Personal Data in Kazakhstan: Localization, Cloud and What It Means for Development

Personal data in Kazakhstan is governed by the Law of the Republic of Kazakhstan "On Personal Data and Its Protection" dated 21 May 2013 No. 94-V. It requires personal data to be stored in a database or digital object located on the territory of the Republic of Kazakhstan, and permits cross-border transfer only under the conditions of Article 16. For developers, this turns into concrete decisions: where test and production data live, which clouds and SaaS services are acceptable, and whether code and logs may be sent to external services.

Key acts and their status in 2026

• Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V "On Personal Data and Its Protection": in force; the reference system reflects amendments up to September 2026.
• Digital Code of the Republic of Kazakhstan dated 9 January 2026 No. 255-VIII: in force since July 2026. It establishes the rights of data subjects (deletion, anonymization, restriction of processing), including through Article 41, which the updated personal data law refers to.
• Law of the Republic of Kazakhstan dated 9 January 2026 No. 256-VIII: replaced the term "informatization objects" with "digital objects" in the personal data law; in force since 12 July 2026.
• Law of the Republic of Kazakhstan dated 24 June 2026 No. 326-VIII: major amendments, including new Articles 10-1, 23-2 and 25-1 and changes to Articles 12 and 22. The provisions affecting the personal data law entered into force on 25 August 2026.

Law No. 94-V has not been repealed with the arrival of the Digital Code. The two operate in parallel.

Localization: what Article 12 requires

In the current wording of paragraph 2 of Article 12, personal data is stored "in a database and/or digital object located on the territory of the Republic of Kazakhstan". This is the text of the official version of the law in the reference system. Practical conclusions drawn by lawyers (we present them as opinions, not as norms):

• the main current database must be in Kazakhstan; some authors argue that parallel copies abroad are not prohibited;
• the new wording with "digital object" settles the question of whether platforms, applications and cloud environments count as storage;
• hosting the database in Kazakhstan does not resolve the transfer question: a request containing personal data sent to an external SaaS platform or an AI model may be treated as cross-border transfer, and remote access to the production database from abroad is also treated as a transfer by lawyers.

Cross-border transfer: Article 16

Transfer is permitted if the foreign state ensures the protection of personal data. For states without such protection, the law lists exceptions: the data subject's consent, international treaties, specific laws of the Republic of Kazakhstan, protection of human rights when consent cannot be obtained. Transfer may be prohibited or restricted by law. According to legal reviews, there is no official list of "reliable" countries, so the conclusion that protection is adequate should be backed by a written justification. Consent must be verifiable and must state that cross-border transfer will take place.

What the 2026 amendments changed

• Classification of operators (new Article 25-1): by the number of unique data subjects: small (up to 10 thousand), medium (from 10 to 500 thousand), large (over 500 thousand). Processing of restricted-access data raises the category by one level; the authorized body will set protection measures for each category. According to an EY review, the concept of a "unique data subject" is not defined in the law.
• Register of processors (Article 10-1): owners and operators notify the authorized body about the start and end of processing, including the locations where the database is hosted and information on cross-border transfers. According to EY and Morgan Lewis reviews, the notification obligation applies to large operators.
• Register of security breaches (Article 23-2) is maintained by the authorized body, drawing on open sources and data from cybersecurity centers.
• Masking and hashing have been added to the protection methods (Article 23). Deletion of data collected unlawfully, once confirmed, must be completed within one working day.
• Incident notification: the owner or operator must notify the authorized body of a personal data security breach immediately after discovering it (subparagraph 8, paragraph 2, Article 25).
• Automated decisions: Article 19-1 restricts processing that independently creates or terminates a person's rights, without consent or a direct requirement of the law.

What this means for development

These provisions lead to engineering rules that should be built into the development process.

1. Data map. Which fields are personal, where they are stored, and where they go: logs, traces, errors in issue trackers, analytics, backups. Without this map it is impossible to localize data or respond to a data subject's request.
2. Test environments without production data. Use masking and synthetic data: the law explicitly names masking and hashing as protection methods.
3. Protection against leaks through code. Static analysis finds logging of personal data, weak cryptography and hardcoded secrets. See SAST, DAST, SCA and MAST.
4. Dependency control. A malicious package or a vulnerable library is a common leak path. You need an SBOM and component checks during the build.
5. Secrets outside the code. Tokens and access keys for databases containing personal data must live in a secrets store. See secrets management.
6. Logs and response. The obligation to report a leak requires that you can quickly establish the fact and scale of an incident.

Cloud or on-premise for AppSec tools

Source code scanners work with the company's most sensitive asset: its code, which often also includes sample data, secrets and configurations. When such material is sent to an external cloud service, the question arises whether personal data leaves with it and whether this counts as cross-border transfer. For organizations that process citizens' data at scale, the simplest way to remove the question is to run the analyzer inside the company's own perimeter.

• On-premise: code and analysis results stay in your infrastructure; it is easier to explain to a regulator or auditor where everything is stored. The downside is that you operate the platform yourself.
• Cloud SaaS: faster start and less operational work, but you need to check where the servers are physically located, which data from the repository is transmitted, and whether you have a legal basis for the transfer.

DerScanner is supplied as an on-premise platform (SAST, DAST, SCA, MAST), which lets you keep analysis inside your own environment. We cover general approaches to choosing a deployment model in the article on-premise or cloud for AppSec, and the organization of the whole process on the DevSecOps page.

Data subject rights and the Digital Code

The Digital Code strengthens individual rights in the digital environment, which affects how systems are designed:

• Deletion, anonymization, restriction of processing (Article 41 of the Code). If the law requires data to be kept, the company restricts access and suspends processing instead of deleting. Exceptions include a court decision, performance of a contract, and archival or public interest. Products need mechanisms that can actually delete and anonymize records, including copies and logs.
• Algorithmic decisions (Article 43 of the Code). A person has the right to know that an automated system was used, to receive a clear explanation of the key factors behind the decision, and to request its review by a specialist. Disclosing source code or model parameters is not required. If your service makes automatic decisions about a customer, provide a log and the option of manual review.
• Authentication. According to a review by Bluescreen, biometrics cannot be the only login method unless the law provides otherwise.

Common mistakes of development teams

• Personal data in logs and error trackers. A stack trace containing a personal ID number or phone number, sent to a foreign SaaS monitoring service, becomes a cross-border transfer.
• A copy of the production database on test. Without masking, this violates the protection regime and creates a leak risk through a less protected environment.
• External AI assistants and services. Pasting fragments containing personal data into a public model is a transfer, even if the provider stores nothing (this is how lawyers interpret the situation).
• Remote access to production from abroad by contractors and vendor support: lawyers treat it as a transfer.
• No single data owner. Appoint a person responsible for personal data processing and maintain an up-to-date map of data flows.

Frequently asked questions

This article is for information purposes only and does not constitute legal advice. Regulations change quickly: before making decisions, check the current version on adilet.zan.kz.

Sources

• Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Its Protection" (current version)
• EY: amendments to the Personal Data Law (Law No. 326-VIII)
• Morgan Lewis: Kazakhstan data protection law amendments in 2026
• THE TECH: SaaS and foreign AI models: where to store data
• Digital Code: what changes for citizens and business (zakon.kz)
• Law on Personal Data and Its Protection of the Republic of Kazakhstan for 2026 (prg.kz)