KazakhstanLaw on Personal Data and Their Protection, comprehensive regime and lawful bases
Law No. 94-V (), as amended through Law No. 350-VIII (14.07.2026), Arts. 1, 4-9, 10-1
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of individuals in Kazakhstan must obtain the subject's consent, or rely on one of the Law's limited consent-free grounds, before processing, and must confine that processing to the stated purpose of collection.
- A data owner, operator or third party that is classed as large under Article 25-1 (500,000 or more unique data subjects, a class that rises by one level where restricted-access personal data is processed) must notify the competent authority before it begins processing personal data in Kazakhstan and again before it stops.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a data owner, operator or third party that processes the personal data of exactly five hundred thousand unique subjects count as medium ("от десяти тысяч до пятисот тысяч уникальных субъектов", "from ten thousand to five hundred thousand unique subjects"), and so fall within the Article 10-1(2) exemption from notifying the competent authority, or as large ("пятьсот тысяч и более уникальных субъектов персональных данных", "five hundred thousand or more unique subjects of personal data") under Article 25-1(3)?
- Which personal data counts as "персональных данных ограниченного доступа" ("restricted-access personal data") for the one-level rise in category under Article 25-1(3), given that Article 6 describes such data only as data to which access is restricted by the legislation of the Republic of Kazakhstan?
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 8(1) requires consent to be given in writing, through a state or non-state service, or in another manner that enables confirmation of consent, so a controller has to hold something that confirms it. Article 7(3-1) separately puts the duty to confirm the lawfulness of later processing on each person who processes data a subject made public without the required consent. The Article 10-1 notice to the competent authority before processing starts and stops is a filing, not a record the controller keeps. Article 22(1)(5), which requires the registration and recording of actions, and Article 25(2)(5), which requires evidence of consent, lie outside the sections this instrument cites and are left to the rows that cite them.
- Kind
- Implicit
- As of
- Provision
- Article 8(1)
- Trigger
- consent_or_optout
What this law does
Law No. 94-V is Kazakhstan's single personal-data statute, reaching the owner, operator, and third party generally with no separate public and private carve-out. Art. 8 requires the subject's written or otherwise confirmable consent for processing, subject to Art. 9's consent-free grounds (law enforcement, court proceedings, state statistics, and others), and confines processing to the stated purpose of collection.
The Law was adopted , officially published , and entered into force (Art. 31(1), six months after first official publication); Arts. 8 and 9 have each been amended multiple times since, without displacing the base consent framework this instrument describes.
Law No. 326-VIII of , which takes effect sixty calendar days after its first official publication, supplemented the Law with Article 10-1, under which a data owner, operator or third party must notify the competent authority before it begins processing personal data and again before it stops, except where it is classed as small or medium-sized.
Article 25-1 sets those classes by the number of unique data subjects: no more than 10,000 is small, 10,000 to 500,000 is medium and 500,000 or more is large, and a class rises by one level where restricted-access personal data is processed.
Article 7(3-1) provides that where a subject or the subject's representative has made personal data public without giving a data owner, operator or third party the consent that paragraph 3 requires, each person who later collects, disseminates or otherwise processes that data must confirm the lawfulness of doing so.
Article 9 now also allows processing without consent to transfer immigrants' personal data to the central database of immigrants (sub-paragraph 9-5), and, under Law No. 311-VIII of , from to identify conflicts of interest under the anti-corruption legislation and maintain the digital human resources system (sub-paragraph 9-6).
Law No. 350-VIII of added a further ground at Article 9, sub-paragraph 9-7, for the functions of the housing construction savings bank that holds the status of a national development institution.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .