Kazakhstan and the GDPR — a summary comparison

In short

Kazakhstan’s Personal Data Law resembles the GDPR in its set of concepts: principles, consent, data subject rights, protection measures, breach notification. But the logic is different:

• consent is the main ground for processing, and there is no contract or legitimate interest ground (Art. 7(1), Art. 9);
• data must be stored in Kazakhstan (Art. 12(2));
• protection measures are prescribed by lists by category rather than chosen through risk assessment;
• deadlines for handling requests and breaches are measured in days, not weeks;
• fines are fixed and much lower, but there is criminal liability.

GDPR compliance therefore does not mean compliance with Kazakhstan law.

Summary table

No.	Issue	Kazakhstan	GDPR	More
1	Territorial scope	Not expressly regulated	Applies to foreign companies targeting the EU market (Art. 3(2))	Scope
2	Personal data	Information about a subject combined with identifiers	Any information relating to an identifiable person (Art. 4(1))	Scope
3	Roles	Owner, operator, third party	Controller and processor	Scope
4	Legal grounds	Consent; without consent, a closed list in Art. 9	Six equal grounds, including contract and legitimate interest (Art. 6)	Consent, Without consent
5	Content of consent	Closed list of 8 items; withdrawal within 15 working days	Specific, informed, unambiguous; as easy to withdraw as to give	Consent
6	Sensitive data	Restricted-access data, no closed list	Closed list of special categories (Art. 9)	Types of data
7	Children	Through the legal representative, no age set	Online services from 16; States may lower to 13 (Art. 8)	Consent
8	Records of processing	An approved list of personal data	Records of processing activities (Art. 30)	Principles
9	Data subject rights	Deadlines of 1 to 15 working days; no portability or general right to object	One month, extendable; portability, objection (Arts 12–21)	Data subject rights
10	Automated decisions	Prohibited without consent or law; objection handled within 3 working days	Prohibited with exceptions; human intervention (Art. 22)	Automated processing
11	Responsible person / DPO	Mandatory for all legal entities; no independence requirements	Only in certain cases; independence and expertise (Arts 37–39)	Responsible person
12	Protection measures	Closed lists by operator category (small, medium, large)	Based on risk (Art. 32)	Security measures
13	Impact assessment	Not provided for	Mandatory for high-risk processing (Art. 35)	Security measures
14	Security breaches	Notify the regulator within 1 working day, no risk threshold	72 hours, only where there is a risk (Art. 33)	Breaches
15	Localisation	Storage in a database or digital object in Kazakhstan is mandatory	None	Localisation
16	Cross-border transfers	To “countries ensuring protection” — no list; otherwise consent	Adequacy decisions, contractual mechanisms (Arts 44–49)	Cross-border transfers
17	Notifying the regulator before processing	For large operators, from 25 August 2026	None	Notification
18	Regulator	A ministry; inspections of businesses are unscheduled only	Independent supervisory authority (Art. 52)	Regulator
19	Fines	Fixed, up to 2,000 MCI (KZT 8.65 million in 2026)	Up to EUR 20 million or 4% of worldwide turnover (Art. 83)	Liability
20	Criminal liability	Yes, Art. 147 of the Criminal Code	Left to Member States (Art. 84)	Liability

What is similar

• Principles: lawfulness, purpose limitation, minimisation, storage limitation, confidentiality (Arts 5, 7); see “Principles of personal data processing”.
• Basic rights: to know about one’s data, to demand rectification, deletion and blocking, to withdraw consent (Art. 24).
• The duty to apply protection measures and to notify the regulator of breaches (Arts 22, 25).
• Anonymisation: an irreversible transformation after which the data can no longer be attributed to a person (Art. 1(2-5)). The Law does not say expressly whether it takes data outside its scope, as the GDPR does (Recital 26); see “Deletion, destruction, de-identification and anonymisation”.

What a GDPR-compliant company must additionally do

1. Revisit the legal grounds. Where you rely on contract or legitimate interest under the GDPR, in Kazakhstan you need consent or a specific statutory provision. Consent must contain the mandatory information (Art. 8(4)).
2. Store data in Kazakhstan: a database or digital object located in the country, even if the data are also processed abroad.
3. Obtain consent to cross-border transfers. The EU standard contractual clauses are not recognised as a ground in Kazakhstan.
4. Put the mandatory documents in place: an approved list of personal data, a policy, an order appointing the responsible person (Art. 25(2)).
5. Determine the operator category by the number of unique data subjects, apply the protection measures from the Rules for that category, and file a notification if large.
6. Respond faster: breach notification within 1 working day; rectification, blocking and deletion on request within 1 working day; answers to data requests within 3 working days; stopping processing after withdrawal of consent within 15 working days.
7. Stop making paper copies of identity documents (Art. 7(10)).
8. Obtain consent to automated decisions that affect rights, and handle objections (Art. 19-1).
9. Check retention periods against Kazakhstan’s: the Retention Schedule and sector laws.
10. Take account of sector regimes: banking and medical confidentiality, subscriber service information, employment law; see the notes on the financial sector, health, telecommunications and employment.

Interpretation. Items 1–3 are the most costly: they change data architecture and the legal basis for processing. Items 4–9 are mostly a matter of documents and processes that a GDPR-compliant company already has and needs to adapt.

International context

Kazakhstan is not a party to Council of Europe Convention 108 (per the chart of ratifications as of 18 October 2026), and there is no European Commission adequacy decision for Kazakhstan. To transfer data from the EU to Kazakhstan, a European company must use the mechanisms of Arts 46–49 GDPR.

Open questions

Open question: convergence with the GDPR. The 2025–2026 amendments (anonymisation, deletion, automated decisions, operator categories, notification) are moving towards the European model. Will contractual transfer mechanisms and grounds like legitimate interest follow?

Open question: dual compliance. How can a single process meet both GDPR and Kazakhstan requirements where they differ, for example on the breach notification deadline and the role of consent?

Still to research

• A comparison with neighbouring countries — Russia, Uzbekistan, Kyrgyzstan — which also have localisation rules.
• The EU AI Act and Kazakhstan’s AI Law in more detail, as secondary legislation appears.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.