Timeline
Key dates: adoption, publication and entry into force of personal data legislation.
2026
- in force
Amendments to the Credit Bureau Law (Law No. 352-VIII) take effect: mostly terminological — "digital systems" instead of "information systems", information security in the financial sector; consent rules (Art. 25) unchanged
- in force
Protection Rules as restated by Order No. 534/NK take effect — tiered measures by operator category, new numbering
- adopted
Protection Rules restated (Order No. 534/NK)
- in force
2026 amendments take effect — "digital object" in the localisation rule, notification, operator categories
- in force
New version of the Breach Notification Rules takes effect (Order No. 232/NK)
- in force
New version of the Protection Rules takes effect
- in force
New Constitution takes effect; the 1995 Constitution ceases to apply
- published
Law No. 326-VIII published
- adopted
Law No. 326-VIII adopted — amending package on personal data
- adopted
New Constitution adopted by national referendum; Art. 21 expressly guarantees personal data protection for the first time
- adopted
Digital Code adopted; in force six months after publication
2025
- published
AI Law published; in force after 60 calendar days
- adopted
AI Law adopted; Article 19-1 on automated processing added to the Personal Data Law
- in force
Protection Rules add the requirement to store electronic data in a server room or data centre in Kazakhstan
2024
- adopted
Inspection checklist on personal data approved
2016
- in force
The in-country storage requirement takes effect
2013
- adopted
Personal Data Law adopted