For any technology startup, digital marketplace, fintech application, or enterprise operating in Kazakhstan, compliance with national personal data protection regulations has shifted from a theoretical legal formality into an actively audited statutory requirement. State regulatory bodies, including the Ministry of Digital Development, Innovations and Aerospace Industry (MDDIAI), conduct systematic compliance audits backed by severe administrative penalties under Article 79 of the Administrative Violations Code.
Below, RAEM provides a comprehensive compliance manual outlining physical database localization mandates, administrative liabilities, domestic cloud infrastructure providers, and lawful architectures for integrating foreign SaaS platforms and generative AI models.
1. The Primary Mandate: Physical Database Localization in Kazakhstan
Under Law No. 94-V “On Personal Data and Their Protection,” operators collecting and processing personal data belonging to citizens of Kazakhstan must ensure that the primary databases physically reside within the geographical territory of the Republic of Kazakhstan.
This statutory requirement mandates that whenever an individual registers an account, makes an online payment, or submits identifying credentials (full name, phone number, IIN, email, address), the authoritative master database recording that profile must sit on physical servers located within a Kazakhstani data center.
Statutory Penalties and Corporate Liability: Article 79 KoAP RK
Failure to implement necessary protective measures, unlawful collection, or database non-localization carries substantial tiered fines calculated via the Monthly Calculation Index (MRP):
| Violation Category | Business Classification | Fine in MRP | Amount in Tenge (2026) |
|---|---|---|---|
| Unlawful Collection & Processing (without verified subject consent) | Small Business / Sole Proprietor | 60 MRP | 259,500 ₸ |
| Medium Enterprise | 100 MRP | 432,500 ₸ | |
| Large Enterprise / Corporate | 200 MRP | 865,000 ₸ | |
| Breach of Security Measures (data leaks or unencrypted storage) | Small Business / Sole Proprietor | 100 MRP | 432,500 ₸ |
| Medium Enterprise | 150 MRP | 648,750 ₸ | |
| Large Enterprise / Corporate | 500 MRP | 2,162,500 ₸ | |
| Repeated Infractions Within 12 Months | Small Business / Sole Proprietor | 150 MRP | 648,750 ₸ |
| Medium Enterprise | 200 MRP | 865,000 ₸ | |
| Large Enterprise / Corporate | 1,000 MRP | 4,325,000 ₸ |
2. Directory of Domestic Data Centers and Cloud Providers in Kazakhstan
To maintain full physical localization, IT organizations deploy core databases and transactional backends across certified domestic infrastructure operators:
| Provider | Infrastructure Type | Reliability Tier & Footprint | Target Segment |
|---|---|---|---|
| PS.kz | IaaS, VPS/VDS, Dedicated Servers | Tier III data center in Almaty; operating since 2003 | SMBs, web applications, e-commerce, digital agencies |
| Kazteleport | Enterprise IaaS, Colocation, Cloud | Multiple Tier III facilities across Almaty and Astana | Fintech, banking institutions, large enterprise systems |
| Transtelecom (TTC) | Sovereign Cloud, Colocation | Distributed network of 10+ regional Tier II/III data centers | GovTech, industrial conglomerates, large logistics portals |
| QazCloud | Private Cloud, Enterprise Virtualization | High-availability enterprise data center in Astana | Samruk-Kazyna portfolio, national monopolies, corporate tech |
| Kazakhtelecom | National Backbone Colocation, Cloud | Tier III certified data centers in Almaty, Pavlodar, and Astana | High-bandwidth telecom, national platforms, video streaming |
3. Lawfully Utilizing Global SaaS Tools and Generative AI Services
Modern startups rely on global developer stacks—AWS, Google Cloud, HubSpot, Stripe, OpenAI, and Anthropic. How can a Kazakhstani venture utilize these tools without violating physical localization mandates?
The Compliant Architecture: Local Master Database with Depersonalized Sync. The law does not prohibit cross-border data transfer if the subject gives explicit, informed consent and the foreign jurisdiction guarantees adequate data protection. However, the authoritative primary database must always be physically retained in Kazakhstan. Startups achieve compliance by storing full user profiles and PII in a domestic database (e.g., PostgreSQL on PS.kz or Kazteleport) and transmitting only depersonalized, tokenized identifiers (e.g., anonymized user UUIDs) to foreign analytics, CRM, or AI API endpoints.
Compliance Checklist: 6 Steps for Tech Companies in Kazakhstan
- Implement Explicit Digital Consent: Deploy unbundled, active checkboxes for user consent on registration and checkout forms. Pre-ticked consent boxes violate statutory norms.
- Publish a Transparent Privacy Policy: Clearly articulate the exact scope of personal data collected, specific processing purposes, retention periods, and third-party recipients.
- Physically Localize Primary Databases: Verify and document that your primary production database server is located inside a verified Kazakhstani data center facility.
- Appoint a Data Protection Officer (DPO): Formally designate an internal officer responsible for data security protocols and regulatory correspondence.
- Log Access and Modification Telemetry: Maintain immutable administrative access logs recording any viewing, modification, or export of customer records.
- Formulate a 24-Hour Breach Response Protocol: Under updated regulations, operators must report unauthorized data breaches to state cybersecurity authorities within 24 hours of incident discovery.
Frequently Asked Questions
Do email addresses and phone numbers qualify as personal data?
Yes. Under Kazakhstani jurisprudence, any piece of information or combination of identifiers that enables the direct or indirect identification of an individual constitutes personal data.
Must frontend CDN and cache servers also be hosted in Kazakhstan?
No. Stateless frontend static assets (HTML, CSS, JavaScript bundles) and edge caching layers can utilize global CDNs (Cloudflare, CloudFront). The statutory localization mandate applies specifically to the physical databases that store and record personal data.
{ “@context”: “https://schema.org”, “@type”: “FAQPage”, “mainEntity”: [ { “@type”: “Question”, “name”: “Do email addresses and phone numbers qualify as personal data in Kazakhstan?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “Yes. Under Kazakhstani law, any data that enables the direct or indirect identification of an individual constitutes personal data subject to statutory protection.” } }, { “@type”: “Question”, “name”: “Must frontend CDN and cache servers also be hosted in Kazakhstan?”, “acceptedAnswer”: { “@type”: “Answer”, “text”: “No. Stateless frontend static assets and caching layers can reside on global CDNs; the localization requirement applies specifically to physical databases containing personal records.” } } ] }
