Kazakhstan

Law No. 232-VIII inserted Article 641-1 into the Code of Administrative Offences the same day it adopted the AI Law itself, giving that Law's disclosure and risk-management duties an administrative penalty. Article 641-1(1) makes it a violation for the owner or holder of an AI system to fail to ensure users are informed of synthetic output of the system capable of misleading them, or to fail to carry out risk management of the AI system.

The fine schedule tiers by the size of the violator: fifty monthly calculation indices for a small business or non-profit organisation, seventy for a medium-sized business, and two hundred for a large business, together with suspension or prohibition of the AI system's operation. A companion Article 692-3 gives the authorised body in the sphere of artificial intelligence, the Ministry of Artificial Intelligence and Digital Development, jurisdiction to hear these cases.

Article 17(3) bans creating or operating an AI system that has any of seven functional capabilities: using subconscious, manipulative or other methods that distort a person's behaviour and impair their ability to make an informed decision, or coerce a decision that could cause or threaten harm; exploiting a person's moral or physical vulnerability arising from age, disability, social position or other circumstance to cause or threaten harm; evaluating or classifying people over time by their social behaviour or known, presumed or predicted personal traits, except where a Kazakhstani law provides for it; collecting or processing personal data in violation of Kazakhstan's personal-data legislation; classifying people by biometric data to infer race, political views, religious affiliation or other criteria for the purpose of discrimination; determining a person's emotions without their consent, except where a Kazakhstani law provides for it; and creating or distributing AI-generated output that Kazakhstani law bans.

Article 23(1)-(2) protects a work created using an AI system by copyright only where there is a human creative contribution to its creation, and recognises a text prompt sent to an AI system as a copyright object where it is itself the result of a person's intellectual creative activity.

Article 23(3) states that using a work to train an AI model does not fall within copyright law's free-use exceptions for educational or scientific purposes, and Article 23(4) states that training does not itself amount to exercising the author's reproduction, distribution, adaptation, public display, performance, broadcast or cable-communication rights.

Article 23(5) then permits using a work to train an AI model only where the author or rightsholder has not expressed a prohibition in machine-readable form, an opt-out condition on top of the two preceding paragraphs.

Article 43 defines an algorithmic system as a digital system that makes, or influences the making of, a decision based on automated data processing, including an AI system, and states that decisions made using an algorithmic system must not result in discrimination on grounds Kazakhstani law sets out.

Where a decision is made entirely without human involvement in assessing the circumstances or approving the outcome, in cases provided for by law or agreement, the subject of that decision has the right, in cases and in the manner the legislation sets, to learn that an algorithmic system was used, to obtain an explanation of the key factors and criteria that influenced the decision without disclosure of the algorithm, source code, or legally protected secrets, and to demand review of the decision by an authorised specialist where the decision carries legal consequences or is capable of affecting the person's rights and legitimate interests.

Article 7 requires that users be given full information about an AI system's operational characteristics and limitations so it is used for its intended purpose, and gives a user subject to a decision made with an AI system the right to be informed of the automated processing and its consequences, the possibility of objecting to it, and how to protect their rights.

Article 21 requires users to be informed that goods, works or services are produced or provided using an AI system, and permits distributing synthetic output only where it carries a machine-readable label and a visual or other warning that a user can perceive without methods that impede that perception; responsibility for informing users about synthetic output rests on the system's owner or holder.

The Act has no dedicated special-category article and never defines biometric data as a term; it regulates biometric processing through four scattered clauses instead.

Art. 7(12) restricts collecting biometric data in public places to constitutional-order, public-order, rights, health, or morality purposes unless the subject consents; this clause was reworded by Law No. 96-VII (30 December 2021, in force 2 March 2022), so the currently quoted text has been in effect since that date, not since the Act's 2013 commencement.

Art. 11(3) defers biometric confidentiality entirely to other Kazakh legislation, which it does not name, and carries no amendment footnote of its own, so it has stood unchanged since the base Act's 25 November 2013 commencement.

Art. 12(2)'s domestic-storage duty applies to biometric data as ordinary personal data; that duty was itself introduced by Law No. 419-V, in force 1 January 2016, with no biometric-specific carve-out or heightening found; Law No. 326-VIII of 24 June 2026 now words it as storage in a database and/or digital storage facility located within the territory of Kazakhstan.

Art. 6, as amended by Law No. 326-VIII, lists the data owner's facial biometric vector or its derivatives, and an image of the face, among the personal data identifiers used to identify a subject. The only biometric modality the Act names is the face, at Article 6.

Article 25(2)(8) requires the owner or operator, within one business day from the moment a personal data security breach is detected, to notify the competent authority, naming the contact details of the person responsible for organizing personal data processing where one exists.

The one-business-day deadline is stated in the lead-in to the list in which the sub-paragraph sits, and the competent authority's Rules for Notifying Data Subjects of a Personal Data Security Breach (Order No. 481/NK of 9 August 2024, as reworded by Order No. 232/NK of 30 April 2026) repeat it in paragraph 4, under which the owner or operator notifies the competent authority within one working day of detecting the breach.

Article 25(2)(8) names the competent authority as the recipient of the breach notice. Under paragraph 7 of the Rules, the "digital government" operator, not the owner or operator, notifies the affected data subjects, on information it receives from the competent authority. A distinct Article 19(1) duty to notify the subject of a transfer of their data to a third person within ten business days should not be confused with a breach notice.

Law No. 326-VIII of 24 June 2026 supplemented the Law with Article 23-2, a register of personal data security breaches that the authorized body keeps from publicly available sources and from the cybersecurity operations centers and incident-response services, and Article 1(15-2) now defines a personal data breach. The Law of 11 December 2023 numbered 44-VIII added the breach-notice clause to Article 25(2)(8), by sub-paragraph 4 of paragraph 11 of its Article 1.

Article 2 of that Law brings that sub-paragraph into force from 1 July 2024, an exception to its general rule of sixty calendar days after first official publication. Article 25 has been amended four times since the base Act's 2013 commencement, most recently by Law No. 326-VIII; the amendment before it, Law No. 44-VIII, states its own effective date directly in the base Act's footnote rather than by a from-publication formula.

Law No. 94-V is Kazakhstan's single personal-data statute, reaching the owner, operator, and third party generally with no separate public and private carve-out. Art. 8 requires the subject's written or otherwise confirmable consent for processing, subject to Art. 9's consent-free grounds (law enforcement, court proceedings, state statistics, and others), and confines processing to the stated purpose of collection.

The Law was adopted 21 May 2013, officially published 25 May 2013, and entered into force 25 November 2013 (Art. 31(1), six months after first official publication); Arts. 8 and 9 have each been amended multiple times since, without displacing the base consent framework this instrument describes.

Law No. 326-VIII of 24 June 2026, which takes effect sixty calendar days after its first official publication, supplemented the Law with Article 10-1, under which a data owner, operator or third party must notify the competent authority before it begins processing personal data and again before it stops, except where it is classed as small or medium-sized.

Article 25-1 sets those classes by the number of unique data subjects: no more than 10,000 is small, 10,000 to 500,000 is medium and 500,000 or more is large, and a class rises by one level where restricted-access personal data is processed.

Article 7(3-1) provides that where a subject or the subject's representative has made personal data public without giving a data owner, operator or third party the consent that paragraph 3 requires, each person who later collects, disseminates or otherwise processes that data must confirm the lawfulness of doing so.

Article 9 now also allows processing without consent to transfer immigrants' personal data to the central database of immigrants (sub-paragraph 9-5), and, under Law No. 311-VIII of 12 June 2026, from 1 January 2027 to identify conflicts of interest under the anti-corruption legislation and maintain the digital human resources system (sub-paragraph 9-6).

Law No. 350-VIII of 14 July 2026 added a further ground at Article 9, sub-paragraph 9-7, for the functions of the housing construction savings bank that holds the status of a national development institution.

Article 22(1) requires the owner and operator, and any third party, to implement the measures the law and the competent authority's procedure require to protect personal data, ensuring the prevention of unauthorized access and the timely detection of unauthorized access that could not be prevented. Article 22(1)(5) adds the registration and recording of the actions under Article 8(4)(3) to (6).

