Kazakhstan

Law No. 232-VIII inserted Article 641-1 into the Code of Administrative Offences the same day it adopted the AI Law itself, giving that Law's disclosure and risk-management duties an administrative penalty. Article 641-1(1) makes it a violation for the owner or holder of an AI system to fail to ensure users are informed of synthetic output of the system capable of misleading them, or to fail to carry out risk management of the AI system.

The fine schedule tiers by the size of the violator: fifty monthly calculation indices for a small business or non-profit organisation, seventy for a medium-sized business, and two hundred for a large business, together with suspension or prohibition of the AI system's operation. A companion Article 692-3 gives the authorised body in the sphere of artificial intelligence, the Ministry of Artificial Intelligence and Digital Development, jurisdiction to hear these cases.

Article 17(3) bans creating or operating an AI system that has any of seven functional capabilities: using subconscious, manipulative or other methods that distort a person's behaviour and impair their ability to make an informed decision, or coerce a decision that could cause or threaten harm; exploiting a person's moral or physical vulnerability arising from age, disability, social position or other circumstance to cause or threaten harm; evaluating or classifying people over time by their social behaviour or known, presumed or predicted personal traits, except where a Kazakhstani law provides for it; collecting or processing personal data in violation of Kazakhstan's personal-data legislation; classifying people by biometric data to infer race, political views, religious affiliation or other criteria for the purpose of discrimination; determining a person's emotions without their consent, except where a Kazakhstani law provides for it; and creating or distributing AI-generated output that Kazakhstani law bans.

Article 23(1)-(2) protects a work created using an AI system by copyright only where there is a human creative contribution to its creation, and recognises a text prompt sent to an AI system as a copyright object where it is itself the result of a person's intellectual creative activity.

Article 23(3) states that using a work to train an AI model does not fall within copyright law's free-use exceptions for educational or scientific purposes, and Article 23(4) states that training does not itself amount to exercising the author's reproduction, distribution, adaptation, public display, performance, broadcast or cable-communication rights.

Article 23(5) then permits using a work to train an AI model only where the author or rightsholder has not expressed a prohibition in machine-readable form, an opt-out condition on top of the two preceding paragraphs.

Article 7 requires that users be given full information about an AI system's operational characteristics and limitations so it is used for its intended purpose, and gives a user subject to a decision made with an AI system the right to be informed of the automated processing and its consequences, the possibility of objecting to it, and how to protect their rights.

Article 21 requires users to be informed that goods, works or services are produced or provided using an AI system, and permits distributing synthetic output only where it carries a machine-readable label and a visual or other warning that a user can perceive without methods that impede that perception; responsibility for informing users about synthetic output rests on the system's owner or holder.

The Act has no dedicated special-category article and never defines biometric data as a term; it regulates biometric processing through three scattered clauses instead.

Art. 7(12) restricts collecting biometric data in public places to constitutional-order, public-order, rights, health, or morality purposes unless the subject consents; this clause was reworded by Law No. 96-VII (30 December 2021, in force 1 March 2022), so the currently quoted text has been in effect since that date, not since the Act's 2013 commencement.

Art. 11(3) defers biometric confidentiality entirely to other Kazakh legislation, which it does not name and which is not identified here, and carries no amendment footnote of its own, so it has stood unchanged since the base Act's 25 November 2013 commencement. Art. 12(2)'s domestic-storage duty applies to biometric data as ordinary personal data; that duty was itself introduced by Law No. 419-V, in force 1 January 2016, with no biometric-specific carve-out or heightening found. No modality (face, voice, fingerprint) is named anywhere in the Act.

Art. 25(2)(8) requires the owner or operator, from the moment a personal data security breach is detected, to notify the competent authority, naming the contact details of the person responsible for organizing personal data processing where one exists.

No numeric deadline for that notice was found in the text read, and no separate duty to notify the affected data subject of the breach itself was found; a distinct Art. 24(1)(5) duty to notify the subject of a third-party transfer of their data should not be confused with a breach notice.

Article 25 has been amended three times since the base Act's 2013 commencement; a fixed commencement date is confirmed only for the most recent amendment, Law No. 44-VIII, which states its own effective date directly in the base Act's footnote rather than by a from-publication formula.

Law No. 94-V is Kazakhstan's single personal-data statute, reaching the owner, operator, and third party generally with no separate public and private carve-out found in the text read. Art. 8 requires the subject's written or otherwise confirmable consent for processing, subject to Art. 9's consent-free grounds (law enforcement, court proceedings, state statistics, and others), and confines processing to the stated purpose of collection.

