Law: Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V on Personal Data and its Protection (the Personal Data Law) and  Law on Amendments and Additions to Some Legislative Acts of the Republic of Kazakhstan on the Regulation of Digital Technologies (only available in Kazakh here) (the Amendment Law)

Regulator: The Government of the Republic of Kazakhstan (the Government) and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan (MDAI), have specific competence in the area of personal data.

Summary: On May 21, 2013, the Law on Personal Data and its Protection No. 94-V (the Personal Data Law) came into effect, establishing itself as the primary legal framework governing personal data in the Republic of Kazakhstan. This law provides general regulations for the collection and processing of personal data, including extensive requirements for data localization. In addition, the Constitution of the Republic of Kazakhstan (the Constitution) also forms part of Kazakhstan's data protection framework by guaranteeing the right to personal and family privacy.

Furthermore, in July 2020, the Law on Amendments and Additions to Some Legislative Acts of the Republic of Kazakhstan on the Regulation of Digital Technologies (only available in Kazakh here) (the Amendment Law) was introduced, which significantly expands the data protection obligations for organizations. Among other provisions, the Amendment Law introduces additional requirements for data collection and processing, outlines obligations for data operators (similar to data processors), and redefines key concepts. Additionally, the Amendment Law delineates the competence of the data protection authority, specifying its powers and role.

Notably, the Amendment Law establishes a recourse mechanism in case personal data is illegally collected, processed, or disclosed. It also outlines penalties that can be imposed on individuals and organizations failing to comply with the provisions set out in the law.