Personal Data Protection in Kazakhstan 2026: What Businesses Need to Do
From August 25, 2026, personal data protection in Kazakhstan has become noticeably stricter. Law No. 326-VIII of June 24, 2026, rewrote part of the basic law "On Personal Data and Their Protection" of 2013: mandatory masking and hashing were introduced, operators were classified by the number of subjects, a state registry of leaks was established, and the requirement to store data in a database or digital object on the territory of the republic was clarified. And from September 22, any security breach must be reported to the authorized body within one working day.
At West Star Ltd, we build integrations with 1C, web services, and AI agents for Kazakhstani companies, and in almost every project in recent months, the same question has arisen: "Is this even allowed for us?" Can we store the client database in a foreign cloud, send correspondence to a neural network, or upload employees to an HR service? In this material, we analyze what has really changed, who it concerns, and what minimum needs to be done to avoid ending up in the registry of violators.
Personal Data Protection: What Has Changed in the Law
The basic structure remains the same: there is a subject (a person whose data is being processed), there is an owner and operator of the database, there is consent, and there is an authorized body — currently, the Ministry of Artificial Intelligence and Digital Development. But the 2026 amendments have made the law much more "technical."
Firstly, the law introduced the concepts of deletion, anonymization, masking, and hashing. Previously, a company could formally "destroy" a record, leaving its copies in backups and exports. Now, deletion is a separate operation with a clear result, and masking and hashing in digital objects are established as mandatory protection methods. Simply put, a client's IIN should not be in plain text in every table and log.
Secondly, the law introduced a closed list of identifiers: full name in combination, IIN, facial image, and biometric facial vector. This is important for those who install recognition cameras or collect photos in questionnaires — a facial image is now explicitly named as an identifier.
Thirdly, if illegal collection or processing is confirmed, the operator is obliged to destroy or delete the data within one working day. A week for "dealing with the contractor" is no longer provided.
Fourthly, a registry of personal data security violations has appeared. It is maintained by the authorized body based on publicly available sources and information from cybersecurity centers. In other words, the state may learn about your leak not from you, but from a Telegram channel — and this will be entered into the registry.
All this does not cancel what was adopted earlier. The Digital Code, signed on January 9, 2026, enshrined citizens' rights to limit processing and anonymization — we analyzed it in detail in the material on the Digital Code of the Republic of Kazakhstan. And the Artificial Intelligence Law of November 17, 2025, added requirements for AI systems.
Small, Medium, or Large Operator
The new Article 25-1 divides operators into three classes based on the number of unique subjects in the database:
- small — up to 10,000 people;
- medium — from 10,000 to 500,000;
- large — 500,000 and above.
If you process restricted access data — health, biometrics — the category is raised by one level. A clinic with a database of 50,000 patients is legally in the same class as a large retailer.
Large operators are required to notify the authorized body about the start and cessation of processing, and the body enters the information into the registry within 30 working days. Small and medium operators do not need to notify — but this is the only relief. All are required to store data in Kazakhstan, obtain consent, mask identifiers, and report leaks.
There is an unobvious detail: the concept of a "unique subject" is not disclosed in the law. Should employees, clients, newsletter subscribers, and website visitors with a feedback form be counted separately? Consultants have already sent a request to the state body. In our practice, we advise counting to the maximum — combined across all company systems. An online store with 8,000 customers, 3,000 subscribers, and 200 employees easily crosses the 10,000 threshold.
Localization and Neural Networks: Where to Store and Where to Transmit
Paragraph 2 of Article 12 in the new edition requires storing personal data in a database and (or) digital object located on the territory of Kazakhstan. A digital object is both a platform, an application, and a cloud environment. No transition period was provided for existing operators.
Parallel storage abroad is not directly prohibited, but the Kazakhstani copy must be the main and up-to-date one, not an archive updated quarterly. A separate order on protection requirements in the edition effective from July 12, 2026, clarifies: databases with personal data are placed in a server room or data center in Kazakhstan, and restricted access data is collected and processed through digital objects located in the country.
What this means in practice. CRM on foreign SaaS, where all clients live, is a risk. A Google sheet with a list of employees and their IINs is also a risk. 1C on a server in a Kazakhstani data center with a replica in an external analytics service is permissible if the main database is here and the replica does not contain unnecessary data.
The most painful question of 2026 is working with AI. Localization under Article 12 does not close the requirements of Article 16 on cross-border transfer. Even if your server is in Almaty, sending text with personal data to a foreign provider's model is a cross-border transfer. It doesn't matter whether the provider stores the request or deletes it immediately. Access of foreign contractor personnel to the working database is also a cross-border transfer.
Transfer is allowed to countries that ensure personal data protection, and to others — only in cases explicitly specified in the law, and for a commercial service, in practice, this is the subject's consent. Moreover, the consent must be verifiable and explicitly mention cross-border transfer. The wording "by continuing to use the service, you agree" is considered insufficient by lawyers.
