Personal data localisation in Kazakhstan

In short

The Law requires personal data to be stored “in a database and/or digital object located in the territory of the Republic of Kazakhstan” (Art. 12(2)). This wording applies from 25 August 2026. The implementing rules add detail: electronic data are stored in a server room or data centre in Kazakhstan, and restricted-access data must also be collected and processed through digital objects located in Kazakhstan (Rules, para 16, para 18).

The localisation requirement does not prohibit transfers abroad. Transfers are regulated separately (Art. 16), and the text of the Law suggests that both requirements have to be met at the same time.

What the Law says

“Personal data shall be stored by the owner and/or operator, as well as by a third party, in a database and/or digital object located in the territory of the Republic of Kazakhstan.” — Law No. 94-V, Art. 12(2) (unofficial translation)

The rule is addressed to the owner, the operator and any third party (Art. 1(9), (10), (17)). It sets no thresholds based on data volume or company size, and it covers all personal data, not only restricted-access data.

The Law does not apply to processing for personal or family needs, archives (with exceptions), state secrets, or operational-search, intelligence and counter-intelligence activities (Art. 3(3)). Article 12 itself contains no exceptions.

What changed in 2026

The requirement to store data in a database in Kazakhstan has applied since 2016 (according to the editorial note to Article 12, it was introduced by Law No. 419-V of 24 November 2015). In 2026 its wording changed. Law No. 326-VIII replaced “in a database located” with “in a database and/or digital object located” (Art. 1(37)(9)). The amending law was published on 25 June 2026 and enters into force 60 calendar days later (Art. 2); by calculation, on 25 August 2026.

The definitions show why this matters. Under the current wording, a “database” means ordered data on paper (Art. 1(8)). For electronic data the Law now uses the term “digital object containing personal data” (Art. 1(10-1)). It builds on the definition of a digital object in the Digital Code, which lists, among others, digital resources, software, digital systems, platforms and digital infrastructure (Art. 20).

Interpretation. Had Article 12 kept only the word “database”, one could argue about whether localisation applies to electronic data at all. Adding “digital object” appears to settle that question: the requirement expressly covers electronic systems, including cloud environments.

What the secondary legislation adds

The Rules on personal data protection measures changed twice in 2026. The version adopted by Order No. 338/NK applied from 12 July 2026; from 21 September 2026 the Rules were restated by Order No. 534/NK (the date is calculated from publication on 10 September 2026). The numbering of the paragraphs changed. The current version contains three requirements on where processing takes place (Rules):

1. Storage. Data held in digital resources are stored in a database and/or digital object located in a server room or data centre in Kazakhstan (para 18).
2. Collection and processing of restricted-access data. Only through digital objects located in Kazakhstan (para 16).
3. Cryptography. Restricted-access data are stored and transmitted using cryptographic tools of at least security level 3 under national standard ST RK 1073-2007. This does not apply to cross-border transfers under Article 16 (para 15(9)).

Storage in a database in Kazakhstan is a separate item of the inspection checklist (item 6), so it is checked during inspections. The checklist was approved in 2024 and uses the earlier terminology.

From 25 August 2026 there is also a notification of the start of processing (Art. 10-1). It is filed by large operators, those processing data of 500,000 or more unique data subjects. An operator processing restricted-access data moves up one category (Art. 25-1). The notification states where the database and/or digital object is located and whether cross-border transfers take place (Art. 10-1(3)(5), (8)).

Interpretation. Through the notification, the regulator will know where large operators store data even before an inspection. A mismatch between the notification and the actual system architecture looks like a risk in its own right.

Comparison with the GDPR

Question	Kazakhstan	GDPR
General duty to keep data in a particular country	Yes (Art. 12(2))	No; data move freely within the EU (Art. 1(3))
Data exports	Separately under Art. 16, on top of localisation	Chapter V (Arts 44–49)
Requirements on infrastructure location	Server room or data centre in Kazakhstan (Rules, para 18)	None
Can the issue be solved by contract	No: the requirement concerns the physical place of storage	For transfers, yes, e.g. through SCCs

Interpretation. The GDPR regulates where data go and on what terms. Kazakhstan law additionally prescribes where data must be. GDPR compliance therefore does not in itself mean compliance with Article 12: a company that stores data only in a European cloud formally does not meet the localisation requirement.

Open questions

Open question: primary copy or sole place of storage? Article 12 does not say “only”. A SOLIS Partners article refers to a letter of the Information Security Committee of 6 May 2024. As the article’s authors describe it, the letter allows parallel storage abroad if the Kazakhstan database is the primary and up-to-date one. The letter itself has not been found, so its content is known only from this account.

Open question: foreign companies with no presence in Kazakhstan. The Law has no specific provision on territorial scope (Art. 3). The text does not clearly answer whether Article 12 applies to a foreign online service that collects data of people in Kazakhstan.

Open question: remote access. If the database is in Kazakhstan but is accessed from abroad, the storage requirement is met. Is the access itself a cross-border transfer? Article 16(1) speaks of transfer “to the territory of foreign states”. The provision gives no answer.

Open question: liability. The Code on Administrative Offences has no specific offence for breaching localisation. Article 79(1) (unlawful collection and processing, 30 to 200 MCI) or 79(3) (failure to take protection measures, 150 to 600 MCI; up to 2,000 MCI under 79(4) where data are lost or unlawfully processed) could apply. How breaches are classified in practice remains to be researched (Code on Administrative Offences, Art. 79). MCI is the monthly calculation index, set annually.

Still to research

• The text of the Information Security Committee letter of 6 May 2024 or other regulator guidance on localisation.
• Court and administrative practice under Article 79 of the Code on Administrative Offences regarding localisation.
• Sector-specific requirements: banking, telecommunications, healthcare, state bodies.
• Whether the inspection checklist has been updated after the 2026 amendments.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.