KazakhstanLaw on Personal Data and Their Protection, localization and cross-border transfer
Law No. 94-V (), Arts. 12(2), 16
In force since , effective .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app storing or processing the personal data of individuals in Kazakhstan, including a voiceprint or other biometric identifier, must keep it in a database and/or digital storage facility located within Kazakhstan; Kazakhstani law does not on its own text forbid an additional copy abroad. Transferring that data to another country requires that the destination state ensure equivalent protection, or one of four fallback grounds: the subject's consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Which body decides, and on what criteria, whether a foreign state is one "ensuring of protection of personal data" for the purposes of Article 16(2)?
- Does the exclusion in Article 7(6) of "the cases prescribed by Article 16 of this Law" from the rule that cross-border transfer is subject to the individual's consent cover a transfer to a state that ensures protection under Article 16(2), or only the fallback cases in Article 16(3)?
What it makes you log
Logging duty
Article 12(2) requires personal data to be stored inside Kazakhstan and sets the retention period of the personal data itself by the date its purposes are fulfilled, which limits the data and not a log. Article 16 permits a transfer abroad only to a state that protects personal data or on a listed ground, and states no record duty. The cited sections carry no territorial scope clause: a transfer to the territory of a foreign state is the conduct regulated, not a test for when the Law applies.
- Kind
- None
- As of
What this law does
Art. 12(2) requires Kazakhstani personal data to be stored in a database and/or digital storage facility located inside Kazakhstan, unqualified by citizenship and not framed as forbidding an additional copy abroad; it answers where data is stored, not whether it may also leave the country.
This storage duty was introduced by Law No. 419-V, in force , and Law No. 326-VIII of amended Article 12 again; Art. 12(2) did not exist in this form at the base Act's 2013 commencement.
Art. 16 answers the leaving-the-country question separately, and its general permitted-transfer grounds (paragraphs 1-4: an adequacy-equivalent destination, or one of four fallback grounds, subject consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained) stand in the current text, with one amendment footnote to Art. 16, Law No. 128-VI of ; a sector law may impose a harder bar than the general Law does.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .