Important changes in the legislation of Kazakhstan

06.10.2026

Collection and processing of personal data: what has changed and for whom

By Order of the Acting Minister for Artificial Intelligence and Digital Development dd. 17.09.2026, amendments were made to the Rules on the collection and processing of personal data (PD).

The definition of ‘personal data’ has been clarified. PD refers to data (including biometric data) relating to a PD subject who is identified or identifiable on the basis of such data, recorded on an electronic, paper or other physical medium.

Furthermore, PD owners, controllers or third parties are obliged to ensure the protection of PD that is not subject to disclosure in accordance with the legislation of the RK by masking such data when publishing information in publicly available sources.

Access to PD disseminated in publicly available sources is granted to the data subject or their legal representative following the completion of authorisation and identification procedures, unless otherwise provided for by the laws of the RK.

In addition, the rules have been supplemented with a provision stating that the processing of PD in the form of cross-border transfers – with the exception of cases provided for in art. 16 of the Law ‘On Personal Data and Its Protection’ – the dissemination of PD in publicly accessible sources, and its transfer to third parties, shall be carried out subject to the data subject’s consent.

PD shall be stored by the data owner, data processor or a third party in a database or digital storage facility located within the territory of Kazakhstan.

It is specified that, in the event of information coming to light regarding a breach of the conditions for the collection or processing of PD, the data subject may require the data owner, data processor or third party to block or anonymise such data. PD collected and processed by the data owner, data processor or a third party in breach of the RK law, as well as in other cases, shall be destroyed or deleted at the data subject’s request.

The Order came into force on 01.10.2026.

Source: zakon.kz
22.09.2026



The rules for verifying the authenticity of EDSs using a digital system have been updated

By Order of the Acting Minister for Artificial Intelligence and Digital Development dd. 09.09.2026, the Rules for the verification of the authenticity of electronic digital signatures (EDS) by a trusted third party in the RK have been approved.

The Trusted Third Party of the Republic of Kazakhstan (TTP RK) is a digital system that, within the framework of cross-border cooperation, verifies the authenticity of foreign EDS and EDS issued within Kazakhstan.

The parties involved in the exchange of information with the TTP RK are:

  • a certification authority (CA)

  • foreign CAs

  • TTPs of foreign states

  • users of digital systems integrated with the TTP RK.

The authenticity of an EDS generated using certificates issued by a foreign CA is verified by the TTP RK on the basis of requests from users and digital systems.

The TTP RK verifies the authenticity of an EDS provided that the following conditions are met:

  • the electronic document being verified is certified by the EDS of a natural or legal person;

  • the TTP of a foreign state or the CA of a foreign state that issued the certificate being verified is registered with the TTP RK.

To verify the authenticity of an EDS, the user or digital system sends one of the following electronic requests to the TTP RK: VSD or XML.

The electronic receipt for the EDS verification, generated on the basis of the response from the CA, a foreign CA or the TTP of a foreign state, confirms the result of the EDS authenticity verification and is necessary and sufficient to confirm the authenticity of the EDS within the territory of the RK.

Verification of the EDS authenticity or certificate by the TTP RK is carried out free of charge.

The TTP RK verifies certificates issued by CAs accredited in the RK in order to provide a verification receipt to the TTP of a foreign state.

Digital systems integrated with the TTP RK must, upon receipt of an EDS verification receipt generated by the TTP RK, carry out at least the following checks:

  • the authenticity of the EDS of the TTP RK confirming the authenticity of the receipt;

  • the conformity of the received receipt with the e-document being certified and the EDS.

The Order came into force on 27.09.2026. Consequently, the previously applicable rules are repealed.

Source: zakon.kz
17.09.2026



Changes to the rules governing desk-based audits

By order of the Acting Minister of Finance dd. 02.09.2026, amendments and additions have been made to the Rules governing desk-based audits.

It is clarified that a notice to rectify breaches must be complied with by the entity subject to the state audit within 10 business days from the day following the date of its delivery (receipt via the web portal and/or digital systems). If the identified breaches are rectified independently within 10 working days, the official shall not be held administratively liable.

Desk-based audits of public procurement conducted via a request for quotations shall be carried out within 3 business days of the information relating to them being published on the web portal. The following provision has also been added: desk-based audits of supplementary agreements to public procurement contracts shall be carried out within 3 business days of their being sent to the supplier (contractor) for signature.

The Order came into force on 19.09.2026.

Source: zakon.kz
09.09.2026



Changes to the rules governing foreign currency transactions in Kazakhstan

The Resolution of the National Bank dd. 27.08.2026 has introduced amendments to the Rules governing foreign currency transactions in the RK.

The Rules have been supplemented by the provision stipulating that the transfer of non-cash foreign currency by a resident legal entity—which is subject to a special regulatory regime and engages in the issuance and circulation of stablecoins—to accounts held with foreign banks or financial institutions is recognised as a purpose related to the fulfilment of obligations in foreign currency. This provision applies where the funds are used to settle digital financial assets utilised in the performance of foreign currency contracts relating to exports or imports.

It is further specified that, when a resident legal entity purchases non-cash foreign currency from an authorised bank within 1 business day in exchange for national currency, as part of the fulfilment of obligations, for an amount exceeding the threshold value, it must attach the following to the purchase application:

  • a copy of the relevant foreign currency contract;
  • an instruction to the authorised bank – in the event that the non-cash foreign currency purchased is not used for the stated purposes within 10 business days of the date of purchase – to sell it for national currency within the following 3 business days, except in cases specifically provided for.

A resident legal entity subject to a special regulatory regime and engaged in the issuance and trading of digital financial assets backed by money (stablecoins) shall, when purchasing foreign currency in excess of the threshold amount, submit the following together with its purchase order:

  • information on the reference numbers assigned to foreign currency contracts for exports/imports;
  • an instruction to the authorised bank – in the event that the purchased non-cash foreign currency is not used for the stated purposes within 10 business days of the date of purchase – to sell it for national currency within the following 3 business days.

Where, within 1 business day, non-cash foreign currency is purchased from an authorised bank in exchange for national currency through multiple transactions, the value of each of which individually does not exceed the threshold but whose combined value exceeds it, the provision set out above shall apply.

The purchased currency may not be used for purposes unrelated to the fulfilment of obligations denominated in foreign currency.

If a foreign currency contract has been assigned a reference number, a copy of that contract bearing a note confirming the assignment of the reference number, or a copy of the registration certificate or notification certificate, must be submitted.

When processing the application, the authorised bank shall verify the stated purpose and amount of the purchase against the relevant foreign currency contract, as well as against available information on previous purchases of non-cash foreign currency for national currency made under that foreign currency contract.

It is also specified that an authorised bank shall refuse to process an application from a resident legal entity to purchase non-cash foreign currency for national currency if the total amount of such purchases under a single foreign currency contract—calculated on the basis of applications from the resident legal entity or information from other authorised banks—exceeds the amount specified in that foreign currency contract.

The Resolution came into force on 15.09.2026.

Source: zakon.kz
07.09.2026



Rules on the issuance of IIN to foreign nationals have been updated

By the Order of the Minister of Internal Affairs dd. 30.06.2026, amendments were made to the Rules for the provision of the public service ‘Issuance and amendment of Individual Identification Numbers to foreign nationals and stateless persons temporarily residing in the Republic of Kazakhstan’.

The rules have been revised. This public service is provided through the State Corporation ‘Government for Citizens’.

To obtain an IIN, a foreign national or stateless person must submit an application in person, together with the required supporting documents, to the State Corporation at their place of residence.

To amend an IIN, an individual (or their legal representative) must also apply to the State Corporation at their place of residence by submitting an application.

When an applicant makes an enquiry, a member of staff at the State Corporation:

  • verifies the identity of the applicant;

  • checks the documents to ensure the accuracy of the information contained therein;

  • submits the application to the Integrated Information System of Public Service Centres.

Applications for the creation and amendment of the IIN from the Integrated Information System of the Public Service Centres are forwarded to the Digital System of the Ministry of the Internal Affairs for processing. An operator at the Ministry of the Interior checks the incoming applications for accuracy. If the application meets the requirements for completion, the operator carries out the procedure for creating or amending the IIN.

Upon approval of the application, a Registration Certificate is issued.

In the event of a refusal, the application may be resubmitted once the reasons for the refusal have been rectified.

The Order came into force on 17.07.2026.

Source: zakon.kz
08.07.2026