Personal data in the financial sector

In short

There is no separate personal data regime for the financial sector: the general Law applies, with sector-specific secrecy rules and duties on top. The main ones are:

• banking secrecy under the new 2026 Banking Law (Art. 69);
• microcredit secrecy (Microfinance Law, Art. 21);
• consent to the formation of a credit history (Credit Bureau Law, Art. 25);
• customer due diligence and keeping customer files for at least five years (AML/CFT Law, Arts 5, 11).

The new Banking Law

The Law “On Banks and Banking Activity in the Republic of Kazakhstan” No. 258-VIII of 16 January 2026 replaced the 1995 law. It enters into force 60 calendar days after its publication on 17 January 2026, i.e. on 18 March 2026. Some provisions apply from 1 July 2026, 1 January 2027 and 1 May 2027 (Art. 135). In particular, disclosure of banking secrecy to the financial ombudsman (Art. 69(19)) and the data showcase for the regulator (Art. 75(5)) apply only from 1 January 2027.

Banking secrecy

Banking secrecy covers information on the clients and correspondents of banks, their transactions and relations with the bank: accounts and their holders, balances and movements of funds, attachments, loans, property in safe deposit boxes, payments and transfers (Art. 69(1)). The bank guarantees its confidentiality (Art. 69(2)).

Banking secrecy may be disclosed (Art. 69(4)):

1. to the bank’s client;
2. to any third party with the consent of the account holder, given to the bank in writing or through the holder’s means of identification;
3. to other persons on the grounds and within the limits set by Article 69.

The article then lists many recipients that receive information without the client’s consent: tax authorities, the financial monitoring authority, credit bureaus, other banks, courts, law enforcement bodies and others (Art. 69(5)–(18)).

Interpretation. Banking secrecy and personal data overlap but do not coincide. Secrecy also covers information on legal entities, but does not cover, for example, data of visitors to the bank’s website. For the personal data of an individual client both regimes apply at the same time: the bank must comply with both Art. 69 of the Banking Law and the Personal Data Law. In practice the two consents are often combined in one document.

Biometrics

• Remote account opening requires biometric authentication through the National Bank’s Identification Data Exchange Centre (IDEC), with the client’s consent and using data from the national biometric authentication system (Art. 52(7)).
• Online loans require biometric authentication; for large loans it goes through the IDEC (Art. 58(9)).
• At the borrower’s request, the bank must report within 10 working days when and how the borrower was authenticated, including checks against the anti-fraud centre database (Art. 58(10)).

The IDEC and the National Bank’s anti-fraud centre are defined in the Payments Law (Art. 1(7-3), (38-1)).

Interpretation. Biometric data are restricted-access data. Enhanced protection measures therefore apply to them, and the operator moves up one category. See the notes “Types of personal data” and “Personal data security measures”.

Processing without consent

Financial institutions often rely on statutory grounds that do not require consent:

• supervision: the financial market regulator obtaining information from individuals and legal entities (Personal Data Law, Art. 9(9));
• AML/CFT: customer due diligence (AML/CFT Law, Art. 5) and reporting transactions to the financial monitoring authority (Art. 10);
• transfer of a bank’s assets and liabilities: the acquiring bank processes client data without their consent (Banking Law, Art. 68(13)).

More on these grounds in the note “Processing personal data without consent”.

Credit bureaus

• Consent. Banks and other data providers share information with a credit bureau with the consent of the data subject (Art. 25(1)).
• Without consent, negative information about the subject is shared and credit reports containing it are issued (Art. 25(4)).
• Data subject rights (Art. 22): to obtain one’s own credit report, dispute entries, demand correction of inaccurate information, and set or remove a voluntary self-ban on borrowing free of charge.

Microfinance organisations keep microcredit secrecy. It may be disclosed to the borrower, to third parties with the borrower’s written consent and to state bodies in the cases listed in the law (Microfinance Law, Art. 21).

Retention

Documents and information obtained during customer due diligence, including the customer file and correspondence, are kept for at least five years after the business relationship ends (AML/CFT Law, Art. 11(4)).

Interpretation. This is a case where the retention period is set not by “the date the purposes of collection and processing are achieved” but by law (Personal Data Law, Art. 12(2)). A former client’s request to delete data is not complied with during these five years; instead access is restricted (see the note “Deletion, destruction, de-identification and anonymisation”).

Oversight

Oversight of compliance with personal data legislation by the National Bank and its organisations is carried out under the Entrepreneurial Code, the Personal Data Law and the Law on the National Bank (Personal Data Law, Art. 27-2).

Comparison with the GDPR

Question	Kazakhstan	GDPR
Ground for AML/CFT	Set directly in the AML/CFT Law	Legal obligation (Art. 6(1)(c))
Professional secrecy	Banking and microcredit secrecy in sector laws	Left to Member State law (Art. 90)
Credit histories	Formed with consent; negative data without consent	Usually legitimate interest or law; credit scoring falls under Art. 22
Biometrics	Through state infrastructure (IDEC) with consent	Special category, requires a ground under Art. 9(2)

Open questions

Open question: two consents. Is one document enough for both consent to disclose banking secrecy (Art. 69(4) of the Banking Law) and consent to process personal data (Art. 8 of the Personal Data Law)? Their content requirements differ.

Open question: cloud and outsourcing. What requirements do the National Bank and the financial market regulator impose on hosting bank data in the cloud and with foreign providers, beyond general localisation?

Open question: credit scoring. Does an automated decision to refuse a loan fall under Art. 19-1 of the Personal Data Law, and how do banks obtain consent for it? See the note “Automated processing and artificial intelligence”.

Still to research

• The financial market regulator’s information security and outsourcing requirements for banks.
• Rules of the IDEC and the anti-fraud centre: retention periods for biometric data.
• Insurance secrecy and rules for insurers.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.