KazakhstanLaw on Personal Data and Their Protection, data subject rights
Law No. 94-V (), Art. 24; Art. 8(7); Art. 19-1
In force since , effective .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app must let a Kazakhstani data subject learn what personal data is held about them and how it is processed, correct or supplement it, demand it be blocked, anonymized, destroyed or deleted where processing was unlawful, and withdraw consent, including specifically for a cross-border or third-party transfer, within the Law's three and fifteen working day response windows.
These lines are LexLint's reading of the law's text. Also read by: Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, the competent authority for personal data protection: Rules for the Collection and Processing of Personal Data, approved by Order No. 395/NK of under Article 27-1(1)(7) of the Law (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://adilet.zan.kz/rus/docs/V2000021498
- Guidance body
- Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, the competent authority for personal data protection: Rules for the Collection and Processing of Personal Data, approved by Order No. 395/NK of under Article 27-1(1)(7) of the Law
- Open questions
- Does "not executed obligation" in Article 8(2), which bars withdrawal of consent, reach any debt or contractual duty the subject owes the owner or operator (for example an unpaid subscription), or only an obligation that a law of the Republic of Kazakhstan imposes?
- Does a human review of an automated output, after the processing itself ran without the owner or operator taking part, take a decision outside the ban in Article 19-1(1) on automated processing "as a result of which the subject has, changes or terminates the rights, legitimate interests"?
What it makes you log
Logging duty
Article 24 lists the subject's rights, Article 8(7) requires processing to stop within fifteen working days of a withdrawal of consent or a reasoned refusal, and Article 19-1 requires an owner or operator to explain automated processing, allow objection and answer an objection within three working days. These are duties to respond and to act. None states a duty to create, keep or produce a log or record. The cited sections carry no territorial scope clause.
- Kind
- None
- As of
What this law does
Art. 24 gives the subject the right to know about and obtain information on processing, demand correction or supplementation, demand blocking and/or anonymization where a violation is alleged, demand destruction or deletion where a violation is confirmed, withdraw consent (including specifically for a cross-border or third-party transfer), consent or withdraw consent to public-source distribution, and seek protection of rights and compensation for moral and material damage.
Art. 24 was reworded by Law No. 96-VII (, in force ) and amended again by Law No. 326-VIII of ; the version quoted here is that current text, not the Act's original 2013 wording. Separately, Art. 8(7) requires the owner or operator to stop processing personal data within fifteen working days of a subject withdrawing consent, or to give a reasoned refusal, a duty carried by Article 8 since before its most recent 2025 and 2026 amendments.
A newer right was added by Law No. 231-VIII (, in force ) at new Art. 19-1: a subject may object to automated processing of their personal data, and the owner, operator, or third party must consider the objection and respond within three working days. This is the automated-decision-objection right this batch's Israel page records as unconfirmed either way; Kazakhstan now has one.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .