Law note · Kazakhstan
Law on Personal Data and Their Protection, data subject rights
What it requires
- An app must let a Kazakhstani data subject learn what personal data is held about them and how it is processed, correct or supplement it, demand it be blocked or destroyed where processing was unlawful, and withdraw consent, including specifically for a cross-border or third-party transfer, within the Law's three and fifteen working day response windows.
When LexLint raises it
crawls_webtrains_models
What we found
Art. 24 gives the subject the right to know about and obtain information on processing, demand correction or supplementation, demand blocking where a violation is alleged, demand destruction where a violation is confirmed, withdraw consent (including specifically for a cross-border or third-party transfer), consent or withdraw consent to public-source distribution, and seek protection of rights and compensation for moral and material damage.
Art. 24 was reworded by Law No. 96-VII (30 December 2021, in force 1 March 2022); the version quoted here is that current text, not the Act's original 2013 wording.
Separately, Art. 8(7) requires the owner or operator to stop processing personal data within fifteen working days of a subject withdrawing consent, or to give a reasoned refusal, a duty carried by Article 8 since before its most recent 2025 and 2026 amendments, though this research could not isolate which of Article 8's five stacked amending laws last touched paragraph 7 specifically.
A newer right was added by Law No. 231-VIII (17 November 2025, in force 17 January 2026) at new Art. 19-1: a subject may object to automated processing of their personal data, and the owner, operator, or third party must consider the objection and respond within three working days. This is the automated-decision-objection right this batch's Israel document flagged as unconfirmed either way; Kazakhstan now has one.