The Law was adopted 21 May 2013, officially published 25 May 2013, and entered into force 25 November 2013 (Art. 31(1), six months after first official publication); Arts. 8 and 9 have each been amended multiple times since, most recently in 2025 and 2026, without displacing the base consent framework this instrument describes.

Art. 12(2) requires a database of Kazakhstani personal data to be located inside Kazakhstan, unqualified by citizenship and, on the text read, not framed as forbidding an additional copy abroad; it answers where data is stored, not whether it may also leave the country. This storage duty was introduced by Law No. 419-V, in force 1 January 2016; Art. 12(2) did not exist in this form at the base Act's 2013 commencement.

Art. 16 answers the leaving-the-country question separately, and its general permitted-transfer grounds (paragraphs 1-4: an adequacy-equivalent destination, or one of four fallback grounds, subject consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained) are original 2013 text, unamended since the base Act's commencement; a sector law may impose a harder bar than the general Law does.

Art. 24 gives the subject the right to know about and obtain information on processing, demand correction or supplementation, demand blocking where a violation is alleged, demand destruction where a violation is confirmed, withdraw consent (including specifically for a cross-border or third-party transfer), consent or withdraw consent to public-source distribution, and seek protection of rights and compensation for moral and material damage.

Art. 24 was reworded by Law No. 96-VII (30 December 2021, in force 1 March 2022); the version quoted here is that current text, not the Act's original 2013 wording.

Separately, Art. 8(7) requires the owner or operator to stop processing personal data within fifteen working days of a subject withdrawing consent, or to give a reasoned refusal, a duty carried by Article 8 since before its most recent 2025 and 2026 amendments, though which of Article 8's five stacked amending laws last touched paragraph 7 specifically is not established.

A newer right was added by Law No. 231-VIII (17 November 2025, in force 17 January 2026) at new Art. 19-1: a subject may object to automated processing of their personal data, and the owner, operator, or third party must consider the objection and respond within three working days. This is the automated-decision-objection right this batch's Israel page records as unconfirmed either way; Kazakhstan now has one.

Art. 79 of the Code of Administrative Offences, not the Personal Data Law itself, sets the fine schedule for a breach of Kazakhstan's personal-data legislation, starting at thirty monthly calculation indices for individuals for illegal collection or processing of personal data and scaling up by entity type. The Code was adopted 5 July 2014 and entered into force 1 January 2015 (Art. 920).

Article 79's fine schedule has since been amended four times; the most recent, Law No. 155-VIII, raised the amounts and took effect 12 March 2025. The Ministry of Artificial Intelligence and Digital Development (formed 28 September 2025) and its Committee for Information Security are the competent authority; no private right of action was found in the Personal Data Law, which instead gives the subject a general civil-damages right at Art. 24(1)(7). A separate AI-specific fine article and a Criminal Code backstop are not recorded here.

Article 207(1) punishes intentional acts or omissions directed at disrupting the operation of an informatization object, with a fine up to 2,000 monthly calculation indices, correctional labour of the same amount, public works up to 600 hours, restriction of freedom up to 2 years, or imprisonment for the same term, plus an optional bar of up to 2 years from holding certain positions.

Article 207(2) raises the penalty where the target is critically important information and communication infrastructure, Article 207(2-1) raises it further for repeat or pre-arranged group commission, and Article 207(3) reaches 5 to 10 years' imprisonment where the act under any of the preceding paragraphs is committed by an organized criminal group or causes grave consequences. The article's heading was reworded by Law No. 210-VIII (16 July 2025).

Article 205(1) punishes intentional unauthorized access to legally protected information held on an electronic medium, at an informatization object, that causes significant harm, with a fine up to 160 monthly calculation indices, correctional labour of the same amount, public works up to 160 hours, or arrest up to 40 days, plus an optional bar of up to 2 years from holding certain positions or engaging in certain activities.

Article 205(2) raises the penalty where the target is critically important information and communication infrastructure, and Article 205(3) raises it further where the act, under either paragraph, causes grave consequences through negligence, reaching a fine up to 2,000 monthly calculation indices or imprisonment up to 2 years.

The offence's trigger is unauthorized access to protected information causing significant harm; the text read does not require defeating a technical security measure, so it reaches unauthorized access more broadly than a security-circumvention-only standard would. The article's heading was reworded by Law No. 210-VIII (16 July 2025).

