New rules on the collection and processing of personal data will come into force in Kazakhstan on 2 October 2026. The changes were introduced by Order No. 556/НҚ of the Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan dated 17 September 2026.
The changes clarify the rules governing personal data made publicly available and introduce mechanisms for the deletion, anonymisation and masking of such data.
For businesses, this means reviewing existing personal data collection and processing practices, including the transfer of data to third parties and outside Kazakhstan.
Key Changes
1. New Personal Data Definitions
The rules introduce the following definitions:
- deletion — removing data from a digital object in a way that makes it impossible to restore them;
- anonymisation — transforming data so that it is no longer possible to identify the individual to whom the data relates;
- masking — replacing part of the actual data with invalid or anonymised data.
2. Personal Data Made Publicly Available
If an individual or their legal representative has independently made personal data publicly available without specific consent, a person who subsequently collects, disseminates or processes such data will have to demonstrate that their actions are lawful.
Third parties may subsequently collect and disseminate such data provided that they include a link to the source.
Separate consent will not be required for the dissemination of information that legislation expressly requires to be made publicly available.
At the same time, data whose publication is prohibited by law must be protected, including through masking.
3. When Consent Will Be Required
The data subject’s consent will be required, in particular, for:
- cross-border transfers of personal data, except where otherwise provided by law;
- transfers of personal data to third parties;
- processing of personal data in cases established by the new rules.
4. Right to Request Blocking and Deletion of Data
If personal data has been collected or processed in breach of the law, the data subject will be able to request that the owner, operator or third party block and/or anonymise the data.
In cases provided for by law, the data must also be destroyed and/or deleted at the data subject’s request.
What This Means for Businesses
The new rules are relevant to companies that collect and process personal data relating to customers, employees and other individuals.
Businesses should:
- review their personal data collection and processing practices;
- check the legal grounds for transferring data to third parties and outside Kazakhstan;
- assess their use of personal data made publicly available;
- ensure that mechanisms are in place for the deletion, anonymisation and masking of data;
- review internal documents and procedures relating to obtaining consent from data subjects.
How REVERA Kazakhstan Can Help
REVERA Kazakhstan can assist businesses in adapting their personal data processes to the new requirements, including by:
- conducting personal data processing audits;
- reviewing the lawfulness of the collection, storage, transfer and use of personal data;
- drafting and updating personal data processing consents, policies and internal documents;
- analysing cross-border data transfers and transfers of personal data to third parties;
- developing procedures for the deletion, anonymisation and masking of personal data;
- assessing the risks associated with using personal data made publicly available;
- preparing recommendations for bringing business processes into line with the new requirements.
If your business processes personal data in Kazakhstan, the REVERA Kazakhstan team can help assess your current practices and identify the changes that may be required ahead of the new rules coming into force.
