Who is covered and when; what personal data, owner, operator, third party and digital object mean.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
The law covers collecting, processing and protecting information about people, both in paper databases and in digital systems. It does not apply when an individual processes data purely for personal and family needs (for example, contacts in their own phone), or to archives (except information on private life), state secrets, and intelligence and operational-search activities.
The owner is whoever owns the database or system holding the data; the operator is whoever collects, processes and protects the data. They are often the same company. There is no direct equivalent of the European controller–processor pair — a contractor processing data on someone else's behalf is not singled out in the law.
The law gives no direct answer — it has no provision on its application outside the country. The Digital Code extends obligations to foreigners working with digital data on Kazakhstan's territory. For a foreign online service with no presence in the country, the question remains open.
The word "database" in the law now means data on paper, and in 2026 the concept of a "digital object containing personal data" was introduced for electronic data. As a result, the law's requirements — including keeping data in Kazakhstan — now clearly apply to electronic systems.
Note
A summary table of 20 issues showing where Kazakhstan's personal data rules resemble the GDPR and where they differ fundamentally — legal grounds, localisation, cross-border transfers, deadlines, the responsible person, fines. Plus a list of what a GDPR-compliant company must additionally do for Kazakhstan.
Note
The foundations of Kazakhstan personal data law after 2026: the new Constitution, a narrow definition of personal data built on a closed list of identifiers, the roles of owner, operator and third party, the exclusions from the Law, and the unresolved question of whether the Law reaches foreign services.
The new Constitution, in force from 1 July 2026 in place of the 1995 Constitution (Art. 94). Article 21 for the first time expressly guarantees protection of personal data against unlawful collection, processing, storage and use, including by digital technologies.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceProcessing principlesScope and key terms
The new code on the digital environment. Key for data protection: the concept of a "digital object" (Art. 20), now used in the Personal Data Law, and the right to erasure, anonymisation and restriction (Art. 41). In force six months after publication on 10 January 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceData subject rightsDeletion and anonymisationScope and key terms
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures