Support Centre



Law: Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V on Personal Data and its Protection ('the Personal Data Law') and  Law on Amendments and Additions to Some Legislative Acts of the Republic of Kazakhstan on the Regulation of Digital Technologies (only available in Kazakh here) ('the Amendment Law')

Regulator: The Government of the Republic of Kazakhstan ('the Government') and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan ('MDAI'), have specific competence in the area of personal data.

Summary: Data protection has been a significant area of interest for the Government of the Republic of Kazakhstan. At present, the Personal Data Law provides general regulations on the collection and processing of personal data, and notably includes broad requirements for data localisation. In addition, the Amendment Law was introduced in July 2020, significantly extending data protection obligations for organisations. The Amendment Law introduces, among other things, further requirements for data collection and processing, obligations for data operators (similar to data processors), and redefines key concepts. The Amendment Law further establishes the competency of the data protection authority including its powers and role.

Browse more jurisdictions:


The interest of business, especially foreign investors, in the Astana International Financial Centre (AIFC) has been growing steadily over the past years. In the framework of the AIFC, Kazakhstan has, for the first time in the post-Soviet space, introduced a special jurisdiction based on the principles of the laws of England and Wales. The AIFC aims to attract investments to the Kazakhstan economy, develop local capital markets, and create effective projects in the sphere of production and services. As of February 7, 2024, 2,537 companies are registered in the AIFC.1 The regulatory framework of the AIFC has been actively developing. In this article, Yekaterina Khamidullina, Partner at AEQUITAS Law Firm, considers the legal regulation of personal data protection in the AIFC, the basis of which is formed by the AIFC Data Protection Regulations (the Regulations) and the AIFC Data Protection Rules.