How destruction, deletion, de-identification and anonymisation differ, and when each is required.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
Destruction means the data can no longer be restored (it also covers paper); deletion is the same for electronic data in a digital system. De-identification and anonymisation make it impossible to link the data to a person; anonymisation works by irreversibly transforming identifiers — full name, IIN, an image of the face. The law defines them almost identically, and there are no criteria for irreversibility yet.
More in the note «Deletion, destruction, de-identification and anonymisation»
When the purpose of processing is achieved or the retention period has expired, the relationship with the person has ended, a court has so decided, or the data were collected without consent or a legal ground. If a person reports a violation and it is confirmed, the data must be deleted within one working day.
More in the note «Deletion, destruction, de-identification and anonymisation»
Data must be de-identified before they are passed on for research — by any method that rules out restoring the original data; as a rule, whoever requested the de-identified data bears the cost. The law gives no specific methods, so European anonymisation guidance is a useful reference, along with checking whether a person could be identified by matching the data with other sources.
More in the note «Deletion, destruction, de-identification and anonymisation»
Note
Four similar concepts in Kazakhstan law and how they differ; when data must be destroyed or deleted and how fast; when de-identification is required; and how this fits with the right to erasure in the Digital Code and with the GDPR.
Note
What rights data subjects have under the Personal Data Law and the Digital Code, how quickly the operator must respond (from one to fifteen working days), how a request is made and where to complain. A summary table of deadlines and a comparison with the GDPR, noting the absence of data portability and a general right to object.
Note
How Kazakhstan law limits the purposes and scope of processing, how the retention period is set and what happens once the purpose is achieved. Also: retention periods for HR documents under the 2025 schedule, and the tension between a one-year retention period for consent forms and the duty to prove consent.
The new code on the digital environment. Key for data protection: the concept of a "digital object" (Art. 20), now used in the Personal Data Law, and the right to erasure, anonymisation and restriction (Art. 41). In force six months after publication on 10 January 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceData subject rightsDeletion and anonymisationScope and key terms
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
The 2026 amending package. Changes to the Personal Data Law are in Art. 1(37): "digital object" in the localisation rule, new Arts 10-1, 23-2 and 25-1, erasure and anonymisation. In force 60 days after publication (computed: 25 August 2026).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsDeletion and anonymisationData localisationNotification and register of operators
Detailed rules on collection and processing: consent for public dissemination, disclosure and cross-border transfer (para 4-5), a three-working-day deadline to answer data subjects (para 16), irreversible de-identification (paras 20–21), blocking and deletion (para 25).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceConsentCross-border transfersData subject rightsDeletion and anonymisationDisclosure to third partiesPurpose, scope and retention
EDPB guidance on pseudonymisation: pseudonymised data remain personal data. Useful for mapping Kazakhstan's masking, de-identification and anonymisation concepts. Published for public consultation.
Open:edpb.europa.eu (opens in a new tab)
Not checked against the sourceDeletion and anonymisationKazakhstan and the GDPR
The classic European paper on anonymisation techniques and their risks (singling out, linkability, inference); a useful yardstick for "irreversibility" in Kazakhstan's definitions.
Open:ec.europa.eu (opens in a new tab)
Not checked against the sourceDeletion and anonymisationKazakhstan and the GDPR