Kazakhstan Data Protection & Privacy Regulation

Lawful Processing & Special Data

A substantive new restriction on the use of publicly available personal data took effect on 25 August 2026 under Article 7.11 of Law No. 94-V as amended. The provision prohibits the unauthorised extraction or accumulation of publicly available personal data for the purpose of building or expanding databases, without the data subject's express consent. The provision also clarifies a point that had previously been ambiguous: a person's voluntary decision to publish their own personal data does not, by itself, constitute consent to further collection or dissemination of that data by third parties. This closes a gap that scraping and database-aggregation practices had previously been able to exploit by treating public availability as equivalent to consent.

Alongside this restriction, the same effective date brought a set of new statutory definitions into the law: automated processing, anonymisation, masking, hashing and personal-data security breach are now each defined terms. The definition of 'personal data' itself was reoriented around the concept of a personal-data identifier, rather than being tied to a physical medium or to biometric linkage as under the prior formulation. Together, the new anti-extraction rule and the new definitional architecture mark a clear tightening of the lawful-processing baseline: the law now reaches activity - bulk collection of ostensibly public data - that the prior text did not clearly address, and it does so with a firmer conceptual vocabulary for anonymisation and pseudonymisation-adjacent techniques than existed before.

These changes apply uniformly to both controllers and processors, and they engage regardless of sector, which distinguishes this update from narrower sectoral interventions. The practical effect for any entity that aggregates personal data from public sources - whether for commercial enrichment, due-diligence, or analytics purposes - is that such activity now requires an identifiable legal basis of express consent rather than an assumption that public availability suffices.

Outlook

How Kazakhstani authorities interpret 'building or expanding databases' in practice, and what counts as adequate express consent in this context, are the open questions following the 25 August 2026 effective date. No enforcement action under the new Article 7.11 provision has been identified to date; the provision is new enough that implementation practice has not yet become visible in available reporting.

Lawful Processing & Special Data

Law No. 326-VIII introduces a risk-based classification system for controllers and the databases they hold, under a new Article 25-1 of Law No. 94-V as amended. Under this system, a database would ordinarily be classified as 'small' where it covers fewer than ten thousand unique subjects, but the amendment provides that any database containing biometric data is reclassified upward to the 'medium' tier regardless of how few subjects it covers. This means the presence of biometric data, rather than the volume of subjects processed, independently determines a meaningful part of a controller's regulatory tier and, by extension, the compliance obligations that attach to that tier.

The practical significance of this reclassification is that controllers holding comparatively small datasets, who might otherwise have assumed a lighter compliance posture based on subject-count alone, must now separately assess whether any biometric data within that dataset pushes them into the medium tier. This is a tightening of the classification test specifically targeted at sensitive-category data rather than at overall processing scale.

Outlook

The reclassification rule takes effect alongside the rest of Law No. 326-VIII's provisions from 25 August 2026. What to watch is whether implementing guidance clarifies the precise definition of biometric data for the purposes of this reclassification test, and whether further categories of special data beyond biometric data are brought within the same upward-reclassification logic in future amendments.

Lawful Processing & Special Data

Kazakhstan introduced a more granular lawful-processing requirement specific to automated decision-making this cycle. From 25 August 2026, Law No. 326-VIII requires specific consent for automated processing of personal data and establishes a corresponding right to object to such processing. This represents a tightening of the lawful-basis framework as it applies to automated processing specifically, distinguishing it from the more general consent and lawful-basis provisions that apply to manual or non-automated processing under the pre-existing framework.

The requirement for specific consent, rather than reliance on a general consent previously obtained for other processing purposes, suggests that automated processing is now treated as requiring its own distinct lawful-basis justification under Kazakhstani law. Pairing this consent requirement with an explicit objection right gives data subjects a mechanism to resist automated processing even after initially consenting to it, a structure that provides an ongoing control point rather than a one-time gating decision at the point consent is first given.

This development sits within the same 25 August 2026 effective-date wave as the controller/processor classification tiers described under Controller/Processor Duties, and the two provisions are best read together: entities newly classified into higher processing tiers, particularly those engaged in large-scale automated processing, now face both a scale-based classification obligation and a processing-specific consent and objection requirement applicable to their automated-processing activity.

The available record for this cycle does not extend to data-subject-rights provisions more broadly, such as access or rectification deadlines, which were not independently re-verified against a primary source this cycle; the automated-processing consent and objection requirement is the specific lawful-processing development evidenced this cycle, and should not be read as representing a comprehensive re-statement of Kazakhstan's full data-subject-rights architecture.

Outlook

How Kazakhstani controllers operationalise the new automated-processing consent and objection requirement, particularly whether implementing guidance clarifies what constitutes automated processing for these purposes, is the clearest open question following this cycle's amendments. The interaction between this consent requirement and the new controller-classification tiers, specifically whether larger-tier controllers face additional documentation or disclosure obligations when relying on automated-processing consent, is a related area likely to develop further as the 25 August 2026 changes bed in.

Lawful Processing & Special Data

Amendments effective 25 August 2026 under Law No. 94-V, as amended by Law No. 326-VIII, tightened the rules governing already-published personal data. The law now provides that a data subject's own publication of their personal data does not imply consent to its further collection, use, or dissemination by others, and imposes a masking duty where such data is republished. This closes what had been a gap around data that individuals had themselves made public, treating self-publication as distinct from a general waiver of protection. The same amendment wave added statutory definitions, effective 25 August 2026, for deletion, anonymisation, masking, hashing, and personal data security breach, terms that had not previously been defined in the statute and that now give the law vocabulary to describe the technical lifecycle of personal data from collection through to destruction.

Outlook

The practical application of the new consent-limitation rule for self-published data, including how masking duties on republication will be enforced in practice, has not yet been tested; how the regulator interprets the new definitions of anonymisation and masking against actual processing practices will be a significant point to watch following the 25 August 2026 effective date.

Lawful Processing & Special Data

Two related developments under Law No. 326-VIII, both effective 25 August 2026, tighten the lawful-processing framework in Kazakhstan. First, the amendments clarify that a data subject's voluntary publication of their own personal data in the public domain does not automatically constitute consent to subsequent collection, dissemination or further processing of that data by others. This closes what had been an ambiguous gap: previously, publicly available data carried uncertain consent status for downstream processors, and this clarification narrows the lawful basis available to anyone relying on public availability alone as a justification for further processing.

Second, the same amendment wave introduced new statutory definitions of automated processing, anonymization, masking, personal-data security breaches and hashing, effective August 2026. These definitions provide the technical scaffolding underlying the security-measures obligations elsewhere in the amended law (see Controller/Processor Duties), giving controllers and processors a firmer statutory basis for understanding what counts as anonymised or masked data, and by extension what data may fall outside the scope of certain obligations.

Outlook

The practical interaction between the new consent clarification and existing sectoral practices — particularly around scraped or aggregated public data — has not been tested or clarified this cycle. Watch for MAIDD guidance or early enforcement practice interpreting the new definitions, none of which has been identified in the evidence available this cycle.

Controller/Processor Duties

Two related obligations for controllers took effect on 25 August 2026 under the Law No. 326-VIII amendments to Law No. 94-V. First, the law now classifies personal-data controllers into small, medium and large categories, determined by the volume of personal data processed. Each category carries its own set of mandated technical and organisational security measures, including requirements around encrypted transmission and cryptographic protection of stored data; the technical Rules implementing this classification took effect slightly earlier, on 12 July 2026. This is a risk-based tiering of security obligations where none previously existed in this form, meaning the scope of a controller's security duties under Kazakhstani law now depends on the scale of its processing rather than applying uniformly across all controllers.

Second, the amendments establish a register of personal-data security breaches, administered by the Ministry of Artificial Intelligence and Digital Development, also effective 25 August 2026. This creates a documented, centrally held record of breach events rather than leaving breach-handling as a matter addressed solely within each controller's own internal processes. Read together with the risk-tiered security-measures regime, the breach register gives the Ministry both an ex-ante classification tool - who must do what, by size of operation - and an ex-post accountability record - what went wrong and when - that did not exist in this combined form before the 2026 amendment wave.

