Cross-border Data Transfers in Kazakhstan

Cross-border transfer framework

Law No. 94-V permits cross-border transfers of personal data where the receiving country protects personal data (Art. 16(2)). Kazakhstan does not maintain a published list of adequate countries, which means that businesses must conduct their own adequacy assessment for the receiving jurisdiction before transferring personal data. Where it does not, transfer may still take place with the data subject's consent, under a ratified treaty, in cases set by law for listed public interests, or to protect constitutional rights where consent cannot be obtained (Art. 16(3)). A law may also prohibit or restrict a transfer (Art. 16(4)).

Adequate jurisdiction transfers

Personal data may be transferred to jurisdictions that ensure adequate protection of personal data. Because Kazakhstan publishes no official list, treating the EU, the UK or other GDPR-style regimes as adequate is a working assessment, not a ruling. Bond Stone advises on jurisdiction-specific assessments before cross-border data flows are set up.

Non-adequate jurisdiction transfers — consent requirement

Where the receiving jurisdiction does not ensure adequate personal data protection, the usual basis is the data subject's consent to the cross-border transfer, given in writing, through a service or in another provable way (Arts. 8(1), 16(3)). Consent cannot be withdrawn where that would contradict the law or while an obligation remains unperformed (Art. 8(2)). Bond Stone advises on designing consent mechanisms for cross-border transfer scenarios — including employee data transfers to non-adequate group company locations and customer data transfers for international service delivery.

Intercompany data sharing arrangements

Multinational groups operating in Kazakhstan frequently transfer personal data between group entities across jurisdictions — for HR platform consolidation, shared services, ERP systems, and data analytics. Bond Stone advises on structuring intragroup data sharing agreements (data processing agreements and controller-to-controller transfer agreements) compliant with Kazakhstan's cross-border transfer requirements, alongside any localisation obligations. An agreement supports a transfer but does not replace an Article 16 ground.

Interaction with localisation requirement

Cross-border transfer compliance is a separate requirement from data localisation — both must be satisfied simultaneously. Personal data must be stored in a database located in Kazakhstan (Art. 12(2)); subsequent cross-border transfers from the localised database are subject to the transfer requirements above. Bond Stone advises on managing both localisation and transfer compliance within the same data architecture.