A library of materials on personal data protection in Kazakhstan — statutes, secondary legislation, regulator guidance, case law and articles, each with a short annotation — plus working notes by topic.
This is not legal advice. Notes reflect a current understanding of the subject, are updated over time and always link to primary sources. Notes are written in Russian; English summaries are provided.
Note
Three layers of rules on automated decisions: Article 19-1 of the Personal Data Law (prohibited without consent or a statutory basis, right to object with a response within three working days), Article 43 of the Digital Code (explanation and human review) and the 2025 AI Law (prohibited functions, transparency, training data). Plus the 2026 standard on AI in schools: teachers, not systems, decide on grades.
Note
Who oversees compliance with personal data law: the regulator (the Ministry of Artificial Intelligence and Digital Development), local executive bodies and the prosecutor's office. How businesses are inspected — unscheduled inspections only, against a 33-item checklist — and how state bodies are inspected.
Note
Four similar concepts in Kazakhstan law and how they differ; when data must be destroyed or deleted and how fast; when de-identification is required; and how this fits with the right to erasure in the Digital Code and with the GDPR.
A sector act on AI in schools with express rules on pupils' data: school staff, not the system, decide on grades and discipline (para 4); materials are anonymised before being passed to third-party AI services (para 5); no demanding a pupil's full prompt history (para 8).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AI
The new Constitution, in force from 1 July 2026 in place of the 1995 Constitution (Art. 94). Article 21 for the first time expressly guarantees protection of personal data against unlawful collection, processing, storage and use, including by digital technologies.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceProcessing principlesScope and key terms
Personal medical data, the fact of seeking care, health status and diagnosis constitute medical secrecy (Art. 273(1)); Art. 273 lists when they may be disclosed without consent, and Art. 62 covers digital resources with medical data.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceTypes of personal dataHealthcare