This tightening sits within a broader pattern across the 2026 amendments: the national framework is accumulating structural accountability mechanisms - registration, classification, breach recording - in a way the prior text did not provide for, strengthening the Ministry's supervisory position over controllers and processors without altering the dual-perimeter structure that keeps the AIFC's own regime separate.

Outlook

How the breach register is populated and used in practice, and how controllers are assigned to the small, medium or large categories in borderline cases, are the practical implementation questions that follow the 25 August 2026 effective date. Direct confirmation from the Ministry's own published Rules has not yet been obtained; current reporting relies on professional-services commentary describing the enacted provisions.

Controller/Processor Duties

Two controller/processor-facing developments converge. First, a new version of the Rules for the Implementation of Personal Data Protection Measures entered into force on 12 July 2026, introducing revised organisational and technical security measures that controllers and processors are required to apply when handling personal data. Second, Law No. 326-VIII establishes a register of personal-data security breaches, to be maintained by the authorised state body, which represents a new institutional mechanism for tracking breach events at the national level.

The specific deadline and recipient test that would govern individual breach notification, meaning when and to whom a controller must notify an affected data subject directly following a breach, as distinct from the state-level breach register itself, has not been located in the material available. This leaves a practical gap between the existence of the state register and the controller-facing notification duty that would typically accompany it in a mature breach-notification regime.

Outlook

The security-measures update is already in force as of 12 July 2026, and the breach register is established by a law whose other provisions largely commence 25 August 2026. The specific question to track is whether implementing guidance or a subsequent instrument supplies the missing deadline and recipient test for individual breach notification to data subjects, which would complete the breach-notification duty as a practical compliance obligation rather than a state-register-only mechanism.

Controller/Processor Duties

Kazakhstan introduced a risk-tiered controller and processor classification system this cycle, a structural change to how compliance obligations are calibrated across the market. From 25 August 2026, Law No. 326-VIII classifies controllers and operators into three tiers: small, medium, covering entities processing data on 10,000 to 500,000 unique data subjects, and large, covering entities processing data on 500,000 or more unique data subjects. Entities handling restricted-access personal data are raised one tier above where their data-subject volume alone would place them, meaning the sensitivity of the data processed, not only its volume, factors into an entity's classification.

Alongside this classification system, Order No. 338/НҚ of 22 June 2026 entirely restated the Rules for the Implementation of Personal Data Protection Measures by Data Controllers and/or Data Processors and Third Parties, with the restated rules in force from 12 July 2026. An entire restatement of implementing rules governing how controllers and processors must implement protective measures, delivered within weeks of the tiered-classification system taking shape, suggests the two instruments are intended to operate together: the classification tier determines which category of obligation an entity falls into, while the restated implementing rules set out what protective measures entities in each category, or more broadly, must follow.

The classification system's three-tier structure, by volume of unique data subjects, with an uplift for restricted-access data, mirrors a risk-based regulatory design common internationally, scaling compliance burden to the scale and sensitivity of processing rather than applying a single uniform standard across all controllers regardless of size. The reported new breach-register obligation referenced in connection with this amendment wave is consistent with this risk-tiered design, though the specific documentation this cycle retrieved does not establish full procedural detail for how the breach register itself must be maintained or reported to the regulator.

Outlook

The practical operation of the three-tier classification system, particularly how entities determine their unique-data-subject count for classification purposes and how frequently that classification must be reassessed, is the clearest area requiring further regulatory or commercial guidance. The interaction between the restated Order No. 338/НҚ protective-measures rules and the classification tiers, specifically whether the restated rules impose differentiated protective-measure requirements by tier, is a related area this cycle's record does not fully resolve.

Controller/Processor Duties

Law No. 326-VIII's amendments to Law No. 94-V, effective 25 August 2026, introduced a risk-based classification of data controllers by the number of unique data subjects they process: small controllers process fewer than 10,000 data subjects, medium controllers process between 10,000 and 500,000, and large controllers process 500,000 or more. Alongside this classification, the amendments introduced a new data-breach register and raised administrative fines, which may now reach up to 2,000 monthly calculation indices for personal-data violations and up to 1,000 monthly calculation indices for cybersecurity-requirement violations. Separately, a new version of the Rules for the Implementation of Personal Data Protection Measures entered into force on 12 July 2026, introducing additional organisational and technical security measures specifically for restricted-access personal data, ahead of the broader August amendment wave.

