Conditions for transferring personal data abroad.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
There is no official list — neither the law nor secondary legislation says who determines such countries or by what criteria. In practice, therefore, companies usually obtain consent to cross-border transfer in all cases.
Above all, with the person's consent. Without consent — if a ratified international treaty or a law provides for it (to protect the constitutional order, public order, rights, health and morals), or if it is needed to protect the person's rights when their consent cannot be obtained.
The law does not say directly — it speaks of transfer "to the territory of foreign states". The requirement to store data in Kazakhstan is met in such a case. The cautious approach is to treat access from abroad as a transfer and cover it in the consent.
Sending personal data to a foreign service — a cloud API or an AI model — looks like a cross-border transfer, even if the main database is in Kazakhstan. A ground is needed, usually consent, and it is worth checking first whether personal data need to be sent at all: often they can be removed or de-identified beforehand.
Note
When personal data may be sent abroad: Article 16 of the Law, how it interacts with the consent requirement in Article 7, sector-specific bans, and why the absence of a list of "safe" countries leaves much unclear.
Note
A summary table of 20 issues showing where Kazakhstan's personal data rules resemble the GDPR and where they differ fundamentally — legal grounds, localisation, cross-border transfers, deadlines, the responsible person, fines. Plus a list of what a GDPR-compliant company must additionally do for Kazakhstan.
Note
The Communications Law's special regime for subscriber data: what counts as service information (numbers, IMEI, IIN, billing, location, IP addresses), the absolute ban on transferring it abroad, access by state bodies, secrecy of communications and device registration. The 2026 amendments and a pilot project running to the end of 2027.
Note
A working note on Kazakhstan's in-country storage rule: Article 12 of the Personal Data Law as amended in 2026, the implementing rules, the contrast with the GDPR, and the questions that remain open.
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
Special regime for subscriber service information (numbers, device IDs, billing, location, IP addresses, Art. 23-1): it must be stored in Kazakhstan and may not be transferred abroad except to serve Kazakhstan subscribers roaming abroad (Art. 15(1)(2)).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceCross-border transfersData localisationTelecommunications
Detailed rules on collection and processing: consent for public dissemination, disclosure and cross-border transfer (para 4-5), a three-working-day deadline to answer data subjects (para 16), irreversible de-identification (paras 20–21), blocking and deletion (para 25).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceConsentCross-border transfersData subject rightsDeletion and anonymisationDisclosure to third partiesPurpose, scope and retention
Used for comparison. The GDPR has no general localisation duty: data move freely within the EU (Art. 1(3)), and exports outside the EEA are governed by Chapter V, with the transfer conditions in Arts 44–49.
Open:EUR-Lex (opens in a new tab)official
● Checked 26 October 2026in forceCross-border transfersKazakhstan and the GDPRData localisation
The only binding international treaty on data protection, open to non-member states. As of 18 October 2026 Kazakhstan is not a party, which matters when assessing which countries "ensure protection" for transfers.
What counts as a "transfer" under GDPR Chapter V. Helps frame the same question for Kazakhstan, where transfer is defined only by territory.
Open:edpb.europa.eu (opens in a new tab)
Not checked against the sourceCross-border transfersKazakhstan and the GDPR
A practical piece on localisation after the 2026 amendments. Distinguishes storage (Art. 12) from transfer (Art. 16) and argues, citing a 6 May 2024 regulator letter, that parallel storage abroad is acceptable if the primary database stays in Kazakhstan.