Kazakhstan Law on Personal Data and Their Protection (Заңы О персональных данных и их защите Zaňy O personaľnyh dannyh i ih zaščite) Law No. 94-V of 21 May 2013 + significant amendments 2017 + 2019 + 2022 + recent updates 2024 introducing GDPR-style elements. Foundational comprehensive data protection statute for Republic of Kazakhstan. (1) Statutory Framework: (a) Law No. 94-V adopted 21 May 2013 by Kazakhstan Parliament; (b) Effective date 1 December 2013; (c) Major amendments 2017 (mass media + sensitive data) + 2019 (data subject rights + breach notification) + 2022 (biometric data localization + cross-border restrictions); (d) Implementing Regulations + Ministry orders; (e) Code of Administrative Offences (CoAP) penalty provisions Article 79; (f) Constitutional Court of Kazakhstan oversight. (2) Articles 1-3 Definitions + Scope: (a) Personal Data (Personaľnye dannye персональные данные) - information about identified or identifiable individual (subject of personal data); (b) Sensitive Personal Data per Article 9 - race + ethnic origin + political + religious + philosophical + trade union + sexual life + criminal convictions + health + genetic + biometric; (c) Subject of Personal Data (Subject personaľnyh dannyh субъект персональных данных) - physical person to whom personal data relate; (d) Owner of Personal Data Database (Sobstvennik bazy personaľnyh dannyh собственник базы персональных данных) - entity that has rights of ownership + use + disposal of personal data database (similar to controller); (e) Operator of Personal Data Database (Operator bazy personaľnyh dannyh оператор базы персональных данных) - entity that processes personal data on behalf of owner; (f) Cross-Border Transfer per Article 16; (g) Processing - operations on personal data including collection + recording + organisation + storage + adaptation + retrieval + consultation + use + disclosure + dissemination + alignment + restriction + erasure + destruction; (h) Consent of Subject of Personal Data; (i) Public Sources of Personal Data per Article 10. (3) Article 3 Scope and Application: (a) Material Scope - applies to all processing of personal data of individuals in Kazakhstan; (b) Territorial Scope - applies to (i) processing by Kazakhstan-based controllers + processors; (ii) processing of personal data of Kazakhstan citizens + residents by foreign entities subject to Article 12 biometric data localization requirement; (c) Sectoral Application - banking + telecommunications + insurance + health + education + state authorities + private sector. (4) Astana International Financial Centre (AIFC) Exemption: (a) AIFC established 2015 + governed by AIFC Constitutional Statute + AIFC Court; (b) Operating English Common Law within AIFC zone; (c) AIFC Data Protection Regulations (separate from Law 94-V) following GDPR-aligned approach; (d) Personal data processed within AIFC subject to AIFC rules; (e) Cross-AIFC vs main law boundary issues; (f) Notable companies operating under AIFC - banking + asset management + fintech. (5) Authorized Body: (a) Ministry of Digital Development Innovation and Aerospace Industry (MDDIAI) (Ministerstvo Cifrovogo Razvitiya Innovacii i Aerokosmicheskoi Promyshlennosti); (b) Sub-agency - State Service for Information Security; (c) State Technical Service (STS) for technical compliance; (d) Functions - issue regulations + monitor compliance + investigate complaints + administrative penalties; (e) Inter-Ministerial coordination - Ministry of Internal Affairs + KNB Committee for National Security + Ministry of Justice; (f) Constitutional Court for constitutional review. (6) Constitutional Anchor: (a) Constitution of Kazakhstan 1995 (as amended) Article 18 personal liberty + Article 30 inviolability of correspondence + Article 28 Personal Inviolability; (b) International Covenant on Civil and Political Rights (ICCPR) Article 17 ratification; (c) Universal Declaration of Human Rights. (7) International Influences + Coordination: (a) Russian Federation Federal Law No. 152-FZ On Personal Data (significant alignment + similar structure); (b) EU GDPR Regulation 2016/679 (recent amendments converging); (c) Council of Europe Convention 108+ (Kazakhstan accession in process); (d) CIS Commonwealth of Independent States data protection coordination; (e) EAEU Eurasian Economic Union (Russia + Belarus + Kazakhstan + Kyrgyzstan + Armenia) data flows; (f) Shanghai Cooperation Organisation cyber framework; (g) UN Guidelines for Personal Data Files (2018). (8) Sectoral Coordination: (a) National Bank of Kazakhstan + banking secrecy; (b) Telecommunications Regulator + telecom data; (c) Ministry of Health + medical records; (d) Ministry of Education + student data; (e) State Tax Service; (f) Civil Code of Kazakhstan; (g) Mass Media Law; (h) Anti-Money Laundering and Counter-Financing of Terrorism Law. (9) Recent Amendments: (a) 2022 Biometric Data Localization Requirement per Article 12 - biometric data of Kazakhstan citizens + residents must be stored on servers in Kazakhstan territory; (b) Expansion of sensitive data categories; (c) Enhanced breach notification 72-hour standard; (d) Recent 2024 amendments converging on GDPR-style rights including portability + clarified DPO equivalent. (10) Sanctions: per Code of Administrative Offences (CoAP) Article 79: (a) Administrative violations - KZT (Kazakhstan Tenge) 500K-3M for individuals + KZT 1.5M-30M for legal entities; (b) Repeat violations - doubled; (c) Criminal liability per Criminal Code Article 147 + 148 for severe violations - up to 3 years imprisonment + KZT 1.5M fine; (d) Civil compensation; (e) Operational suspension. Coordinates with Russian Federation Personal Data Law 152-FZ + Russian Roskomnadzor + EU GDPR + Council of Europe Convention 108+ + CIS data protection + EAEU + Constitutional Court of Kazakhstan + AIFC Court + AIFC Data Protection Regulations + Code of Administrative Offences + Criminal Code Articles 147-148 + ICCPR Article 17 + Constitution Articles 18 + 30 + 28 + National Bank of Kazakhstan + Telecommunications Regulator + Ministry of Health + Ministry of Education + KNB Committee for National Security + Ministry of Justice + State Tax Service + Mass Media Law + AML Law. Kazakhstan PDPL Scope + Application applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.