For businesses, this rarely looks like a ‘transfer of data abroad’: formally, the company is simply paying for a subscription. However, from the perspective of the Law of the Republic of Kazakhstan ‘On Personal Data and Their Protection’ (the ‘Law’), the use of a foreign cloud solution, as a rule, constitutes a cross-border transfer of personal data. In 2026, the requirements for such transfers were significantly tightened.
This article will be useful to executives and to the IT and legal departments of companies operating in Kazakhstan, including subsidiaries of foreign groups.
What the law considers a cross-border transfer
The Law defines cross-border transfer as the transfer of personal data to the territory of foreign states (Art. 16 of the Law). Such a transfer is carried out provided that those states ensure the protection of personal data. If there is no such protection, transfer is possible only where special grounds exist: in particular, the consent of the data subject to the transfer of their data to the relevant state, an international treaty, or in cases expressly provided for by law.
Localisation and cross-border transfer: two separate requirements
A common mistake is to assume that it is sufficient to comply with one of the requirements. In fact, the law imposes them in parallel.
The first requirement is storage. The Law requires personal data to be stored in a database located in the territory of the Republic of Kazakhstan (Art. 12). This implies the primary localisation of the database in the Republic of Kazakhstan.
The second requirement is transfer. Even where localisation has been ensured, the subsequent transfer of data to a foreign cloud, a foreign parent company or a foreign contractor is assessed separately, under the rules of Art. 16 of the Law.
Compliance with localisation does not legalise cross-border transfer, and the existence of consent to the transfer does not release the company from localisation.
What changed in 2026
Transfer only via secure channels or with encryption
The Rules for the Implementation of Personal Data Protection Measures, as updated by Order No. 338/НҚ of 22 June 2026 (in force since 12 July 2026), require the transfer of personal data to third parties and cross-border transfer to be carried out exclusively via secure communication channels and/or using encryption. The mitigating proviso that previously applied has been removed.
Restrictions under the Digital Code
The Digital Code of the Republic of Kazakhstan No. 255-VIII, which entered into force in July 2026, expressly restricts the placement of source (raw) data, including personal data, outside the territory of the Republic of Kazakhstan within the framework of data circulation on exchange platforms.
New definition of personal data
Information is recognised as personal data if one or more identifiers relate to it (surname, first name and patronymic in combination, individual identification number, facial image, biometric vectors and others). The scope of data subject to regulation has expanded, and with it the volume of information whose transfer abroad requires verification.
Where data transfer occurs in cloud architecture
- the hosting region of the production (working) environment, as well as of backups and the disaster recovery environment – these are often located in different jurisdictions;
- the provider’s sub-processors, i.e. companies it engages to process data: the service itself may be deployed on the infrastructure of a third-party provider;
- technical support and administration, if specialists from other countries have access to the data;
- telemetry, event logs and service usage analytics;
- integrations: mailings, chatbots, call tracking, advertising accounts, BI systems;
- use of customer data to improve the service and train the provider’s models – under many standard terms this is provided for by default, and opting out requires a separate setting or is available only on other terms.
What to check before connecting a service
- the categories of data processed and whether they include restricted-access data;
- the jurisdictions of the production environment, backups and the development environment;
- the list of sub-processors;
- who has access to the data and from which countries;
- whether secure communication channels and/or encryption are ensured during transfer;
- whether the data is used to train models and how this is excluded;
- retention periods, the procedure for deleting data after termination of the contract and the procedure for notifying incidents.
What to set out in the contract with the provider
The standard public offers of foreign providers are geared towards a different regulatory framework and may not cover Kazakh requirements. It is advisable to set out the following in the contract:
- the list and categories of data processed;
- the purposes of processing and a prohibition on processing for other purposes;
- confidentiality obligations and protection measures;
- the procedure for engaging subcontractors;
- the place where data is processed and stored;
- requirements for secure channels and encryption;
- retention periods and the procedure for deleting data.
Incident notification deadline
This condition requires particular attention. The Law gives the owner and the operator one working day to notify the authorised body of a personal data security breach. If the contract with the provider provides for notification ‘within a reasonable time’ or within 72 hours, the company will not be able to comply with the requirements of Kazakh legislation.
Consent of the data subject as a ground for transfer
If data is transferred to a state that does not ensure an adequate level of protection, the most practical ground remains the consent of the data subject. For it to work, consent must be specific: the data subject must understand that their data is being transferred outside Kazakhstan, to which states or to which categories of recipients, and for what purpose.
Typical mistakes
- Judging ‘by the signboard’ – assuming that if a service has a local legal entity or a local domain, the data does not leave Kazakhstan.
- A discrepancy between documents and practice – the privacy policy does not mention cross-border transfer, although in fact it takes place every day.
- Failure to keep records of personal data transfers.
The bottom line
Working with cloud services is not prohibited and does not require abandoning foreign solutions. What is required is something else – an understanding of the data route and the ability to document it.
For a company that maintains a register of the services it uses, knows the jurisdictions where processing takes place, has ensured encryption and the recording of transfers, and has collected proper consents, cross-border transfer does not create critical risks. For the others, the issue usually arises at the least convenient moment – during an inspection, an incident or a due diligence of the company’s activities.
How we can help
The lawyers of REVERA Kazakhstan can help with preparing contracts and data processing agreements (DPAs) with foreign providers; we update privacy policies and data subject consent forms. In addition, we review the terms of use of third-party services, including AI solutions, for the training of models on customer data, and during inspections by the authorised body we represent the company’s interests and challenge orders and fines.
