Automated processing and artificial intelligence

In short

Since early 2026, automated processing that gives rise to, changes or terminates a data subject’s rights and legitimate interests has been prohibited without the subject’s consent or an express statutory basis (Art. 19-1(1)). The subject must be told how the processing works and what its consequences may be, and must be able to object; an objection is considered within three working days (Art. 19-1(2)–(3)). The Digital Code adds a right to an explanation of the key factors behind a decision and to human review (Art. 43). The AI Law prohibits a number of AI system functions, including unlawful processing of personal data and emotion recognition without consent (Art. 17(3)). A sector example is the standard on the use of AI in schools: teachers decide on grades, and materials are anonymised before being passed to external AI services (paras 4–5).

What automated processing is

It is processing of personal data by an informatisation object “excluding the participation” of the owner, operator and third party in the processing (Art. 1(2-3)). The Digital Code separately defines a fully automated decision — one taken without human involvement in assessing the circumstances or approving the result (Art. 43(3)) — and an algorithmic system, which takes or influences decisions on the basis of automated data processing, including AI systems (Art. 43(1)).

The Personal Data Law: Article 19-1

The article was added by Law No. 231-VIII of 17 November 2025, adopted on the same day as the AI Law.

• Prohibition. Automated processing that gives rise to, changes or terminates the subject’s rights and legitimate interests is allowed only with consent or in cases provided for by law (Art. 19-1(1)).
• Transparency. The subject must be told how the processing works and its possible consequences, given the opportunity to object, and told how to protect their rights (Art. 19-1(2)).
• Objection. It is considered within three working days and the subject is notified of the result; the operator’s actions may be challenged (Art. 19-1(3)).

Interpretation. The prohibition presumably covers automated credit scoring that leads to refusal of a loan, automated blocking of an account or card, and automated screening of job applicants. For such processes, automated processing should be mentioned specifically in the consent, its consequences described, and a way to receive objections set up.

The Digital Code: Articles 5 and 43

Algorithmic and automated decisions are applied in compliance with transparency, non-discrimination and the possibility of control by the subject (Art. 5(3)). Decisions of algorithmic systems must not lead to discrimination (Art. 43(2)). A person subject to a fully automated decision is entitled, “in the cases and manner established by legislation” (Art. 43(4)):

1. to learn that an algorithmic system was used;
2. to receive an explanation of the key factors and criteria behind the decision, without disclosure of algorithms, source code or protected secrets;
3. to demand review of the decision with the involvement of an authorised specialist, if the decision has legal consequences or may affect their rights.

The AI Law

Law No. 230-VIII of 17 November 2025 entered into force 60 calendar days after its publication on 18 November 2025 (Art. 31). Provisions relevant to personal data:

• Automated decisions. Requirements for decisions based solely on automated processing of personal data are set by personal data legislation (Art. 21(4)). A user subject to decisions taken with AI has the right to be informed about the automated processing and its consequences and about the possibility to object (Art. 7(2)).
• User rights. To receive explanations of results affecting their rights; to request information about the data on which a decision was based; to refuse to interact with AI where interaction is not mandatory by law (Art. 16(1)).
• Data protection. AI may be operated only in compliance with data protection requirements, without unlawful collection, storage or dissemination of personal data (Art. 10).
• Prohibited functions (Art. 17(3)): assessing and classifying people by social behaviour or personal characteristics (social scoring), save as provided by law; collecting and processing personal data in breach of the law; classifying people by biometric data to infer race, political views or religion for discriminatory purposes; emotion recognition without consent, save as provided by law; manipulative techniques and exploiting vulnerabilities.
• Transparency. Users are informed that goods and services are produced or provided using AI; synthetic content is labelled (Art. 21(1)–(2)).
• Risk management. Owners and operators of AI systems review risks at least once a year (Art. 18).
• Model training. On datasets within predetermined and lawful purposes; dataset owners must comply with personal data legislation (Art. 27(2)–(3)). An audit of AI systems assesses whether datasets were used lawfully (Digital Code, Art. 100(4)).

Training AI on personal data

There are no special rules, so the general ones apply:

• a ground for processing is needed — consent or an Article 9 case (Art. 7(1));
• the training purpose must be stated in advance — using data collected for other purposes is problematic (see the note “Purpose, scope and retention of personal data”);
• non-purposive extraction of data from public sources to build databases is prohibited (Art. 7(11));
• open AI systems may be used for restricted-access data only in compliance with informatisation legislation, and local systems are intended for such data (AI Law, Art. 17(4)).

Interpretation. Sending personal data to external AI services (chatbots, cloud models) whose servers are abroad is a cross-border transfer and sometimes a localisation issue. See the notes “Cross-border transfers of personal data” and “Personal data localisation in Kazakhstan”.

AI in schools: a sector standard

Since 28 September 2026, schools have been subject to the Standard on the use of artificial intelligence in secondary education (Order of the acting Minister of Education No. 283-NK). It applies to all secondary schools regardless of ownership (para 2) and carries the general rules on automated processing over to work with pupils:

• a person decides: decisions on grading, educational or disciplinary measures and other decisions directly affecting a pupil’s rights may not be made automatically without the responsible member of school staff (para 4). AI may help analyse work and prepare feedback, but the teacher gives the final grade (para 11);
• anonymisation before external services: learning materials passed to third-party AI tools are anonymised beforehand, unless the law provides for processing of the personal data they contain by that tool (para 5);
• pupils’ accounts are created taking into account the AI tool’s age limits and, where the law so provides, with the consent of a legal representative (para 6);
• no unnecessary information: a pupil may not be required to hand over their full history of AI prompts or the share of AI-generated content unless this is relevant to the purpose of the task (para 8);
• AI detectors give a probabilistic assessment and do not in themselves prove a breach of academic integrity; the pupil is given the opportunity to explain how the work was done (paras 14–15);
• the school’s responsibility: the head ensures compliance with the standard, and the school ensures safe use of AI, informs pupils and their legal representatives and complies with cybersecurity requirements (para 16).

The standard sets no retention periods or deletion rules: personal data processing when using AI follows personal data legislation (para 5).

Interpretation. The ban in para 4 is stricter than the general rule: Art. 19-1 of the Law allows automated processing that changes rights with the data subject’s consent, whereas the standard always requires a member of school staff to be involved. Anonymisation under para 5 also removes the cross-border transfer question where the AI service runs abroad, but only if the anonymisation really makes it impossible to identify the pupil.

Comparison with the GDPR and the AI Act

Question	Kazakhstan	EU
Automated decisions	Prohibited without consent or law where rights are affected (Art. 19-1)	Decisions based solely on automated processing with legal or similarly significant effects are prohibited; exceptions: contract, law, explicit consent (GDPR, Art. 22)
Safeguards	Explanation, objection within 3 working days; explanation and review under Digital Code Art. 43	Human intervention, expressing one’s view, contesting (Art. 22(3)); information about the logic (Art. 15(1)(h))
AI regulation	AI Law: risk and autonomy levels, prohibited functions	AI Act (Regulation 2024/1689): risk levels, prohibited practices, requirements for high-risk systems
Emotion recognition	Prohibited without consent, save as provided by law	Prohibited in the workplace and education, except for medical or safety reasons (AI Act, Art. 5)
AI in education	2026 standard: decisions on grades and discipline only with a member of school staff (para 4)	Systems evaluating learning outcomes are high-risk (AI Act, Annex III, point 3)

Open questions

Open question: “excluding the participation”. Is the formal involvement of a person who approves the system’s decisions without examining them enough for processing to stop being automated?

Open question: “rights, legitimate interests”. Do personalised advertising, dynamic pricing or search ranking affect rights?

Open question: user and data subject. The AI Law speaks of the rights of the “user”, but the person a decision concerns may not be a user (for example, a job applicant whose CV is screened). Do Arts 7 and 16 apply to them?

Open question: anonymised data. May models be trained on anonymised data without consent, and do such data fall outside the Law?

Still to research

• Secondary legislation under the AI Law: classification rules, the list of documentation, audits.
• Whether a procedure for reviewing automated decisions under Digital Code Art. 43 has been established.
• Sector rules on scoring (banking regulation, credit bureaus).

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.