Outlook

The exact breach-notification deadline and the recipient mechanics for the new breach register, meaning to whom and by when a breach must be reported, were not located in the sources available this cycle and remain an open question for controllers newly subject to the small, medium or large classification.

Controller/Processor Duties

Law No. 326-VIII introduces a risk-based classification of personal-data controllers into small, medium and large categories, based on the volume of personal data processed. This classification is understood to scale obligations by category, though the specific obligations attached to each tier have not been detailed in the evidence retrieved this cycle.

Separately, Article 23 of the Personal Data Law — restated as 'Protection of digital objects containing personal data' — now mandates the use of masking and hashing methods for digital objects containing personal data. The specific application procedure for this mandate is to be determined by MAIDD, meaning the practical compliance requirement is not yet fully specified pending that implementing guidance. This security-measures obligation draws directly on the new statutory definitions of masking, hashing and anonymization introduced in the same amendment wave (see Lawful Processing & Special Data).

Both developments took effect 25 August 2026, alongside the new controller/processor and breach registers described under Regulator & Framework. Together they represent a coordinated tightening of controller and processor obligations: classification determines the scale of obligation, while Article 23 determines a specific technical security measure that applies regardless of tier.

Outlook

Breach-notification timelines under the new breach register were not specifically confirmed this cycle and remain a gap. Watch for MAIDD's implementing procedure for the Article 23 masking-and-hashing mandate, and for clarification of what obligations attach to each of the small, medium and large controller categories.

Algorithmic, Biometric & Surveillance Governance

Kazakhstan's Law No. 230-VIII ZPK 'On Artificial Intelligence,' signed 17 November 2025, entered into force on 18 January 2026 and establishes a risk-tiered legal framework for AI systems operating within the country. The law states transparency, safety, accountability and data-privacy as among its governing objectives, positioning data-privacy as one of several named goals the risk-tiered structure is meant to serve, alongside the biometric-data reclassification rule under Law No. 326-VIII, which separately escalates a database's regulatory tier whenever it contains biometric data regardless of subject count.

Whether Law No. 230-VIII imposes any data-protection-specific transparency duty beyond its general stated objectives, for example a specific disclosure requirement tied to an AI system's processing of personal data, has not been independently retrieved or verified in the material available. The law's stated objectives establish the policy direction, but the operative content translating those objectives into enforceable transparency obligations specific to data processing remains to be confirmed.

Outlook

The AI law has been in force since 18 January 2026, so the near-term question is not commencement but content: whether further implementing regulations or guidance under Law No. 230-VIII articulate concrete data-protection-specific transparency duties, and how the risk-tiered AI framework interacts in practice with the biometric-driven database reclassification rule introduced separately by Law No. 326-VIII.

Algorithmic, Biometric & Surveillance Governance

Kazakhstan's statutory treatment of biometric personal data changed in a way that creates an interpretive ambiguity this cycle. Law No. 256-VIII of 9 January 2026 deleted the standalone statutory definition of biometric personal data from Article 1(1) of Law No. 94-V, with the deletion effective 12 July 2026. Notably, the term biometric personal data itself continues to be used elsewhere in the statute even though its dedicated defining provision has been removed, a legislative-drafting outcome that leaves open the question of what definition now governs the term's use in those remaining statutory provisions.

This development should be read as probable rather than confirmed, reflecting the fact that the underlying evidence for this cycle traces to secondary commercial legal commentary rather than directly retrieved primary statutory text. The deletion itself, and the continued use of the term elsewhere in the statute, are both reported findings; what is not established from the available record is whether a general definition, a cross-reference to a different instrument, or an interpretive gap now governs how biometric personal data is treated under Kazakhstani law.