Those are the particulars that a consent must state: its term or period, whether the owner or operator may transfer the data to third parties, whether the data crosses borders, and whether the owner or operator may disseminate it in publicly available sources.

Article 22(1)(4) also has the owner and operator grant the state technical service access to digital objects that hold restricted-access personal data, so that it can audit the security of the processes for storing, processing and disseminating that data. The protection obligations arise when the personal data is collected and remain in force until it is destroyed, deleted, anonymised or depersonalised.

Article 22 has been amended by Law No. 399-VI of 2 January 2021, Law No. 96-VII of 30 December 2021, Law No. 223-VII of 19 April 2023, Law No. 256-VIII of 9 January 2026 and Law No. 326-VIII of 24 June 2026, and its footnote does not say which of them added sub-paragraph (5).

Art. 12(2) requires Kazakhstani personal data to be stored in a database and/or digital storage facility located inside Kazakhstan, unqualified by citizenship and not framed as forbidding an additional copy abroad; it answers where data is stored, not whether it may also leave the country.

This storage duty was introduced by Law No. 419-V, in force 1 January 2016, and Law No. 326-VIII of 24 June 2026 amended Article 12 again; Art. 12(2) did not exist in this form at the base Act's 2013 commencement.

Art. 16 answers the leaving-the-country question separately, and its general permitted-transfer grounds (paragraphs 1-4: an adequacy-equivalent destination, or one of four fallback grounds, subject consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained) stand in the current text, with one amendment footnote to Art. 16, Law No. 128-VI of 28 December 2017; a sector law may impose a harder bar than the general Law does.

Article 41(1) of the Digital Code lets a person whose personal data is placed or processed in the digital environment require its deletion, anonymization or restriction of processing, whatever the basis on which it was obtained, except in cases the laws of Kazakhstan provide. Article 41(2) obliges the owner of a digital object, or another person who processes personal data, to meet that demand in the manner the personal data legislation sets.

Article 37(4) adds that a data subject has the right to access, control, delete and restrict the processing of the digital data and to receive information on the purposes, legal bases and methods of processing. Article 41(4) lists the grounds on which a demand need not be met, among them protection of the life, health, rights and legitimate interests of third persons. The Code entered into force on 10 July 2026, six months after its first official publication on 10 January 2026 (Art. 106).

Art. 24 gives the subject the right to know about and obtain information on processing, demand correction or supplementation, demand blocking and/or anonymization where a violation is alleged, demand destruction or deletion where a violation is confirmed, withdraw consent (including specifically for a cross-border or third-party transfer), consent or withdraw consent to public-source distribution, and seek protection of rights and compensation for moral and material damage.

Art. 24 was reworded by Law No. 96-VII (30 December 2021, in force 2 March 2022) and amended again by Law No. 326-VIII of 24 June 2026; the version quoted here is that current text, not the Act's original 2013 wording. Separately, Art. 8(7) requires the owner or operator to stop processing personal data within fifteen working days of a subject withdrawing consent, or to give a reasoned refusal, a duty carried by Article 8 since before its most recent 2025 and 2026 amendments.

A newer right was added by Law No. 231-VIII (17 November 2025, in force 18 January 2026) at new Art. 19-1: a subject may object to automated processing of their personal data, and the owner, operator, or third party must consider the objection and respond within three working days. This is the automated-decision-objection right this batch's Israel page records as unconfirmed either way; Kazakhstan now has one.

Art. 79 of the Code of Administrative Offences, not the Personal Data Law itself, sets the fine schedule for a breach of Kazakhstan's personal-data legislation, starting at thirty monthly calculation indices for individuals for illegal collection or processing of personal data and scaling up by entity type. The Code was adopted 5 July 2014 and entered into force 1 January 2015 (Art. 920).

Article 79's fine schedule has since been amended four times; the most recent, Law No. 155-VIII, raised the amounts and took effect 12 March 2025. The Ministry of Artificial Intelligence and Digital Development (formed 28 September 2025) and its Committee for Information Security are the competent authority; the Personal Data Law creates no private right of action and instead gives the subject a general civil-damages right at Art. 24(1)(7). A separate AI-specific fine article and a Criminal Code backstop also exist.

