Deletion, destruction, de-identification and anonymisation

In short

Since the 2026 amendments, the Law distinguishes several actions that look alike at first sight (Art. 1). Data must be destroyed or deleted when the purpose is achieved, the retention period expires, the relationship with the data subject ends, a court so decides, or the data were collected without consent (Art. 18). At the data subject’s request, where a breach is confirmed, this must happen within one working day (Art. 25(2)(8)). For statistical, sociological, scientific and marketing research, data are de-identified before being passed on (Art. 17(1)).

Concepts

Term	Definition in the Law	What matters
Destruction	Actions after which the data cannot be restored (Art. 1(6))	General concept, also covers paper
Deletion	Removing data from a digital object so that they cannot be restored (Art. 1(2-4))	Introduced in 2026 for electronic data
De-identification (obezlichivanie)	Actions after which it is impossible to determine to whom the data belong (Art. 1(7))	About the link to the person, not the data themselves
Anonymisation	Irreversible transformation of identifiers, after which it is impossible to determine to whom the data belong (Art. 1(2-5))	Works through identifiers: full name, IIN, facial image, facial biometric vector (Art. 6)
Blocking	Temporary suspension of all actions with the data (Art. 1(3))	Used while a data subject’s complaint is checked
Masking	Replacing part of the data with invalid or de-identified values (Art. 1(3-1))	A protection method; data remain personal

Interpretation. De-identification and anonymisation are defined almost identically: in both cases it is “impossible” to determine to whom the data belong. The difference seems to lie in the method: anonymisation is described through irreversible transformation of identifiers. De-identification under the Collection Rules must also rule out reverse restoration (para 21). Both concepts are therefore closer to anonymisation in the GDPR sense, while masking is closer to European pseudonymisation.

When data must be destroyed or deleted

The grounds are listed in Art. 18:

1. the retention period has expired — it is defined by the date the purposes of collection and processing are achieved, unless the law provides otherwise (Art. 12(2));
2. the relationship with the data subject has ended;
3. a court decision has entered into force;
4. the data were collected and processed without consent, except in the cases of Art. 7(5) and Art. 9;
5. other cases set by legislation.

The owner and operator must take measures to destroy or delete data once the purpose of processing is achieved (Art. 25(2)(4)). Deadlines on a data subject’s request are tight — one working day (Art. 25(2)(8)):

• correct or supplement the data on the basis of documents, or destroy or delete them if correction is impossible;
• block the data if there is information that the conditions of collection and processing were breached;
• destroy or delete them if the breach is confirmed;
• lift the block if the breach is not confirmed.

The data subject’s right to demand blocking, anonymisation, destruction or deletion is set out in Art. 24(1)(3)–(4) and the Collection Rules, para 25. Protection duties apply until the data are destroyed, deleted, anonymised or de-identified (Art. 22(2)).

The right to deletion in the Digital Code

The Digital Code (Art. 41) gives the data subject the right to demand deletion, anonymisation or restriction of processing of data placed or processed in the digital environment “regardless of the basis on which they were obtained”. Where the law sets mandatory retention periods, access is restricted and processing suspended instead of deletion (para 3). The request is not executed where keeping the data is necessary to protect the life and rights of others, for offence proceedings, justice, a public interest, statistics or research with anonymisation, or state functions and services (para 4). The Personal Data Law expressly refers to these exceptions (Art. 18).

Interpretation. “Regardless of the basis on which they were obtained” goes further than the grounds in Article 18 of the Law: under the Code, a data subject can demand deletion of lawfully obtained data too, unless an exception in para 4 applies. This brings Kazakhstan law closer to the European right to erasure (Art. 17 GDPR).

De-identification for research and analytics

• Research. For statistical, sociological, scientific and marketing research, data are de-identified before being passed on (Art. 17(1)). De-identification takes place before dissemination, by any lawful method that rules out reverse restoration (Collection Rules, paras 20–21). The costs are borne by whoever requested the de-identified data, unless otherwise agreed.
• Analytics for state bodies. Data are de-identified by the e-government operator unless the owner has done so (Art. 17(2)).
• National artificial intelligence platform. De-identification follows requirements approved by the Government (Art. 17(3)).

For protection, the Law also provides for masking and hashing in digital objects (Art. 23(2)). The procedure for applying them is to be set by the authorised body. Since September 2026, approving the rules on applying masking and hashing methods has been expressly listed in the regulations of the Ministry of Artificial Intelligence and Digital Development (Government Resolution No. 853).

Comparison with the GDPR

Question	Kazakhstan	GDPR
Right to deletion	Art. 24 of the Law, Art. 41 of the Digital Code	Art. 17 with exceptions in para 3
Deadline	1 working day (Art. 25(2)(8))	Without undue delay, generally within one month (Art. 12(3))
Anonymous data	Concepts exist; no criteria for irreversibility	Outside scope (Recital 26); criteria in WP29 Opinion 05/2014
Pseudonymisation	Close to masking	Data remain personal (Art. 4(5); EDPB 01/2025)

Open questions

Open question: how to prove irreversibility. The Law requires that it be “impossible” to restore who the data belong to, but gives no criteria or methods. European criteria (singling out, linkability, inference) can serve as a guide but are not binding in Kazakhstan.

Open question: backups. Deletion is defined as removal from a digital object. The Law does not say whether the one-day deadline also applies to backups and archives.

Open question: the masking and hashing procedure. The Law tasks the authorised body with setting this procedure (Art. 23(2)). Government Resolution No. 853 (September 2026) assigned the Ministry the function of approving these rules, but the rules themselves have not been found so far.

Still to research

• The procedure for masking and hashing, if approved.
• Data management requirements for the national AI platform (Art. 17(3)).
• Retention periods set by sector laws (employment, tax, archives).

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.