Law: Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V on Personal Data and its Protection ('the Personal Data Law') and  Law on Amendments and Additions to Some Legislative Acts of the Republic of Kazakhstan on the Regulation of Digital Technologies (only available in Kazakh here) ('the Amendment Law')

Regulator: The Government of the Republic of Kazakhstan ('the Government') and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan ('MDAI'), have specific competence in the area of personal data.

Summary: Data protection has been a significant area of interest for the Government of the Republic of Kazakhstan. At present, the Personal Data Law provides general regulations on the collection and processing of personal data, and notably includes broad requirements for data localisation. In addition, the Amendment Law was introduced in July 2020, significantly extending data protection obligations for organisations. The Amendment Law introduces, among other things, further requirements for data collection and processing, obligations for data operators (similar to data processors), and redefines key concepts. The Amendment Law further establishes the competency of the data protection authority including its powers and role.