Notifying the regulator before processing, the register of processors, and operator size categories.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
Since 25 August 2026 — only large operators (500,000 people or more, or from 10,000 if restricted-access data are processed). They notify before processing starts; the notification states the name and BIN, protection measures, the start date, whether data go to third parties or abroad, whether they are published, the list of data and where the database is located.
More in the note «Notification of the regulator and the register of operators»
By the total number of unique people whose data are processed across all systems — up to 10,000 is small, 10,000 to 500,000 is medium, 500,000 or more is large. If restricted-access data (for example, medical or biometric) are processed, the category goes up one step.
More in the note «Notification of the regulator and the register of operators»
Before processing stops, the regulator must be notified, and within 30 working days it removes the details from the register of operators. The same period applies to entering details in the register after a notification of the start of processing.
More in the note «Notification of the regulator and the register of operators»
Note
Who oversees compliance with personal data law: the regulator (the Ministry of Artificial Intelligence and Digital Development), local executive bodies and the prosecutor's office. How businesses are inspected — unscheduled inspections only, against a 33-item checklist — and how state bodies are inspected.
Note
Since 25 August 2026 large owners and operators must notify the regulator before starting and before stopping personal data processing. Who counts as large, what the notification contains, how the register works and what the law does not yet say — on a transition period, how to file and liability.
Note
What security measures the Law requires and how, from September 2026, they depend on the operator's category (small, medium or large by number of data subjects), plus separate rules for restricted-access data. Compared with the GDPR's risk-based approach.
Note
A working note on Kazakhstan's in-country storage rule: Article 12 of the Personal Data Law as amended in 2026, the implementing rules, the contrast with the GDPR, and the questions that remain open.
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
The 2026 amending package. Changes to the Personal Data Law are in Art. 1(37): "digital object" in the localisation rule, new Arts 10-1, 23-2 and 25-1, erasure and anonymisation. In force 60 days after publication (computed: 25 August 2026).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsDeletion and anonymisationData localisationNotification and register of operators
The main secondary act on protection measures, restated in September 2026: notification, operator size categories and tiered measures, restricted-access data (incl. cryptography), local collection and storage in a server room or data centre in Kazakhstan, the responsible person, and breach notification within one working day.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceBreaches and notificationsTypes of personal dataData localisationNotification and register of operatorsResponsible person and internal policiesSecurity measures