What Is Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Their Protection"?
Current Adilet records identify the Law on Personal Data and Their Protection as Law No. 94-V of 21 May 2013 and expose amendment records from 17 November 2025, 9 January 2026, and 24 June 2026. Those amendment records carry delayed-commencement language, meaning an earlier source-inventory review was not sufficient to treat the amendment trail as fully reconciled — the precise, provision-by-provision current-force status of each 2025-2026 amendment requires further review. The current Russian text supports a personal/family-use exclusion and a consent requirement subject to statutory exceptions. It also lists data-subject information, correction, blocking, destruction of unlawfully collected or processed data, consent-withdrawal, public-source dissemination, and protection rights. The 15-working-day withdrawal rule found is a bounded statutory mechanism, not a universal deletion guarantee. Current government guidance identifies the Committee on Information Security under the Ministry of Artificial Intelligence and Digital Development as the authorized personal-data body and describes citizen appeals, enforcement measures, and unscheduled-inspection criteria — an official escalation route, without a guarantee of investigation or remedy.
At a glance
- Full name
- Law of the Republic of Kazakhstan No. 94-V "On Personal Data and Their Protection"
- Short code
- Law No. 94-V
- Jurisdiction
- Kazakhstan
- Enacted
- 2013
- Last major update
- Adilet consolidated record updated 14 September 2026; amendments from 17 November 2025, 9 January 2026, and 24 June 2026 carry delayed-commencement language
- Regulator
- Committee on Information Security under the Ministry of Artificial Intelligence and Digital Development
- Private right of action
- Limited
Scope, who Law No. 94-V covers
Protected data
Data subject rights
Information about processing
Correction of data
Blocking of data
Destruction of unlawfully collected or processed data
Consent withdrawal, with a 15-working-day statutory mechanism
Protection against unlawful processing
Notable features
Kazakhstan's law has been amended three times in roughly seven months (November 2025, January 2026, June 2026), with delayed-commencement language attached to several of those amendments — a currentness trap for any description that treats the amendment trail as fully settled without provision-level reconciliation.
Enforcement & penalties
Penalties: Not independently confirmed in the 9 October 2026 review pending reconciliation of the 2025-2026 amendment trail; a future update should verify the current penalty schedule directly from the amended statute.
Private right of action: Current government guidance describes citizen appeals, enforcement measures, and unscheduled-inspection criteria available through the Committee on Information Security, but this verifies the existence of an official escalation route rather than a guaranteed investigation or remedy.
Relevance to data brokers
No jurisdiction-specific data-broker endpoint or universal public-record deletion route has been verified. Official materials support conditional regulatory escalation for alleged unlawful processing or refusal to destroy data, while the public-source amendment and its commencement require further provision-level review before any route-specific claim is published.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Has Kazakhstan's personal-data law changed in the 2025–2026 amendment cycle?+
Yes — the current Adilet record (updated 14 September 2026) shows amendments from 17 November 2025, 9 January 2026, and 24 June 2026, several carrying delayed-commencement language. The precise current-force status of each affected provision requires further provision-level review before being treated as fully settled.
Can I withdraw my consent to data processing in Kazakhstan?+
Yes, the law provides a consent-withdrawal right with a 15-working-day statutory mechanism — a bounded process, not a universal deletion guarantee, since the withdrawal only affects consent-based processing.
Official sources & citations
Other international privacy regimes
Law No. 94-V sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: