KazakhstanLaw on Personal Data and Their Protection, data subject rights
Law No. 94-V (21 May 2013), Art. 24; Art. 8(7); Art. 19-1
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 November 2013, effective 17 January 2026.
A data subject rights rule binding public and private bodies.
As of 29 August 2026.
What it requires
- An app must let a Kazakhstani data subject learn what personal data is held about them and how it is processed, correct or supplement it, demand it be blocked or destroyed where processing was unlawful, and withdraw consent, including specifically for a cross-border or third-party transfer, within the Law's three and fifteen working day response windows.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Art. 24 gives the subject the right to know about and obtain information on processing, demand correction or supplementation, demand blocking where a violation is alleged, demand destruction where a violation is confirmed, withdraw consent (including specifically for a cross-border or third-party transfer), consent or withdraw consent to public-source distribution, and seek protection of rights and compensation for moral and material damage.
Art. 24 was reworded by Law No. 96-VII (30 December 2021, in force 1 March 2022); the version quoted here is that current text, not the Act's original 2013 wording.
Separately, Art. 8(7) requires the owner or operator to stop processing personal data within fifteen working days of a subject withdrawing consent, or to give a reasoned refusal, a duty carried by Article 8 since before its most recent 2025 and 2026 amendments, though which of Article 8's five stacked amending laws last touched paragraph 7 specifically is not established.
A newer right was added by Law No. 231-VIII (17 November 2025, in force 17 January 2026) at new Art. 19-1: a subject may object to automated processing of their personal data, and the owner, operator, or third party must consider the objection and respond within three working days. This is the automated-decision-objection right this batch's Israel page records as unconfirmed either way; Kazakhstan now has one.
When LexLint raises it
crawls_webtrains_models
Read the law
official statute text, Adilet Legal Information System, consolidated English translation
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.