The practical significance of this ambiguity is non-trivial for any entity processing biometric data in Kazakhstan, since biometric data typically attracts heightened processing obligations as a form of sensitive or special-category data. Without a clear statutory definition, entities and their advisers are left to infer the term's current scope from its remaining contextual uses in the statute, or to await clarifying guidance, implementing regulation, or judicial or regulator interpretation that resolves what the legislature intended by removing the standalone definition while retaining the term's operative use.

Outlook

The clearest development to watch is whether Kazakhstani authorities issue clarifying guidance, or whether a consolidated statutory text surfaces, resolving how biometric personal data is now defined following the removal of its standalone Article 1(1) definition. Until such clarification emerges, entities processing biometric data in Kazakhstan face genuine interpretive uncertainty as to the precise statutory scope of obligations attaching to that category of data.

Algorithmic, Biometric & Surveillance Governance

Kazakhstan's Law No. 230-VIII 'On Artificial Intelligence', in force since 18 January 2026, treats AI systems as digital objects across seven chapters and twenty-eight articles, and adds rules covering automated decisions and what the law terms digital sovereignty. On the biometric side, the redefined personal-data concept under Law No. 94-V, as amended, effective 11 July 2026, explicitly names full name, individual identification number, facial image, and facial biometric vector and its derivatives among the identifiers treated as personal data. Bringing facial biometric vectors and their derivatives within the statutory definition is a material extension of scope beyond raw facial images, reaching the processed biometric templates increasingly used in automated identification systems.

Outlook

How the AI Law's automated-decision rules interact with the personal-data law's biometric-identifier provisions in practice, particularly for facial-recognition systems that generate biometric vectors, has not yet been clarified by further guidance and is a point to watch as both frameworks mature.

Enforcement & Redress

Administrative liability for personal-data and cybersecurity violations has been increased under the 2026 amendments to Law No. 94-V, effective 25 August 2026, raising the ceiling on fines that can be imposed for breaches of the law. A separate, earlier proposal from January 2026 would have raised the maximum fine from roughly USD 17,000 to roughly USD 42,500 and introduced criminal liability for mass personal-data leaks; whether that specific proposal has been enacted in its originally proposed form has not been confirmed, and the figures and the criminal-liability element should be read as a reported proposal whose final enacted status remains to be verified rather than as a confirmed figure.

The pattern here is one of two distinct enforcement-related developments running on different tracks: a general increase in administrative fine ceilings that is confirmed as part of the in-force 2026 amendment wave, and a more specific criminal-liability proposal whose enactment status is still unresolved. Treating the two as a single confirmed development would overstate what is presently known; the general fines increase is the more securely evidenced of the two.

This enforcement tightening sits alongside the accountability architecture introduced elsewhere in the 2026 amendments - the new processing register, the breach register, and the risk-tiered security obligations - which together give the Ministry a materially expanded supervisory and punitive toolkit compared with the position before the amendment wave, even setting aside the unresolved criminal-liability question.

Outlook

Whether the January 2026 proposal to raise the fine ceiling to roughly USD 42,500 and introduce criminal liability for mass data leaks is enacted in that form, and if so when, remains the open question for this module. Confirmation would most likely come through direct publication of the final legislative text, which has not yet been retrieved.

Enforcement & Redress

No specific enforcement decision or fine schedule tied to Kazakhstan's data-protection regime was located in the material available. The principal development bearing on enforcement and redress is institutional rather than case-specific: Law No. 326-VIII's commencement timeline, with most provisions taking effect 25 August 2026, is the main driver of what the enforcement landscape will look like going forward, since it is this law that creates both the large-controller notification duty and the new breach register maintained by the authorised state body.

The breach register itself represents a potential future enforcement and redress mechanism, in that it creates an institutional record against which the authorised body could act, but the specific deadline and recipient test governing individual breach notification to affected data subjects, which would typically be the provision most directly tied to redress for an affected individual, has not been located. Absent that detail, it is not yet possible to assess how directly an individual data subject's redress rights are engaged by a breach event under the new regime.

