Law note · Kazakhstan
Law on Personal Data and Their Protection, localization and cross-border transfer
What it requires
- An app storing or processing the personal data of individuals in Kazakhstan, including a voiceprint or other biometric identifier, must maintain a database located within Kazakhstan; Kazakhstani law does not on its own text forbid an additional copy abroad. Transferring that data to another country requires that the destination state ensure equivalent protection, or one of four fallback grounds: the subject's consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotprocesses_biometricsprocesses_voice
What we found
Art. 12(2) requires a database of Kazakhstani personal data to be located inside Kazakhstan, unqualified by citizenship and, on the text read, not framed as forbidding an additional copy abroad; it answers where data is stored, not whether it may also leave the country. This storage duty was introduced by Law No. 419-V, in force 1 January 2016; Art. 12(2) did not exist in this form at the base Act's 2013 commencement.
Art. 16 answers the leaving-the-country question separately, and its general permitted-transfer grounds (paragraphs 1-4: an adequacy-equivalent destination, or one of four fallback grounds, subject consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained) are original 2013 text, unamended since the base Act's commencement; a sector law may impose a harder bar than the general Law does.