Working notes: what the provisions say, how they may be read, and what remains unclear.
Note
Three layers of rules on automated decisions: Article 19-1 of the Personal Data Law (prohibited without consent or a statutory basis, right to object with a response within three working days), Article 43 of the Digital Code (explanation and human review) and the 2025 AI Law (prohibited functions, transparency, training data). Plus the 2026 standard on AI in schools: teachers, not systems, decide on grades.
Note
Who oversees compliance with personal data law: the regulator (the Ministry of Artificial Intelligence and Digital Development), local executive bodies and the prosecutor's office. How businesses are inspected — unscheduled inspections only, against a 33-item checklist — and how state bodies are inspected.
Note
Four similar concepts in Kazakhstan law and how they differ; when data must be destroyed or deleted and how fast; when de-identification is required; and how this fits with the right to erasure in the Digital Code and with the GDPR.
Note
What counts as a personal data breach and who notifies whom, and how fast: the operator reports to the regulator within one working day, cybersecurity centres within three hours, and data subjects are notified not by the operator but through e-government. Compared with the GDPR's 72 hours.
Note
In Kazakhstan consent is the main ground for processing, not one of many. This note covers the form of consent, its required content, when separate consent is needed, how the state and non-state services work, how consent is withdrawn, and why proving consent is harder than it seems.
Note
When personal data may be sent abroad: Article 16 of the Law, how it interacts with the consent requirement in Article 7, sector-specific bans, and why the absence of a list of "safe" countries leaves much unclear.
Note
Kazakhstan law splits data not into "ordinary" and "special" as the GDPR does, but into publicly available and restricted-access. There is no list of restricted-access data: it has to be assembled from other laws on medical secrecy, fingerprint and genomic registration and access to information. The answer drives security measures, place of processing and the operator's category.
Note
What rights data subjects have under the Personal Data Law and the Digital Code, how quickly the operator must respond (from one to fifteen working days), how a request is made and where to complain. A summary table of deadlines and a comparison with the GDPR, noting the absence of data portability and a general right to object.
Note
How the Law distinguishes disclosure to specific persons from publication in public sources, when consent is needed, what the rules on self-published data and the ban on "non-purposive extraction" change, and why Kazakhstan law has no familiar "processor" figure.
Note
Administrative liability under Art. 79 of the Code of Administrative Offences — fines from 30 to 2,000 MCI (in 2026, from KZT 129,750 to 8.65 million), how cases are opened and the one-year limitation period for legal entities. Criminal liability under Art. 147 of the Criminal Code and civil liability for damages. A comparison with turnover-based GDPR fines.
Note
A summary table of 20 issues showing where Kazakhstan's personal data rules resemble the GDPR and where they differ fundamentally — legal grounds, localisation, cross-border transfers, deadlines, the responsible person, fines. Plus a list of what a GDPR-compliant company must additionally do for Kazakhstan.
Note
Since 25 August 2026 large owners and operators must notify the regulator before starting and before stopping personal data processing. Who counts as large, what the notification contains, how the register works and what the law does not yet say — on a transition period, how to file and liability.
Note
Article 5 of the Law lists only five principles, phrased as general values. The familiar GDPR principles — purpose limitation, minimisation, storage limitation, accuracy, accountability — also exist in Kazakhstan law but are scattered across other articles and secondary acts. This note maps them in one place.
Note
When data may be processed without consent: the closed list of Article 9 and the special rules for published data. What the list lacks compared with the GDPR — contract, legitimate interest, vital interests — and what that means for employers and ordinary businesses.
Note
How Kazakhstan law limits the purposes and scope of processing, how the retention period is set and what happens once the purpose is achieved. Also: retention periods for HR documents under the 2025 schedule, and the tension between a one-year retention period for consent forms and the duty to prove consent.
Note
Who must appoint a person responsible for organising personal data processing, what that person does and how the role differs from a GDPR DPO. Which internal documents an operator needs depending on its category — small, medium or large — under the 2026 version of the Protection Rules.
Note
The foundations of Kazakhstan personal data law after 2026: the new Constitution, a narrow definition of personal data built on a closed list of identifiers, the roles of owner, operator and third party, the exclusions from the Law, and the unresolved question of whether the Law reaches foreign services.
Note
What the Labour Code says about personal data: a closed list of documents on hiring, a ban on asking for more, the unified system for recording employment contracts. When an employer needs consent and when the law suffices, how to handle applicants' data, how long to keep HR records and why identity documents should not be photocopied.
Note
How personal data law interacts with banking secrecy, microcredit secrecy, credit history rules and AML/CFT in banks, microfinance organisations and credit bureaus. The new 2026 Banking Law, biometric authentication through the National Bank and retention of customer files.
Note
The special regime for personal medical data under the Health Code: medical confidentiality and when it may be lifted, the electronic health passport, who may access patient data and when, and Ministry of Health rules on consent, patient notification and storage in Kazakhstan.
Note
The Communications Law's special regime for subscriber data: what counts as service information (numbers, IMEI, IIN, billing, location, IP addresses), the absolute ban on transferring it abroad, access by state bodies, secrecy of communications and device registration. The 2026 amendments and a pilot project running to the end of 2027.
Note
What security measures the Law requires and how, from September 2026, they depend on the operator's category (small, medium or large by number of data subjects), plus separate rules for restricted-access data. Compared with the GDPR's risk-based approach.
Note
A working note on Kazakhstan's in-country storage rule: Article 12 of the Personal Data Law as amended in 2026, the implementing rules, the contrast with the GDPR, and the questions that remain open.