Kazakhstan: Localization of personal data
Published 1 January 2016
What does this cover?
A new law entitled 'On Amendments to Certain Legislative Acts of the Republic of Kazakhstan on Informatization' (24 November 2015 No. 419-V) was published on 26 November 2015 and made amendments to the law entitled 'On Personal Data and Protection Thereof' (21 May 2013 No. 94-V) (the Personal Data Law).
The amendment to the Personal Data Law came into effect on 1 January 2016, and obliges owners and/or operators of personal databases to keep such databases in the territory of Kazakhstan (amendment in bold below):
Article 12: Accumulation and Storage of Personal Data
- Accumulation of personal data shall be carried out by collecting personal data, necessary and sufficient to accomplish the tasks carried out by the owner and/or operator, as well as by a third party;
- Storage of personal data shall be carried out by the owner and/or operator, as well as by a third party in the database, which is kept in the territory of the Republic of Kazakhstan.
The period of storage of personal data shall be determined by the date of the achieving the objectives of the data collection and processing, unless otherwise provided by the legislation of the Republic of Kazakhstan.
The requirement for localization of personal data applies to companies established in Kazakhstan and individual proprietors in Kazakhstan, including branches and representative offices of foreign companies.
It is not clear whether the localization requirement should apply to foreign companies without any legal presence in Kazakhstan, but whose websites are accessible in the territory of Kazakhstan. Arguably, the requirement should only apply to Internet resources supported by hardware located in Kazakhstan.
Article submitted by Ravil Kassilgov, Kassilgov & Partners LLP – Almaty, Kazakhstan.
What action could be taken to manage risks that may arise from this development?
Organisations wishing to export date outside Kazakhstan should take specific legal advice.