Processes personal data, in Kazakhstan

Law No. 94-V (21 May 2013), Art. 22 · Read the law's page

• Take the protection measures Article 22 of Kazakhstan's Law on Personal Data and Their Protection requires of an owner or operator of personal data, including the registration and recording of the actions that a consent states under Article 8(4)(3) to (6), and the timely detection of unauthorized access to the data.

Law No. 94-V (21 May 2013), Art. 24; Art. 8(7); Art. 19-1 · Read the law's page

• An app must let a Kazakhstani data subject learn what personal data is held about them and how it is processed, correct or supplement it, demand it be blocked, anonymized, destroyed or deleted where processing was unlawful, and withdraw consent, including specifically for a cross-border or third-party transfer, within the Law's three and fifteen working day response windows.

Law No. 94-V (21 May 2013), Art. 25(2) · Read the law's page

• An app that suffers a personal data security breach involving Kazakhstani data subjects must notify the competent authority within one business day from the moment the breach is detected, naming the contact details of the person responsible for organizing personal data processing where one exists. The Law runs this notice to the competent authority, not to the affected individuals.

Law No. 94-V (21 May 2013), Arts. 12(2), 16 · Read the law's page

• An app storing or processing the personal data of individuals in Kazakhstan, including a voiceprint or other biometric identifier, must keep it in a database and/or digital storage facility located within Kazakhstan; Kazakhstani law does not on its own text forbid an additional copy abroad. Transferring that data to another country requires that the destination state ensure equivalent protection, or one of four fallback grounds: the subject's consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained.

Law No. 94-V (21 May 2013), Arts. 6, 7(12), 11(3), 12(2) · Read the law's page

• An app is not exempt from Kazakhstan's Law on Personal Data merely because biometric data has no dedicated definition in the Act. Collecting biometric data in a public place for identification purposes is restricted to constitutional-order, public-order, rights, health, or morality grounds unless the subject consents, and biometric data stored on Kazakhstani subjects must sit in a database and/or digital storage facility located inside Kazakhstan like any other personal data. Confidentiality of biometric data specifically is deferred to other Kazakh legislation, which the Act does not name and which is not identified here.

Law No. 94-V (21 May 2013), as amended through Law No. 350-VIII (14.07.2026), Arts. 1, 4-9, 10-1 · Read the law's page

• An app that collects, uses, or discloses the personal data of individuals in Kazakhstan must obtain the subject's consent, or rely on one of the Law's limited consent-free grounds, before processing, and must confine that processing to the stated purpose of collection.
• A data owner, operator or third party that is classed as large under Article 25-1 (500,000 or more unique data subjects, a class that rises by one level where restricted-access personal data is processed) must notify the competent authority before it begins processing personal data in Kazakhstan and again before it stops.

Code of the Republic of Kazakhstan on Administrative Offences No. 235-V (2014), Art. 79 · Read the law's page

• An app processing Kazakhstani personal data may be investigated by the Ministry of Artificial Intelligence and Digital Development's Committee for Information Security and fined under Code of Administrative Offences Art. 79 for unlawful collection or processing, separately from the Personal Data Law itself. An individual harmed may also seek compensation for moral and material damage under Art. 24(1)(7), though this is not framed as a dedicated statutory cause of action.

Criminal Code of the Republic of Kazakhstan No. 226-V (3 July 2014), Art. 147 · Read the law's page

• An app that collects, processes or discloses the personal data of individuals in Kazakhstan faces criminal liability under Criminal Code Art. 147 where it fails to take the personal data protection measures it is bound to take and that failure causes significant harm to a person's rights and legitimate interests, where it unlawfully collects information on a person's private life without consent, or where it unlawfully disseminates such information. The penalties run from fines to imprisonment of up to seven years, and the Code of Administrative Offences Art. 79 fines apply only where the act carries no signs of a criminal offense.

Digital Code No. 255-VIII (9 January 2026), Arts. 37(4)-(6), 41 · Read the law's page

• An app that holds or processes the personal data of individuals in Kazakhstan must, when a data subject demands it, delete, anonymize or restrict the processing of that data, as the personal data legislation provides, unless a listed ground such as protecting the life, health or rights of third persons, a legal proceeding or a public interest set by law requires keeping it. A data subject also has the right of access to the data, control over it, and information on the purposes, legal bases and methods of its processing.

Digital Code No. 255-VIII (9 January 2026), Arts. 20, 97-98 · Read the law's page

• Protect the confidentiality, integrity and availability of every digital object you own or hold in Kazakhstan, a category that expressly includes software you make available to others.
• Implement technical measures, including cryptographic protection where applicable, together with organizational and legal measures, aimed at preventing, detecting and eliminating cyber threats to that digital object.
• Also follow the specific requirements set by the Law of the Republic of Kazakhstan "On Cybersecurity" and the unified digitalization and cybersecurity requirements adopted under it; their own specific duties are not further detailed here.

Code of the Republic of Kazakhstan on Public Health and Healthcare System No. 360-VI (7 July 2020), Art. 273 · Read the law's page

• An app or service that holds personal medical data, information on a person's seeking of medical advice, state of health or diagnosis obtained during examination or treatment must treat it as secrecy of a medical worker and must not disclose it, where the data became known to the app's staff in training, in professional duties or in other official obligations.
• Disclose that data for research or use in teaching only with the informed consent of the patient or the patient's legal representative, and otherwise only in a case Article 273(4) lists, such as a request from the bodies of inquiry and preliminary investigation, the prosecutor or a court in an investigation or judicial proceeding.
• Do not connect an electronic information resource that holds personal medical data to a telecommunication network linking it to other databases without the consent of the natural persons concerned, except in the cases Article 273(6) lists.

Law of the Republic of Kazakhstan on Credit Bureaus and Formation of Credit Histories No. 573 (6 July 2004), Arts. 17, 21 and 22 · Read the law's page

• A credit bureau must give the subject of a credit history a credit report about the subject once in a calendar year free of charge, and free information about the subject's own credit scoring, and must give a credit report to a recipient only on confirmation of the subject's consent, except in the case Article 25(4) provides.
• A credit bureau must submit a corrected credit report to the recipient and to the subject within five calendar days of detecting that a report it gave out differed from what the information providers sent it, and on the subject's application must name the information provider that supplied contested information.
• An information provider must consider a subject's application to correct unreliable information, which Article 22(7) allows the subject to make.

Law of the Republic of Kazakhstan on Credit Bureaus and Formation of Credit Histories No. 573 (6 July 2004), Arts. 6(3), 8, 8-1, 11 and 17(1)(3) · Read the law's page

• A credit bureau may operate only with the permission of the authorized body, and a credit bureau with state participation is the exception (Article 8-1(4) and (5); Article 6(3)).
• Provide technical premises and certified hardware and software for the credit history database, and a secondary server located outside the city where the credit bureau is located, for backup copies of the information (Article 8).
• Prevent disclosure of information contained in credit histories, including information constituting bank secrecy, except in the cases the Law states (Article 17(1)(3)).
• Notify the authorized body of the measures taken under its written instruction within the time the instruction sets, a credit bureau being open to the sanctions of an administrative fine and suspension of permission validity (Article 11(1-3) and (2)).