Data Localisation in Kazakhstan

Localisation requirement — from 1 January 2016

Personal data must be stored in a database or digital object located in Kazakhstan (Art. 12(2)). This requirement has been in force since 1 January 2016, when amendments to Law No. 94-V introduced mandatory data localisation. The requirement applies to databases containing personal data — whether electronic or paper-based. Any owner or operator of personal data operating in Kazakhstan should assume it applies. Its reach over a foreign company with no presence there needs specific analysis.

What data is subject to localisation

The localisation requirement applies to personal data — any information relating to an identified or identifiable individual. This includes: employee data (name, contact details, identification numbers, payroll data, biometric data used for access control); customer and user data (contact details, transaction data, identification data); and operational data that identifies individuals. Data that has been irreversibly anonymised is not personal data and is not subject to localisation.

Infrastructure options for compliance

Companies can satisfy the localisation requirement through: (1) dedicated local servers in Kazakhstan — owned or leased data centre capacity in Kazakhstan; (2) local cloud providers — Kazakhstani cloud infrastructure providers whose servers are physically located in Kazakhstan; (3) hybrid arrangements — localised primary database with a non-localised backup (subject to legal analysis of each specific arrangement). Bond Stone advises on structuring data infrastructure to satisfy the localisation requirement while managing cost and operational efficiency.

Cross-border data flows within localisation framework

Localisation does not prohibit all cross-border data transfers — on the usual reading, a database holding the data must be in Kazakhstan. Subsequent transfers of personal data from the localised database to foreign systems may be permissible subject to cross-border transfer compliance requirements (under Article 16: a country that protects personal data, consent, or another listed ground). Bond Stone advises on structuring lawful data flows for multinationals with Kazakhstan data localisation obligations.

Enforcement — unscheduled inspections

The Ministry of Artificial Intelligence and Digital Development is authorised to conduct unscheduled inspections of entities to verify localisation compliance. Inspections are initiated based on specific facts — including complaints from data subjects. Entities found non-compliant receive mandatory prescriptions requiring remediation. Bond Stone advises on preparing for inspections and managing compliance with mandatory prescriptions.