Banks, microfinance organisations, insurance, credit bureaus.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
Both regimes apply at the same time. Banking secrecy protects information on accounts, transactions and clients, including companies, while personal data law protects any data about people. Secrecy may be lifted for the client, for a third party with the client's consent, and for state bodies as provided by law; the two consents are often combined in one document, but their requirements differ.
Customer due diligence (AML/CFT) records are kept for at least five years after the relationship ends and cannot be deleted at the client's request during that time. Remote account opening and online loans require biometric authentication through National Bank infrastructure. The general rules on storing data in Kazakhstan and on cross-border transfer apply here too; sector requirements on cloud and outsourcing are still to be researched.
Note
How personal data law interacts with banking secrecy, microcredit secrecy, credit history rules and AML/CFT in banks, microfinance organisations and credit bureaus. The new 2026 Banking Law, biometric authentication through the National Bank and retention of customer files.
The new 2026 law replacing the 1995 Banking Law (in force from 18 March 2026, some provisions later). Banking secrecy and disclosure (Art. 69), biometric authentication for remote accounts and loans (Arts 52, 58), client data in asset transfers (Art. 68).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
Defines the National Bank infrastructure handling client data: the Identification Data Exchange Centre (biometric authentication) and the anti-fraud centre (data on transactions showing signs of fraud).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
Microcredit secrecy, the microfinance counterpart of banking secrecy: borrower and loan data are disclosed to the borrower, to third parties with written consent and to state bodies as provided by law (Art. 21).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
Customer due diligence (Art. 5), reporting to the financial monitoring authority (Art. 10) and keeping customer files for at least five years after the relationship ends (Art. 11(4)) — statutory grounds for processing client data.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
Credit histories are built with the borrower's consent; negative information is shared without consent (Art. 25). Data subjects may get their report, dispute entries and set a voluntary self-ban on borrowing free of charge (Art. 22).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial