Access, rectification, erasure, anonymisation, restriction, complaints.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
To know what data are held about them and why; to demand rectification, blocking and deletion; to withdraw consent; to object to automated decisions; to claim compensation. Deadlines are very short — information on data within 3 working days, rectification, blocking and deletion within 1 working day, stopping processing after withdrawal of consent within 15 working days.
The Digital Code lets people demand deletion, anonymisation or restriction of processing of their data in the digital environment, even if the data were obtained lawfully. Exceptions apply where the data are needed to protect others' rights, for offence cases, courts, a public interest set by law or state functions. Where the law requires data to be kept for a set period, access is restricted and processing suspended instead of deletion.
To the regulator — the Ministry of Artificial Intelligence and Digital Development, which considers complaints within 15 working days, with a possible extension. One can also go straight to court, including to claim compensation for non-pecuniary and pecuniary damage.
Note
Three layers of rules on automated decisions: Article 19-1 of the Personal Data Law (prohibited without consent or a statutory basis, right to object with a response within three working days), Article 43 of the Digital Code (explanation and human review) and the 2025 AI Law (prohibited functions, transparency, training data). Plus the 2026 standard on AI in schools: teachers, not systems, decide on grades.
Note
Who oversees compliance with personal data law: the regulator (the Ministry of Artificial Intelligence and Digital Development), local executive bodies and the prosecutor's office. How businesses are inspected — unscheduled inspections only, against a 33-item checklist — and how state bodies are inspected.
Note
Four similar concepts in Kazakhstan law and how they differ; when data must be destroyed or deleted and how fast; when de-identification is required; and how this fits with the right to erasure in the Digital Code and with the GDPR.
Note
In Kazakhstan consent is the main ground for processing, not one of many. This note covers the form of consent, its required content, when separate consent is needed, how the state and non-state services work, how consent is withdrawn, and why proving consent is harder than it seems.
Note
What rights data subjects have under the Personal Data Law and the Digital Code, how quickly the operator must respond (from one to fifteen working days), how a request is made and where to complain. A summary table of deadlines and a comparison with the GDPR, noting the absence of data portability and a general right to object.
Note
Administrative liability under Art. 79 of the Code of Administrative Offences — fines from 30 to 2,000 MCI (in 2026, from KZT 129,750 to 8.65 million), how cases are opened and the one-year limitation period for legal entities. Criminal liability under Art. 147 of the Criminal Code and civil liability for damages. A comparison with turnover-based GDPR fines.
Note
Who must appoint a person responsible for organising personal data processing, what that person does and how the role differs from a GDPR DPO. Which internal documents an operator needs depending on its category — small, medium or large — under the 2026 version of the Protection Rules.
The new code on the digital environment. Key for data protection: the concept of a "digital object" (Art. 20), now used in the Personal Data Law, and the right to erasure, anonymisation and restriction (Art. 41). In force six months after publication on 10 January 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceData subject rightsDeletion and anonymisationScope and key terms
General procedure for handling applications by state bodies. The regulator handles data subjects' complaints under it: 15 working days, extendable by no more than two months (Art. 76(1), (3)).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
Detailed rules on collection and processing: consent for public dissemination, disclosure and cross-border transfer (para 4-5), a three-working-day deadline to answer data subjects (para 16), irreversible de-identification (paras 20–21), blocking and deletion (para 25).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceConsentCross-border transfersData subject rightsDeletion and anonymisationDisclosure to third partiesPurpose, scope and retention
How the state service for consent to access data in state digital objects works: requests answered via the 1414 SMS gateway or e-government, withdrawal, a list of who holds consent, and notifications of actions with the data (para 3).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial