Rules on automated processing and decisions made without human involvement; links to the AI law.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
If automated processing creates, changes or ends a person's rights — only with their consent or in cases set by law. The person must be told how the processing works and what it may lead to, and be able to object; an objection is considered within 3 working days. The Digital Code adds a right to an explanation of the key factors behind the decision and to its review by a human.
More in the note «Automated processing and artificial intelligence»
The AI Law expressly refers decisions based on automated processing of personal data to personal data legislation. It adds a ban on certain functions (social scoring, emotion recognition without consent, unlawful data processing), informing people about the use of AI, labelling of generated content and risk management.
More in the note «Automated processing and artificial intelligence»
Training needs a legal ground — usually consent — and a purpose stated in advance; using data collected for another purpose is problematic. Mass extraction of data from open sources is prohibited. If training happens in an external service abroad, it is also a cross-border transfer, so it is safer to de-identify data beforehand.
More in the note «Automated processing and artificial intelligence»
Note
Three layers of rules on automated decisions: Article 19-1 of the Personal Data Law (prohibited without consent or a statutory basis, right to object with a response within three working days), Article 43 of the Digital Code (explanation and human review) and the 2025 AI Law (prohibited functions, transparency, training data). Plus the 2026 standard on AI in schools: teachers, not systems, decide on grades.
Note
How personal data law interacts with banking secrecy, microcredit secrecy, credit history rules and AML/CFT in banks, microfinance organisations and credit bureaus. The new 2026 Banking Law, biometric authentication through the National Bank and retention of customer files.
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
Kazakhstan's first AI law: risk and autonomy levels, prohibited functions (including unlawful processing of personal data and emotion recognition without consent), transparency and training data. Automated decisions are left to personal data law (Art. 21(4)).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AI
A sector act on AI in schools with express rules on pupils' data: school staff, not the system, decide on grades and discipline (para 4); materials are anonymised before being passed to third-party AI services (para 5); no demanding a pupil's full prompt history (para 8).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AI