Kazakhstan requires large data operators to notify state before processing personal data

September 11, 2026 at 04:51 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Kazakhstan now requires large personal data operators to notify the authorized state body before processing data on 500,000 or more unique subjects. The rule follows a law adopted on June 24, 2026, and exempts small and medium-sized operators. The notification must detail what data is collected, where it is stored, and whether it is transferred to third parties or abroad.

Key Facts

The law was adopted on June 24, 2026, and introduces a three-tier classification of personal data operators based on the number of unique subjects.
Large operators are those processing data on 500,000 or more unique subjects and must notify the authorized body before processing begins.
Small operators handle data on up to 10,000 unique subjects, while medium operators handle between 10,000 and 500,000.
The notification must include what data is collected, where the database is stored, whether data is transferred to third parties or abroad, and what protection measures are applied.
The authorized body enters the company into a register within 30 working days of receiving the notification.

Notification Requirements

Companies must indicate in the notification which data they collect, where the database is stored, whether information is transferred to third parties or abroad, and what protection measures are applied. The authorized body enters the company into a register within 30 working days. The Ministry of Justice is also introducing SMS notifications for citizens when a notary accesses their personal data. A notary who views information without legal grounds risks losing their license.

Operator Classification

The law divides owners, operators, and third parties working with personal data into three categories: small, medium, and large. Small operators work with data on no more than 10,000 unique subjects. Medium operators process data on between 10,000 and 500,000 people. Large operators process data on 500,000 or more unique subjects and must notify the authorized body before processing begins.

Exemptions and Context

Small and medium-sized businesses are exempt from mandatory notifications. The rule applies only to large owners and operators of personal data. Vice Minister of Justice Botagoz Zhakselekova emphasized that the new Digital Code pays special attention to personal data security.