compliance pressure points |
| HR and payroll for multinationals | Employee records sent to a regional or global HR system | Localise the primary employee database; document transfers; handle sensitive data carefully |
| E-commerce and consumer apps | Customer accounts, payment and behavioural data | Consent wording; localisation of user databases; automated profiling rules |
| Fintech and digital assets | KYC, transaction and wallet data | Overlap with AML retention duties and licensing; regulated-entity outsourcing rules |
| SaaS and cloud providers | Customer-uploaded data processed in global regions | Role as processor or controller; hosting location; customer contracts |
| AI and analytics | Training data, model outputs | Rules on automated processing; localisation of personal-data inputs; classification of outputs as digital data products |
What may change
- Draft decree on data infrastructure. An AmCham brief of 15 May 2026 describes a draft decree on measures to develop data processing and storage infrastructure. Reportedly, it would lift mandatory domestic storage and allow cross-border transfer for most categories of personal data to adequate jurisdictions, or where the operator uses binding corporate rules, standard clauses and recognised security certification, while requiring special categories in the cloud to remain under Kazakh control of encryption keys. It would also create a “cloud first” approach for government data and relax some rules for Data Centre Valley participants who do not serve Kazakh users. We could not confirm from official sources that it has been adopted, so do not rely on it until it is published and in force.
- Online platforms legislation. The same brief refers to a draft bill that would require some foreign platforms to open local representative offices.
- Secondary legislation. Further orders, registration procedures and adequacy criteria will determine how the new registers work in practice.
- Enforcement. Advisers report that the regulator has signalled interest in cross-border enforcement against foreign controllers without a local presence.
A note for Indian businesses
Indian companies that provide IT, outsourcing or SaaS services to clients with Kazakh data, or that handle Kazakh employee or customer data in India, should not assume that Indian practice carries over. Under India’s Digital Personal Data Protection Act, 2023 and the Rules notified in November 2025, transfers abroad are generally permitted unless restricted by the government, whereas Kazakhstan starts from a localisation requirement. A group with operations in both countries needs a data map that identifies which dataset is governed by which law, and should check contracts with Kazakh clients for storage and access terms before routing support or analytics work offshore.
A 90-day action plan
| Timing | Action |
| Days 1–30 | Inventory personal data of Kazakh residents; identify where it is stored and who can access it; test it against the new definition of personal data; identify sensitive and biometric data |
| Days 31–60 | Decide your architecture (local primary database, local cloud, consent-based transfers); confirm your size category and registration obligations; review vendor and cloud contracts; update privacy notices and consents |
| Days 61–90 | Implement access controls and logging; adopt data subject request and breach procedures; train staff; document your legal basis for each cross-border flow; set a monitoring routine for new regulations and the draft decree |
Common mistakes we see
- Assuming a foreign cloud region is compliant because it is fast and accessible from Kazakhstan.
- Relying on standard contractual clauses or intra-group agreements as if they were an approved transfer mechanism.
- Using generic consent language that does not name the transfer or destination.
- Overlooking remote access from abroad as a form of transfer.
- Ignoring the 2026 definition changes and the new registers.
- Treating hashed or pseudonymised data as anonymous without analysis.
- Assuming the AIFC solves onshore compliance.
- Acting on the draft decree as though it were law.
- Failing to document decisions, which is what regulators and counterparties will ask to see.
Frequently asked questions
Does Kazakhstan require personal data to be stored locally? Yes. Article 12(2) of the Personal Data Law requires personal data to be stored in a database located in Kazakhstan. Cross-border transfer rules apply in addition.
Can I transfer personal data abroad? Yes, in defined cases: where the destination ensures adequate protection, with the data subject’s consent, or on another ground provided by treaty or law. Keep records of the basis you use.
Are standard contractual clauses recognised? Not as far as we can confirm. A draft decree would introduce them, but its adoption has not been verified, so do not rely on contracts alone.
Does the law apply to a foreign company with no office in Kazakhstan? The law applies to processing of personal data of Kazakh residents, and regulators have signalled willingness to enforce against foreign controllers, although practical enforcement is harder without a local presence.
What changed in 2026? A new identifier-based definition of personal data (from 11 July), updated protection rules (from 12 July), and a package of amendments from 25 August 2026 covering automated processing, public-source data, registers of processors and security breaches, and higher fines.
Is the AIFC exempt from these rules? The AIFC has its own data protection regime, but onshore activities and data flows remain subject to the national law.
What are the penalties? Reported fines for certain personal data violations can reach 2,000 MCI, with up to 1,000 MCI for certain cybersecurity breaches, in addition to other administrative consequences.
Kazakhstan’s approach to cross-border data is still restrictive in 2026, and the reforms have added registration, new definitions and higher penalties. At the same time, policymakers are discussing a more liberal route that could ease localisation for many datasets. Until that route is in force, the safest approach is to design your data architecture around local primary storage, document a lawful basis for each transfer, and keep your notices, contracts and technical practice aligned.
Disclaimer: This article is for general information and does not constitute legal advice or create a lawyer-client relationship. Laws, regulations and practice change, and individual circumstances differ. Please obtain advice specific to your situation.
Sources and further reading
- Rödl & Partner, “Kazakhstan strengthens personal data regulation” (27 August 2026): roedl.com/en/insights/kazakhstan-personal-data-regulation/
- Baker McKenzie, “Kazakhstan: New Amendments to Personal Data Legislation” (July 2026): bakermckenzie.com/en/insight/publications/2026/07/kazakhstan-new-amendments-to-personal-data-legislation
- EY Kazakhstan, “Personal Data Protection Rules Updated: What Has Actually Changed” (July 2026): ey.com/en_kz/technical/tax-alerts/2026/07/personal-data-protection-rules-updated-kazakhstan-2026
- American Chamber of Commerce in Kazakhstan, “Data Localization Requirements and Proposed Amendments” issue brief (15 May 2026): amcham.kz/wp-content/uploads/2026/05/2026-05-15_AmCham_DataLocalization_Issue-Brief_ENG_v5.pdf
- DLA Piper, “Data Protection Laws of the World: Kazakhstan” (transfer of personal data): dlapiperdataprotection.com
- Thomson Reuters Practical Law, “Data Protection in Kazakhstan: Overview”: morganlewis.com (republished Q&A)
- Bond Stone, “Data Localisation in Kazakhstan”: bondstonelaw.com/data-localisation-in-kazakhstan/
- Chambers, “Kazakhstan: A Pioneer in Artificial Intelligence Regulation” (AIFC cross-border data discussion): chambers.com
- Esplora Legal, “Kazakhstan’s Data Localization Rules Explained for Multinationals”: esploralegal.com/kazakhstans-data-localization-rules-explained-for-multinationals/
- Law on Personal Data and Its Protection No. 94-V (2013) as amended; Digital Code No. 255-VIII (2026); Laws No. 256-VIII and 326-VIII (2026); India’s Digital Personal Data Protection Act, 2023 and Rules, 2025
