🇰🇿Law on Personal Data and their Protection, No. 94-V
Law on Personal Data and their Protection
Law No. 94-V applies to collection, processing and protection of personal data in Kazakhstan, subject to its statutory exclusions.
Core operational duties
Consent and minimisation: Articles 7 to 10 require consent unless an exception applies and restrict processing to personal data that are necessary and sufficient for the stated tasks.
Rights: Articles 22 and 25 support access, correction, blocking, destruction, withdrawal and reasoned responses.
Local storage and transfers: Article 12 requires storage of personal data in a database located in Kazakhstan. Article 16 regulates cross-border transfers and their exceptions.
Security and governance: Articles 22 to 25 require legal, organisational and technical measures, internal policies, proof of consent, destruction after purpose completion and appointment of a person responsible for organising processing by legal entities.
Use the live Adilet consolidation and commencement notes for new amendments. The local PDF is the official Russian consolidation downloaded for this review, while the English text remains unofficial.