Article 211(1) punishes unlawfully distributing electronic information resources containing citizens' personal data, or other information to which access is restricted by Kazakhstani law or by the resource's owner or holder, with a fine up to 200 monthly calculation indices, correctional labour of the same amount, public works up to 180 hours, or arrest up to 50 days, plus an optional bar of up to 3 years from holding certain positions.

Article 211(2) raises the penalty for pre-arranged group commission, mercenary motive, or commission using one's official position, and Article 211(3) reaches 3 to 7 years' imprisonment where the act under either preceding paragraph is committed by an organized criminal group or causes grave consequences. The offence reaches distributing a restricted-access resource that was already obtained, separately from any unauthorized-access offence under Article 205.

The article was last amended by Law No. 180-VI (12 July 2018); the effective date recorded here is the base Penal Code's own commencement, since a precise commencement date for the 2018 wording was not established within this visit's budget.

Article 7(1) lists the categories of works that are copyright objects, and Article 7(3)(2) extends that protection to compilations, naming encyclopedias, anthologies and databases by way of example, and other compound works that represent, by the selection or arrangement of their materials, the result of creative labour; a derivative or compound work is protected regardless of whether the underlying works it is based on or includes are themselves copyright objects.

The text read confers no sui generis database right distinct from this compilation copyright, so a database whose selection or arrangement is not itself the result of creative labour falls outside Article 7 altogether. Article 7 was most recently touched by Law No. 233-VIII (24 November 2025), a terminology amendment on the text read.

Article 16 defines information harmful to children as anything prohibited by the Constitution or by this Law, or restricted for children of a given age group by other legislation, and Article 16(2) lists what is prohibited for children outright: incitement to self-harm or suicide, incitement to antisocial or unlawful acts, sexually explicit content, depiction of sexual violence, profanity, content whose distribution to children is banned by other Kazakhstani laws, and content propagandizing non-traditional sexual orientation or paedophilia.

Article 16(3) bars distributing such prohibited-for-children content to minors at all, and where that distribution happens over the Internet requires administrative, technical, software or other means restricting children's access to it. Article 16 was amended in June 2024 and again at the end of December 2025.

Article 9 requires every item of information production to receive an age classification before distribution in Kazakhstan, assessing theme, genre, content and artistic design, how a child of a given age category is likely to perceive it, and the likelihood of harm to a child's health and development. Article 9(3) sets six categories: "under 6", "from 6", "from 12", "from 14", "from 16", and "from 18" (information containing content prohibited for children).

Article 15 requires the age-category sign to be marked on the product by its distributor, and bars distribution without the sign, subject to a list of exemptions (live news, entertainment and sports broadcasts; general political print periodicals; news and analytical television programmes; radio broadcasting; advertising; and internet resources).

That exemption list itself excludes internet publications and online platforms, so marking on an online platform is not voluntary the way it is for an ordinary internet resource. Both articles were amended in 2024 and again at the end of 2025.

Article 19(1) permits, without the author's or rightsholder's consent and without payment but with mandatory attribution of the author and source, quotation in the original or in translation for scientific, research, polemical, critical or informational purposes from lawfully published works, to an extent justified by the purpose of the quotation, including the reproduction of excerpts from newspaper and magazine articles in the form of press reviews.

Article 19(3) separately permits reproducing in newspapers, or communicating by broadcast or cable to the public, lawfully published newspaper or magazine articles on current economic, political, social and religious topics, or broadcast works of the same character, in cases where the author has not specially prohibited such reproduction, broadcast or cable communication, so the exception is an author opt-out rather than an unconditional licence.

Article 19 carries no headline-length or short-extract cap distinct from the fair-practice and purpose-justified tests in its own text. The Article's heading and adjoining provisions were most recently touched by Law No. 233-VIII (24 November 2025), a terminology-only amendment on the text read.

Article 23(5) of the Law on Artificial Intelligence permits using works, published news articles included, to train an AI model only where the author or rightsholder has not expressed a prohibition in machine-readable form.

The same Article separately states, at Article 23(3), that training does not fall within copyright law's free-use exceptions for educational or scientific purposes, and at Article 23(4) that training a model does not itself amount to exercising the author's reproduction, distribution, adaptation, public display, performance or broadcast rights.

Read together, an aggregator that trains a model on the news content it aggregates needs the absence of a machine-readable rightsholder objection under Article 23(5), separately from whatever licence its underlying reproduction of the articles themselves rests on.