Article 16 of the Kazakhstan PDPL governs cross-border transfers of personal data outside Kazakhstan territory. (1) Article 16 General Framework: Cross-border transfer permitted only on specific grounds (a) Adequacy Determination by Authorized Body; (b) Subject consent (written for sensitive data + specific for transfer); (c) Performance of contract to which subject is party; (d) Vital interests of subject; (e) Public interest as defined by law; (f) Statutory authority; (g) Authorized Body approval for specific transfer mechanism. (2) Adequacy Determinations: (a) Authorized Body determines third country provides adequate level of protection; (b) Consideration includes (i) rule of law + respect for human rights; (ii) data protection legislation + enforcement; (iii) supervisory authority independence; (iv) international commitments; (v) Convention 108+ accession; (c) Reciprocity-based adequacy emerging (e.g. EAEU + CIS member states); (d) Sector-specific adequacy may be issued; (e) EU GDPR adequacy decisions referenced as guidance. (3) EAEU Eurasian Economic Union Coordination: (a) Russia + Belarus + Kazakhstan + Kyrgyzstan + Armenia data flow easements; (b) EAEU Customs Union data sharing; (c) Common Economic Space implications; (d) Mutual recognition of compliance standards; (e) EAEU Single Digital Market emerging. (4) CIS Commonwealth of Independent States: (a) CIS Privacy Framework discussions; (b) Bilateral arrangements with CIS member states; (c) Common Soviet-era legal heritage; (d) Russian language documentation coordination. (5) Specific Country Adequacy Considerations: (a) Russia - extensive cooperation + similar 152-FZ heritage; (b) Belarus - bilateral arrangements; (c) China - emerging data flow agreements + Belt and Road Initiative considerations; (d) Turkey - Turkic Council coordination; (e) EU - convergence + adequacy candidacy emerging; (f) USA - Schrems II considerations + bilateral arrangements; (g) UK - emerging adequacy. (6) Transfer Impact Assessment (TIA): (a) Risk assessment for each transfer destination; (b) Legal regime evaluation; (c) Supplementary measures (encryption + pseudonymisation + access restriction); (d) Periodic review; (e) Authorized Body consultation for high-risk. (7) Standard Contractual Clauses + Binding Corporate Rules: (a) Kazakhstan-approved SCCs emerging (currently bespoke); (b) BCRs for multinational corporate transfers; (c) Code of Conduct approved + binding; (d) Certification mechanism approved; (e) Ad hoc contractual clauses authorised. (8) Authorized Body Approval Process: (a) Application to Ministry of Digital Development; (b) Risk assessment + legal review; (c) Public consultation for material transfers; (d) Decision within 30-90 days; (e) Conditions may be attached; (f) Periodic review + revocation power; (g) Public register of approved mechanisms. (9) Article 12 Biometric Data Localization Constraint: (a) Biometric data of Kazakhstan citizens + residents cannot be permanently stored abroad; (b) Mirror storage with Kazakhstan as primary; (c) Cross-border processing permitted but primary storage Kazakhstan; (d) Foreign cloud provider Kazakhstan region required. (10) Sectoral Cross-Border: (a) Banking + National Bank of Kazakhstan + bank secrecy considerations; (b) Telecommunications + Telecom Regulator; (c) Healthcare + Ministry of Health + medical record cross-border; (d) Government Cloud + sovereign considerations. (11) Cloud-Based Processing: (a) Hyperscaler cloud (AWS + Azure + GCP) with Kazakhstan-region availability emerging; (b) Russia-region or China-region as common alternatives; (c) Sub-processor chain transparency required; (d) Authorized Body awareness + approval for material cloud arrangements. (12) Penalties for Unlawful Transfers: (a) Article 79 CoAP administrative penalties; (b) Operational suspension for non-compliance; (c) Civil compensation; (d) Criminal Code Articles 147-148; (e) Article 12 biometric localization specific. Coordinates with EU GDPR Chapter V Articles 44-50 + Russian Personal Data Law 152-FZ + Convention 108+ Article 14 + EAEU Eurasian Economic Union + CIS Commonwealth of Independent States + Shanghai Cooperation Organisation + Belt and Road Initiative + Bilateral arrangements + AIFC Data Protection Regulations + Code of Administrative Offences + National Bank of Kazakhstan + Telecommunications Regulator + Ministry of Digital Development + State Service for Information Security. Kazakhstan PDPL Cross-Border + Article 16 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.