Principles of collecting, processing and protecting personal data, and the purpose of the law.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
The law lists five principles — respect for constitutional rights, lawfulness, confidentiality of restricted-access data, equal rights of individuals and companies, and the security of the individual, society and the state. The familiar European principles — purpose limitation, minimisation, storage limitation — are also in the law, but as specific duties: approve a list of necessary data, use it only for stated purposes and delete it once the purpose is achieved.
No published court or regulator decisions applying the principles on their own have been found so far. Inspections look at specific duties on the inspection checklist; the principles serve mainly as a guide to interpretation.
Note
A summary table of 20 issues showing where Kazakhstan's personal data rules resemble the GDPR and where they differ fundamentally — legal grounds, localisation, cross-border transfers, deadlines, the responsible person, fines. Plus a list of what a GDPR-compliant company must additionally do for Kazakhstan.
Note
Article 5 of the Law lists only five principles, phrased as general values. The familiar GDPR principles — purpose limitation, minimisation, storage limitation, accuracy, accountability — also exist in Kazakhstan law but are scattered across other articles and secondary acts. This note maps them in one place.
Note
How Kazakhstan law limits the purposes and scope of processing, how the retention period is set and what happens once the purpose is achieved. Also: retention periods for HR documents under the 2025 schedule, and the tension between a one-year retention period for consent forms and the duty to prove consent.
The new Constitution, in force from 1 July 2026 in place of the 1995 Constitution (Art. 94). Article 21 for the first time expressly guarantees protection of personal data against unlawful collection, processing, storage and use, including by digital technologies.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceProcessing principlesScope and key terms
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
How to build the inventory of processed data: analyse tasks before processing, state clear and lawful purposes, exclude excessive data (paras 3–4), make the inventory accessible (para 5); a template is annexed. Purpose limitation and minimisation in practice.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceProcessing principlesPurpose, scope and retention