Outlook

The 25 August 2026 commencement date is again the key marker here, since it brings the breach register and notification duty into force. What to watch beyond that date is whether any enforcement action or fine is issued under the amended law, and whether implementing guidance supplies the missing individual-notification deadline and recipient test that would complete the redress mechanism for affected data subjects.

Enforcement & Redress

Kazakhstan's current administrative-penalty ceiling for personal-data-protection violations sits under Article 79(4) of the Code of Administrative Offences, which sets a maximum fine of 2,000 MCI, equivalent to KZT 8,650,000 at the 2026 monthly calculation index, applicable to a large enterprise for failure to take protective measures resulting in loss or unlawful processing of personal data. This figure represents the current binding ceiling as it stands; no confirmed enforcement action or fine imposed under this specific tightened administrative-liability schedule was located during this cycle.

A proposal to raise this ceiling is under active discussion but had not been adopted as at its announcement. On 10 September 2026, a Vice-Minister at the Ministry of Artificial Intelligence and Digital Development, Doszhan Musaliyev, proposed raising the maximum fine for repeated personal-data-protection violations by large companies from 2,000 to 5,000 MCI. As reported, this proposal remained pending discussion with other government agencies, businesses, and the Kurultai, Kazakhstan's representative assembly, meaning it had not become binding law as at the date of the announcement.

Separately, earlier commentary from January 2026 recorded that the Ministry of Artificial Intelligence and Digital Development had proposed introducing criminal liability for mass leaks of citizens' personal data, a distinct and more severe form of liability from the administrative-fine increase proposed in September 2026. Both proposals point toward a direction of travel favouring materially stronger penalties for personal-data violations, though neither had been enacted as at the respective dates these proposals were reported.

The gap between the current 2,000 MCI ceiling and the proposed 5,000 MCI ceiling, and the further gap between either administrative figure and a potential criminal-liability regime for mass leaks, together describe an enforcement landscape in active transition, with the direction of travel toward materially increased deterrence, but with the specific binding ceiling as at this cycle remaining the existing 2,000 MCI figure under Article 79(4).

Outlook

Whether the proposed increase to 5,000 MCI for repeated large-company violations, and the earlier-proposed criminal-liability regime for mass leaks, progress from proposal to enacted law is the central development to track in this module going forward. Any confirmed enforcement action applying either the current 2,000 MCI ceiling or a future increased ceiling would also be a significant development, since no such confirmed action was located this cycle despite the tightened classification and security-measure framework now in force.

Enforcement & Redress

Administrative fines under Kazakhstan's national data-protection regime rose materially this cycle: Law No. 94-V, as amended by Law No. 326-VIII and effective 25 August 2026, sets fines of up to 2,000 monthly calculation indices for personal-data violations and up to 1,000 monthly calculation indices for cybersecurity-requirement violations. This sits alongside the distinct AIFC enforcement track: under AIFC Data Protection Rules section 5.1, the AIFC Commissioner of Data Protection must give a written fine notice stating the contravention and the alleged facts before imposing a fine, a procedural safeguard specific to the AIFC regime and separate from the national enforcement process.

Outlook

How the national regulator will apply the new, higher fine caps in practice, and whether any enforcement action under the new breach-register regime is reported, are the two points most likely to clarify the practical bite of this cycle's enforcement-and-redress tightening.

Enforcement & Redress

Reports indicate that recent reforms have strengthened administrative liability for violations in the field of personal-data protection and introduced obligations to notify citizens in the event of data breaches. This is reported with probable rather than confirmed confidence, and no specific named enforcement action or decision has been identified in the evidence retrieved this cycle — the finding is a general strengthening trend rather than a discrete enforcement event.

The Information Security Committee under MAIDD retains authority to issue penalties for violations of the personal-data framework, a standing feature of the regime's enforcement architecture. The new breach-notification obligation, once its specific procedural requirements are clarified, is expected to interact with the enforcement track by giving the regulator visibility into breach events through the newly-created breach register (see Regulator & Framework), which itself is effective 25 August 2026.

Outlook

Watch for the first substantive enforcement action or administrative penalty decision under the strengthened liability regime, and for confirmation of the specific breach-notification timelines that citizens and the regulator can expect once the breach register becomes operational.