Article 147(1) of the Criminal Code punishes non-compliance with personal data protection measures by a person bound to take them, where it causes significant harm to the rights and legitimate interests of persons, with a fine of up to three thousand monthly calculation indices or a restriction or deprivation of liberty.

Article 147(2) punishes illegal collection of information on a person's private life without consent, or illegal collection or processing of other personal data that causes significant harm, with a fine of up to five thousand monthly calculation indices or a restriction or deprivation of liberty. Article 147(4) punishes illegal dissemination of such information or data with imprisonment of three to six years. The Code is in force from 1 January 2015 (Art. 467).

Article 207(1) punishes intentional acts or omissions directed at disrupting the operation of an informatization object, with a fine up to 2,000 monthly calculation indices, correctional labour of the same amount, public works up to 600 hours, restriction of freedom up to 2 years, or imprisonment for the same term, plus an optional bar of up to 2 years from holding certain positions.

Article 207(2) raises the penalty where the target is critically important information and communication infrastructure, Article 207(2-1) raises it further for repeat or pre-arranged group commission, and Article 207(3) reaches 5 to 10 years' imprisonment where the act under any of the preceding paragraphs is committed by an organized criminal group or causes grave consequences. The article's heading was reworded by Law No. 210-VIII (16 July 2025).

Article 205(1) punishes intentional unauthorized access to legally protected information held on an electronic medium, at an informatization object, that causes significant harm, with a fine up to 160 monthly calculation indices, correctional labour of the same amount, public works up to 160 hours, or arrest up to 40 days, plus an optional bar of up to 2 years from holding certain positions or engaging in certain activities.

Article 205(2) raises the penalty where the target is critically important information and communication infrastructure, and Article 205(3) raises it further where the act, under either paragraph, causes grave consequences through negligence, reaching a fine up to 2,000 monthly calculation indices or imprisonment up to 2 years.

The offence's trigger is unauthorized access to protected information causing significant harm; the text read does not require defeating a technical security measure, so it reaches unauthorized access more broadly than a security-circumvention-only standard would. The article's heading was reworded by Law No. 210-VIII (16 July 2025).

Article 211(1) punishes unlawfully distributing electronic information resources containing citizens' personal data, or other information to which access is restricted by Kazakhstani law or by the resource's owner or holder, with a fine up to 200 monthly calculation indices, correctional labour of the same amount, public works up to 180 hours, or arrest up to 50 days, plus an optional bar of up to 3 years from holding certain positions.

Article 211(2) raises the penalty for pre-arranged group commission, mercenary motive, or commission using one's official position, and Article 211(3) reaches 3 to 7 years' imprisonment where the act under either preceding paragraph is committed by an organized criminal group or causes grave consequences. The offence reaches distributing a restricted-access resource that was already obtained, separately from any unauthorized-access offence under Article 205.

The article was last amended by Law No. 180-VI (12 July 2018); the effective date recorded here is the base Penal Code's own commencement, since a precise commencement date for the 2018 wording was not established within this visit's budget.

Article 7(1) lists the categories of works that are copyright objects, and Article 7(3)(2) extends that protection to compilations, naming encyclopedias, anthologies and databases by way of example, and other compound works that represent, by the selection or arrangement of their materials, the result of creative labour; a derivative or compound work is protected regardless of whether the underlying works it is based on or includes are themselves copyright objects.

The text read confers no sui generis database right distinct from this compilation copyright, so a database whose selection or arrangement is not itself the result of creative labour falls outside Article 7 altogether. Article 7 was most recently touched by Law No. 233-VIII (24 November 2025), a terminology amendment on the text read. No commencement day for the Law has been located.

Law 256-VIII of 9 January 2026 retitled the Law on Informatization as the Law on Cybersecurity. Law 256-VIII was first officially published on 10 January 2026. Law 256-VIII takes effect six months after its first official publication. The owner or holder of a critically important digital object must create its own cybersecurity centre or buy the services of a cybersecurity centre from third parties.

An owner or holder of critically important digital objects that processes data containing a legally protected secret must run a cybersecurity audit at least once a year. Critically important digital objects are among the objects subject to mandatory testing for compliance with cybersecurity requirements. An owner or holder of a critically important object, other than a state body, must within six months of listing take measures to meet the cybersecurity parts of the unified requirements.

Article 97 defines cybersecurity as the state of protection of a digital object, a category Article 20 defines to include software, digital systems, digital platforms and objects of digital infrastructure, against a breach of its confidentiality, integrity or availability, and assigns the duty to protect a digital object to its owner or holder.

Article 98 requires that protection through a combination of technical, organizational and legal measures aimed at preventing, detecting and eliminating cyber threats, naming cryptographic protection as one of the technical means. Article 97(3) directs the specific content of these measures to the Law of the Republic of Kazakhstan "On Cybersecurity" and to unified digitalization and cybersecurity requirements adopted under it, neither of which is further described here.

The owner or holder of a critically important digital object must notify the National Cybersecurity Coordination Centre and its cybersecurity centre of cybersecurity incidents it detects itself, in the order and time the monitoring rules set. An owner or holder of digital government infrastructure or critically important digital objects must provide for immediately informing the National Cybersecurity Coordination Centre of an incident that has occurred, followed by data on the measures taken.

Article 16 defines information harmful to children as anything prohibited by the Constitution or by this Law, or restricted for children of a given age group by other legislation, and Article 16(2) lists what is prohibited for children outright: incitement to self-harm or suicide, incitement to antisocial or unlawful acts, sexually explicit content, depiction of sexual violence, profanity, content whose distribution to children is banned by other Kazakhstani laws, and content propagandizing non-traditional sexual orientation or paedophilia.

Article 16(3) bars distributing such prohibited-for-children content to minors at all, and where that distribution happens over the Internet requires administrative, technical, software or other means restricting children's access to it. Article 16 was amended in June 2024 and again at the end of December 2025. The provisions this entry describes came into force on different days.

Article 9 requires every item of information production to receive an age classification before distribution in Kazakhstan, assessing theme, genre, content and artistic design, how a child of a given age category is likely to perceive it, and the likelihood of harm to a child's health and development. Article 9(3) sets six categories: "under 6", "from 6", "from 12", "from 14", "from 16", and "from 18" (information containing content prohibited for children).

Article 15 requires the age-category sign to be marked on the product by its distributor, and bars distribution without the sign, subject to a list of exemptions (live news, entertainment and sports broadcasts; general political print periodicals; news and analytical television programmes; radio broadcasting; advertising; and internet resources).

That exemption list itself excludes internet publications and online platforms, so marking on an online platform is not voluntary the way it is for an ordinary internet resource. Article 9 was amended only by Law 289-VI of 26 December 2019. Article 15 was amended in June 2024 and again at the end of December 2025. The sections this entry groups came into force on different days.

Article 19(1) permits, without the author's or rightsholder's consent and without payment but with mandatory attribution of the author and source, quotation in the original or in translation for scientific, research, polemical, critical or informational purposes from lawfully published works, to an extent justified by the purpose of the quotation, including the reproduction of excerpts from newspaper and magazine articles in the form of press reviews.

Article 19(3) separately permits reproducing in newspapers, or communicating by broadcast or cable to the public, lawfully published newspaper or magazine articles on current economic, political, social and religious topics, or broadcast works of the same character, in cases where the author has not specially prohibited such reproduction, broadcast or cable communication, so the exception is an author opt-out rather than an unconditional licence.

Article 19 carries no headline-length or short-extract cap distinct from the fair-practice and purpose-justified tests in its own text. The Article's heading and adjoining provisions were most recently touched by Law No. 233-VIII (24 November 2025), a terminology-only amendment on the text read. No commencement day for the Law has been located.

Article 23(5) of the Law on Artificial Intelligence permits using works, published news articles included, to train an AI model only where the author or rightsholder has not expressed a prohibition in machine-readable form.

The same Article separately states, at Article 23(3), that training does not fall within copyright law's free-use exceptions for educational or scientific purposes, and at Article 23(4) that training a model does not itself amount to exercising the author's reproduction, distribution, adaptation, public display, performance or broadcast rights.

Read together, an aggregator that trains a model on the news content it aggregates needs the absence of a machine-readable rightsholder objection under Article 23(5), separately from whatever licence its underlying reproduction of the articles themselves rests on.