Personal data protection in the Republic of Kazakhstan

The Republic of Kazakhstan is considering accession to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention №108) as an observer state. Kazakhstan regards cooperation with Committee of Convention №108 as an important step toward strengthening international dialogue and aligning national legislation with international standards in the field of privacy and personal data protection.

Since 2020, the Ministry of AI and Digital Development has served as the authorized body in the field of personal data protection. The Ministry is responsible for policy development, oversight and compliance, consideration of complaints, and protection of individuals' rights.

Kazakhstan has established a legal and institutional framework for personal data protection based on the principles of transparency, data minimization, and purpose limitation. The national framework includes the Law «On Personal Data and Their Protection» and the Law «On Cybersecurity».

In 2026, a new version of the Constitution was adopted, further strengthening constitutional guarantees for privacy and personal data protection. Article 21 protects individuals from unauthorized collection, processing, storage, and use of personal data, including through digital technologies.

Kazakhstan's legislation provides individuals with the right to receive information about the purposes, means, and conditions of personal data processing, the right to withdraw consent for processing and transfer of data, the right to request modification, blocking, or destruction of personal data.

The country continues to modernize its regulatory framework in response to emerging digital and cybersecurity challenges. Recent reforms include strengthened administrative liability for violations in the field of personal data protection, obligations to notify citizens in the event of data breaches, restrictions on unauthorized export of data, notification requirements regarding the commencement of personal data processing, and the development of mechanisms for depersonalised data. Kazakhstan is also introducing additional cybersecurity and cyber hygiene requirements for organizations and employees.

Kazakhstan has implemented a nationwide Personal Data Access Management System that enables citizens to provide or withdraw consent for personal data processing and receive notifications regarding actions involving their personal data. The system processes over 45 million requests per month.

Special attention is also given to cybersecurity capacity building and human capital development. Cybersecurity specialists are trained in universities and specialized programs, annual national cyber exercises are conducted, and professional development initiatives are implemented through academies, international training programs, and cyber ranges. Kazakhstan additionally promotes public cyber culture initiatives and awareness campaigns aimed at strengthening digital resilience.

Kazakhstan actively participates in international cooperation on cybersecurity and digital governance within the framework of the United Nations, the OSCE, and the Budapest Convention on Cybercrime. The country is also among the leading CIS states in the ITU Global Cybersecurity Index and continues efforts to strengthen legal, technical, and institutional measures in this field.

Kazakhstan considers engagement with Committee of Convention №108 as an opportunity to deepen cooperation with the Council of Europe and partner states, exchange expertise and best practices, strengthen trust in digital services and personal data protection mechanisms.

The Republic of Kazakhstan expresses its readiness for constructive dialogue and further cooperation within the framework of Convention №108.