Subscriber service information in telecommunications

In short

Subscriber service information is information on subscribers and users of communication services that is generated, processed or stored in communication networks (Communications Law, Art. 1(2)). Since 25 August 2026 the law lists expressly what it includes (Art. 23-1). Operators store it in Kazakhstan and may not transfer it abroad, except to serve Kazakhstan subscribers who are abroad (Art. 15(1)(2)). The Personal Data Law refers to this regime directly (Art. 16(5)).

What counts as service information

Under Art. 23-1(1), introduced by Law No. 326-VIII:

• subscriber numbers and device identification codes (IMEI);
• the subscriber’s IIN or BIN;
• billing information;
• the location of the subscriber’s device in the network;
• data network addresses (IP addresses), addresses of accessed internet resources, resource identifiers, protocols;
• other technical information related to communication services and data transmission.

Service information is used for counterintelligence and operational-search activities, and for technical detection of signs of offences on communication networks (Art. 23-1(2)). The second purpose applies only within a pilot project until 31 December 2027, under a procedure set by the National Security Committee in agreement with the Prosecutor General’s Office (Art. 23-1(3)).

Interpretation. Almost all service information is personal data of an individual subscriber: IIN, number, location, IP address. Both the Personal Data Law and the stricter special regime of the Communications Law therefore apply to it.

Duties of operators

Communication operators must (Art. 15(1)):

• collect and store service information under the procedure set by the communications authority, on the territory of Kazakhstan;
• not transfer it outside Kazakhstan, except to provide services to Kazakhstan subscribers abroad;
• give bodies conducting operational-search and counterintelligence activities access to service information and the technical means for their measures.

Interpretation. Under the general rule of the Personal Data Law, transfer to a country without adequate protection is allowed with the data subject’s consent (Art. 16(3)). Service information has no such exception: the ban applies even with the subscriber’s consent. It is an example of a statutory restriction on cross-border transfer (Art. 16(4)); see the note “Cross-border transfers of personal data”.

Secrecy of communications and access to service information

• Operators ensure the secrecy of correspondence, telephone conversations, postal items and other messages, subject to restrictions set by law (Art. 36(2)).
• Service information may be obtained from an operator only with the subscriber’s consent and in the cases provided for by the Communications Law and the laws on operational-search and counterintelligence activities (Art. 36(4)).
• Unlawful violation of the secrecy of correspondence and conversations is a criminal offence (Criminal Code, Art. 148).

Device registration

To register a phone, the owner gives the operator their IIN (or BIN), the IMEI and the subscriber number; this information is sent to the operator of the device identification code database (Art. 36-2(3)). Unregistered devices are not served (Art. 36-2(5)). The procedure was amended by Law No. 320-VIII of 19 June 2026.

Comparison with the EU

Question	Kazakhstan	EU
Special regime	Service information (Communications Law)	Traffic and location data — Directive 2002/58/EC (ePrivacy)
Use	Counterintelligence, operational-search activities, a pilot for detecting offences	Only for the service and billing; otherwise with consent or under national law with safeguards
Retention for authorities	Mandatory, in Kazakhstan	General mandatory retention (Directive 2006/24/EC) was declared invalid by the EU Court of Justice in 2014
Transfer abroad	Prohibited, except roaming	Under the general rules of GDPR, Chapter V

Open questions

Open question: who is bound. Does the service information regime apply to messengers and other online services that are not communication operators but process similar data?

Open question: the pilot project. What data, and with what safeguards, are used for “technical detection of signs of offences”, and will the project be extended beyond 2027?

Open question: operators’ cloud services. How does the ban on transfer abroad affect operators’ use of foreign cloud and analytics services?

Still to research

• The procedure for collecting and storing service information approved by the communications authority (retention periods).
• Rules on verification and registration of subscriber devices.
• The National Security Committee’s procedure for the pilot project.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.