Therefore, when we design AI solutions for business, the architecture is almost always built the same way. Before sending to the model, data goes through a layer of de-identification: full names are replaced with labels, IINs and phone numbers are masked, photos are not sent at all. The model sees "Client A ordered 3 items and requests to reschedule delivery," and the label is matched to the real person within the company's perimeter. For tasks with medical or biometric data, we recommend models deployed in Kazakhstan or not sending such data to external AI at all.
This is not over-caution. A support chatbot that forwards the entire correspondence with phone numbers and addresses to a neural network is a typical example of unconscious cross-border transfer. The company finds out about this when they are audited.
Leak: What to Do in the First 24 Hours
From September 22, 2026, updated rules for notifying about security breaches are in effect. The owner or operator reports the breach to the authorized body within one working day from its discovery. The notification includes contacts of the person responsible for organizing processing, measures taken, and data of affected subjects — full name and IIN or phone number, so they can be notified.
For a personal data protection system, one working day is a very strict standard if no one in the company knows who is responsible for the incident. Therefore, a response plan is needed in advance, not when the database has surfaced in the public domain. It should answer four questions: who records the incident, who assesses the scale, who prepares the notification, and who signs it.
Sanctions are also increasing. Article 79 of the Administrative Code provides for fines differentiated by business size, and they were already increased in March 2025. In spring 2026, the ministry proposed raising the ceiling to 5000 MRP — about 21.6 million tenge at 4325 tenge per MRP — and introducing criminal liability for mass leaks. This is still a project, but the direction is clear.
Pitfalls and Limitations
Honestly about where the law and practice still diverge and where companies most often make mistakes:
- Unclear definitions. "Unique subject" is not defined, the procedure for maintaining the violation registry is not disclosed. Some requirements will have to be interpreted until clarifications appear, and the interpretation may change.
- Backups and logs. Deleting a record from CRM is easy, but from backups, web server logs, and Excel exports — not so much. This is where "deleted" data often remains.
- Contractors. Outsourced accounting, mailing service, developer with access to the production database — each of them processes your data. Responsibility to the subject still lies with you.
- De-identification is not absolute. A masked sample from rare professions in a small town can uniquely identify a person. Anonymization requires verification, not just a checkbox.
- Cost of localization. Moving from foreign SaaS to a Kazakhstani data center or local server is money and time for migration, especially if the system is integrated with 1C and the website.
- Paper security. A privacy policy on the website is worthless if the database password is in a public chat. They check the fact, not the documents.
What follows from this in practice depends on the role. A specialist — accountant, HR, IT administrator — should start with inventory: where personal data is stored, in which systems, tables, and chats, who has access to them. Usually, this is an unpleasant discovery: employee data is not only in 1C:ZUP but also in five Excel files, on personal laptops, and in a messenger.
A manager should appoint a person responsible for organizing processing and approve a leak response plan with specific people and deadlines. The second step is to review consent forms on the website and in questionnaires: consent must be explicit, verifiable, and mention cross-border transfer if it exists.
An owner should assess the operator class and localization decision. If the main database lives abroad, a relocation plan and budget are needed. At the same time, decide how the company uses AI: prohibit employees from copying client data into public chatbots, and for useful scenarios, build a controlled process through de-identification. Part of the work — masking, access control, logging, deletion on request — is well automated at the business process level, rather than relying on people's discipline.
Personal data protection in 2026 has ceased to be a section in a privacy policy that no one reads. It is a property of architecture: where the server is located, what goes into the neural network, who sees the IIN, and how quickly the company detects a leak. Those who embed these answers into their systems now will gain not only peace of mind during an audit but also customer trust, which in an era of regular leaks becomes a competitive advantage.
Frequently Asked Questions
Does a small business need to notify the state body about personal data processing?
No, if the database has fewer than 500,000 unique subjects and no restricted access data that raises the category. Notification of the start and cessation of processing is mandatory only for large operators. But the requirements for consent, storage in Kazakhstan, protection, and reporting a leak within one working day apply to everyone, including individual entrepreneurs with a small client base.
Can a client database be stored in a foreign cloud?
The main and up-to-date database with personal data must be located on the territory of Kazakhstan — in a database or digital object located in the country. A parallel copy abroad is not directly prohibited, but it is a cross-border transfer: consent of the subjects or transfer to a country that ensures data protection is required. The safest option is the main circuit in a Kazakhstani data center.
Can ChatGPT, Claude, and other neural networks be used with client data?
Sending personal data to a foreign provider's model is considered a cross-border transfer, even if the provider does not store it. A practical way is to de-identify data before sending: replace full names with labels, mask IINs and phones, do not send photos and medical information. Then the model solves the task, and personal data remains within the company.
What are the consequences for a company for a personal data leak?
Administrative fines under Article 79 of the Administrative Code, the amount of which depends on the business category, plus inclusion in the state registry of violations and reputational damage. The ministry proposed raising the maximum fine to 5000 MRP and introducing criminal liability for mass leaks — this is still a project.