Scope and key terms

In short

A new Constitution has been in force since 1 July 2026. Its Art. 21 expressly guarantees protection of personal data against unlawful collection, processing, storage and use, including by digital technologies. The main statute is Law No. 94-V, which governs the collection, processing and protection of personal data of individuals. In 2026 the definition of personal data became narrower: it now means information about a data subject “supplemented” by at least one identifier from a closed list (Art. 1(2), Art. 6). There is no specific rule on whether the Law applies to foreign companies.

Constitutional basis

Personal data legislation “is based on the Constitution” (Art. 4(1)). The 1995 Constitution is no longer in force. The new one was adopted by national referendum on 15 March 2026 and took effect on 1 July 2026 (Art. 94).

“The right to inviolability of private life, personal and family secrets, and protection of personal data against their unlawful collection, processing, storage and use, including by means of digital technologies, is guaranteed by law.” — Constitution, Art. 21(1) (unofficial translation)

Interpretation. The previous Constitution spoke of the inviolability of private life and secrecy of communications but did not mention personal data. Data protection is now a stand-alone constitutional right. This may strengthen data subjects’ arguments in disputes and in constitutional review of laws.

Where a ratified international treaty sets different rules, the treaty prevails (Art. 4(2)).

What personal data are

“personal data — information or a set of information about a data subject, supplemented by one or more personal data identifiers” — Law No. 94-V, Art. 1(2) (unofficial translation)

The identifiers are listed in Art. 6:

1. surname, first name and patronymic (if stated in the identity document), taken together;
2. the individual identification number (IIN);
3. an image of the subject’s face;
4. the facial biometric vector or its derivatives that can be restored to the original value.

The data subject is the individual to whom the data relate (Art. 1(16)). The Digital Code adds that the IIN is the unique identifier of an individual and distinguishes public and private identifiers (Art. 45).

Interpretation. The new definition works differently from the GDPR, where personal data are any information relating to an identified or identifiable person. In Kazakhstan, information becomes personal data when it is “supplemented” by an identifier from a closed list. Read literally, an email address, phone number or cookie ID on its own, without a name, IIN or facial image, may fall outside the definition. But that reading is risky: secondary legislation still uses the old, broad wording — data “relating to an identified or identifiable subject” (Collection Rules, para 2).

Who takes part in processing

Role	Definition	Where
Owner	Possesses, uses and disposes of a paper database or a digital object containing personal data	Art. 1(9)
Operator	Collects, processes and protects personal data	Art. 1(10)
Third party	Not the subject, owner or operator, but linked to them by circumstances or legal relations concerning processing	Art. 1(17)
Authorised body	The central executive body for personal data protection	Art. 1(11-1)

Data are kept either in a database — an ordered set on paper (Art. 1(8)) — or in a digital object (Art. 1(10-1)). The concept of a digital object comes from the Digital Code, Art. 20.

Processing means accumulation, storage, alteration, supplementing, use, dissemination, de-identification, anonymisation, blocking, destruction and deletion (Art. 1(12)). Collection is not part of this definition and is mentioned separately (Art. 1(5)).

What the Law does not cover

The Law does not apply to the collection, processing and protection of personal data (Art. 3(3)):

1. solely for personal and family needs, provided the rights of others and the law are not breached;
2. in handling documents of the National Archive Fund and other archives — except documents containing information on private life and personal or family secrets;
3. classified as state secrets;
4. in intelligence, counter-intelligence and operational-search activities and in protecting protected persons and facilities.

Specific rules may be set by other laws and acts of the President (Art. 3(2)).

Territory: the Law is silent, the Code gives a hint

The Personal Data Law has no rule on its territorial application. The Digital Code is different:

• the digital environment is understood “regardless of the territory” where data and objects are located (Art. 1(1));
• foreign individuals and legal entities dealing with digital data in Kazakhstan bear the same obligations as Kazakhstan citizens and legal entities (Art. 1(3));
• personal data may be processed or transferred only with the subject’s consent or where laws expressly provide (Art. 37(3)).

Interpretation. The Code tends to widen the reach: regulation of the digital environment is not tied to where servers are. But the obligations of foreigners in Art. 1(3) are linked to activity “in the territory of the Republic of Kazakhstan”. So the Code does not settle whether a foreign online service with no presence in the country must comply with Kazakhstan requirements.

Comparison with the GDPR

Question	Kazakhstan	GDPR
Personal data	Information supplemented by an identifier from a closed list (Arts 1, 6)	Any information relating to an identified or identifiable person (Art. 4(1))
Roles	Owner, operator, third party	Controller, processor, third party (Art. 4(7)–(10))
Personal needs	Excluded (Art. 3(3))	Excluded (Art. 2(2)(c))
Extraterritorial reach	Not expressly regulated	Applies to foreign companies offering goods or services in the EU or monitoring behaviour there (Art. 3(2))

Open questions

Open question: data without “identifiers”. Are an email, phone number, IP address or cookie personal data when there is no name, IIN or facial image alongside? The letter of the Law allows “no”; secondary legislation says “yes”.

Open question: foreign services. Does the Law apply to a foreign company that collects data of people in Kazakhstan online without any presence here?

Open question: owner or operator? The Law defines the owner through rights over the database and the operator through actions with the data. It does not say how to allocate duties when these are different persons, for example in outsourcing.

Still to research

• Normative resolutions of the Constitutional Court on private life and how they apply under the new Constitution.
• Whether definitions in secondary legislation will be aligned with the new definition of personal data.
• Regulator guidance on data without identifiers: phone numbers, emails, online identifiers.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.