🇰🇿
Kazakhstan
Law on Personal Data and Its Protection (2013)
Asia🔵 Substantial
Compliance Score
36%
5 Addressed
7 Partial
2 None
Authority
Ministry of Digital Development, Innovations and Aerospace Industry and designated state bodies
Overview
Kazakhstan's 2013 law regulates personal-data collection, processing, storage, and protection, including localization-related requirements. The competent authority and current rules should be checked against the latest government structure.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
AddressedBreach Notification
PartialDPO Requirements
PartialChildren's Data
PartialPenalties & Enforcement
AddressedSector-Specific Rules
PartialCookie/Tracking
PartialAI & Automated Decisions
NoneData Localisation
PartialSignificant Data Fiduciary
NoneGovernment Data
Partial? Frequently Asked Questions
What is the primary data protection law in Kazakhstan?+
Kazakhstan is governed by the Law on Personal Data and Its Protection (2013). The law is enforced by the Ministry of Digital Development, Innovations and Aerospace Industry and designated state bodies. According to our analysis, the country has a Substantial level of data protection framework.
Does Kazakhstan require a Data Protection Officer (DPO)?+
Partially. The Law on Personal Data and Its Protection (2013) may require a DPO only for specific high-risk organizations or sectors. It is not universally mandatory for all businesses.
What are the data localisation rules in Kazakhstan?+
Partially. While Law on Personal Data and Its Protection (2013) may not mandate general localisation, specific sectoral laws (like finance or health) might require data to be stored locally.
What are the breach notification requirements in Kazakhstan?+
The Law on Personal Data and Its Protection (2013) has limited breach notification requirements. It may only require notifying the regulator, without mandating notification to affected individuals.