A summary comparison of Kazakhstan's rules with the GDPR on key issues.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
The basic concepts match — principles, people's rights, protection measures, breach notification. The foundations differ — in Kazakhstan consent is the main ground (there is no contract or legitimate interest ground), data must be stored in the country, protection measures are set by lists, response deadlines are counted in days, and fines are fixed and lower, but there is criminal liability.
More in the note «Kazakhstan and the GDPR — a summary comparison»
Revisit the legal grounds — obtain consent where contract or legitimate interest sufficed under the GDPR; store data in Kazakhstan; obtain consent to transfers abroad; approve a list of data and a policy and appoint a responsible person; determine its category and protection measures; adapt processes to 1–3 working-day deadlines; and stop making paper copies of identity documents.
More in the note «Kazakhstan and the GDPR — a summary comparison»
Note
Three layers of rules on automated decisions: Article 19-1 of the Personal Data Law (prohibited without consent or a statutory basis, right to object with a response within three working days), Article 43 of the Digital Code (explanation and human review) and the 2025 AI Law (prohibited functions, transparency, training data). Plus the 2026 standard on AI in schools: teachers, not systems, decide on grades.
Note
Who oversees compliance with personal data law: the regulator (the Ministry of Artificial Intelligence and Digital Development), local executive bodies and the prosecutor's office. How businesses are inspected — unscheduled inspections only, against a 33-item checklist — and how state bodies are inspected.
Note
Four similar concepts in Kazakhstan law and how they differ; when data must be destroyed or deleted and how fast; when de-identification is required; and how this fits with the right to erasure in the Digital Code and with the GDPR.
Note
What counts as a personal data breach and who notifies whom, and how fast: the operator reports to the regulator within one working day, cybersecurity centres within three hours, and data subjects are notified not by the operator but through e-government. Compared with the GDPR's 72 hours.
Note
In Kazakhstan consent is the main ground for processing, not one of many. This note covers the form of consent, its required content, when separate consent is needed, how the state and non-state services work, how consent is withdrawn, and why proving consent is harder than it seems.
Note
When personal data may be sent abroad: Article 16 of the Law, how it interacts with the consent requirement in Article 7, sector-specific bans, and why the absence of a list of "safe" countries leaves much unclear.
Note
Kazakhstan law splits data not into "ordinary" and "special" as the GDPR does, but into publicly available and restricted-access. There is no list of restricted-access data: it has to be assembled from other laws on medical secrecy, fingerprint and genomic registration and access to information. The answer drives security measures, place of processing and the operator's category.
Note
What rights data subjects have under the Personal Data Law and the Digital Code, how quickly the operator must respond (from one to fifteen working days), how a request is made and where to complain. A summary table of deadlines and a comparison with the GDPR, noting the absence of data portability and a general right to object.
Note
How the Law distinguishes disclosure to specific persons from publication in public sources, when consent is needed, what the rules on self-published data and the ban on "non-purposive extraction" change, and why Kazakhstan law has no familiar "processor" figure.
Note
Administrative liability under Art. 79 of the Code of Administrative Offences — fines from 30 to 2,000 MCI (in 2026, from KZT 129,750 to 8.65 million), how cases are opened and the one-year limitation period for legal entities. Criminal liability under Art. 147 of the Criminal Code and civil liability for damages. A comparison with turnover-based GDPR fines.
Note
A summary table of 20 issues showing where Kazakhstan's personal data rules resemble the GDPR and where they differ fundamentally — legal grounds, localisation, cross-border transfers, deadlines, the responsible person, fines. Plus a list of what a GDPR-compliant company must additionally do for Kazakhstan.
Note
Since 25 August 2026 large owners and operators must notify the regulator before starting and before stopping personal data processing. Who counts as large, what the notification contains, how the register works and what the law does not yet say — on a transition period, how to file and liability.
Note
Article 5 of the Law lists only five principles, phrased as general values. The familiar GDPR principles — purpose limitation, minimisation, storage limitation, accuracy, accountability — also exist in Kazakhstan law but are scattered across other articles and secondary acts. This note maps them in one place.
Note
When data may be processed without consent: the closed list of Article 9 and the special rules for published data. What the list lacks compared with the GDPR — contract, legitimate interest, vital interests — and what that means for employers and ordinary businesses.
Note
How Kazakhstan law limits the purposes and scope of processing, how the retention period is set and what happens once the purpose is achieved. Also: retention periods for HR documents under the 2025 schedule, and the tension between a one-year retention period for consent forms and the duty to prove consent.
Note
Who must appoint a person responsible for organising personal data processing, what that person does and how the role differs from a GDPR DPO. Which internal documents an operator needs depending on its category — small, medium or large — under the 2026 version of the Protection Rules.
Note
The foundations of Kazakhstan personal data law after 2026: the new Constitution, a narrow definition of personal data built on a closed list of identifiers, the roles of owner, operator and third party, the exclusions from the Law, and the unresolved question of whether the Law reaches foreign services.
Note
What security measures the Law requires and how, from September 2026, they depend on the operator's category (small, medium or large by number of data subjects), plus separate rules for restricted-access data. Compared with the GDPR's risk-based approach.
Used for comparison. The GDPR has no general localisation duty: data move freely within the EU (Art. 1(3)), and exports outside the EEA are governed by Chapter V, with the transfer conditions in Arts 44–49.
Open:EUR-Lex (opens in a new tab)official
● Checked 26 October 2026in forceCross-border transfersKazakhstan and the GDPRData localisation
Guidance on Arts 33–34 GDPR: when to notify the supervisory authority (72 hours, where there is a risk) and data subjects (high risk). Useful for contrast with Kazakhstan's one-working-day rule without a risk threshold.
Open:edpb.europa.eu (opens in a new tab)
Not checked against the sourceBreaches and notificationsKazakhstan and the GDPR
EDPB guidance on pseudonymisation: pseudonymised data remain personal data. Useful for mapping Kazakhstan's masking, de-identification and anonymisation concepts. Published for public consultation.
Open:edpb.europa.eu (opens in a new tab)
Not checked against the sourceDeletion and anonymisationKazakhstan and the GDPR
What counts as a "transfer" under GDPR Chapter V. Helps frame the same question for Kazakhstan, where transfer is defined only by territory.
Open:edpb.europa.eu (opens in a new tab)
Not checked against the sourceCross-border transfersKazakhstan and the GDPR
The classic European paper on anonymisation techniques and their risks (singling out, linkability, inference); a useful yardstick for "irreversibility" in Kazakhstan's definitions.
Open:ec.europa.eu (opens in a new tab)
Not checked against the sourceDeletion and anonymisationKazakhstan and the GDPR