In accordance with subparagraph 4-1 of Art. 7 of Law No. 544, the Minister of National Economy of Kazakhstan ordered the approval of the Rules of Domestic Trade (Order No. 264). Arts. 105-1 and 106-1 of the Rules mandate e-commerce sellers to indicate their BIN (business identification number), address of business operations on the territory of Kazakhstan and mobile telephone number registered in Kazakhstan in order to operate in the country. Additional information on this requirement is found in Annex 3-10 of Order No. 4.

According to Art. 7 of Law No. 167-VІ SAM on Monetary Regulation and Foreign Exchange Control (which repealed Law No. 57 of 2005 on Monetary Regulation in July 2018), the use of a local bank is mandatory for settlements in foreign currency between residents of the KR and non-residents. Exceptions are settlements made from a foreign bank account of a non-resident, carried out on account of the performance of obligations of a resident (e.g. when a foreign parent company pays its local branch in the KR) and settlements with non-residents made from the resident's account in a foreign bank. Also, settlements between residents of the KR (including local branches of foreign non-financial legal entities considered residents) must be made in local currency.

Kazakhstan ratified the Treaty on the Customs Code of the Eurasian Economic Union through Law No. 115-VI. Pursuant to Art. 136(2) of the Customs Code, no obligation to pay import customs duties or taxes arises for goods placed under the customs procedure of release for internal consumption where the goods are shipped from a single consignor to a single consignee under one transport document, and their total customs value does not exceed the equivalent of EUR 200. For the purpose of determining this threshold, transportation, loading, unloading, transhipment and insurance costs incurred up to the place of arrival are excluded from the customs value.

According to Art. 56 of the Law on Informatization requires that internet resources with ".kz" and ".қaz" domains must be hosted on hardware and software complexes located in Kazakhstan. In other words, an internet resource (website, web application, web service) using a ".kz" or ".қaz" domain must be hosted on a server in a data centre located in Kazakhstan. The server must also be connected to a Kazakh internet provider and use a (dedicated or shared) Kazakhstan IP address. It is reported that the owners of Internet resources were originally required to start using Kazakhstan's data centres by November 2020; however, since the related transition required additional costs and time, the deadline for meeting this requirement was extended to February 2021.

Under Art. 9 of Law No. 18-VIII on Online Platforms and Online Advertising, owners of online platforms with average daily access exceeding 100,000 users located in Kazakhstan during a month must appoint a legal representative to interact with the authorised body. Owners and legal representatives must respond to government requests within 24 hours, comply with final court decisions and relevant instructions from public authorities, and take measures against illegal content. Under Art. 24, failure to comply with Art. 9 may result in the platform’s activities being restricted in Kazakhstan.

The Law on Protection of Consumer Rights provides a general consumer-protection framework applicable to online transactions. Under Art. 2-1(4-1), consumers engaging in electronic commerce must receive a level of protection no lower than that provided in other forms of trade. Arts. 24, 25 and 30 establish specific information requirements concerning online payments, product characteristics, prices and delivery conditions. In addition, Art. 33-1 requires electronic trading platforms to maintain internal procedures against seller misconduct and false information and to operate through secure communication channels. These provisions were introduced by Law No. 241-VI in April 2019.

Kazakhstan has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Kazakhstan has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Kazakhstan has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

Kazakhstan has not joined any agreement with binding commitments to open transfers of data across borders.

Law No. No. 94-V provides a comprehensive regime of data protection in Kazakhstan. The Personal Data Law provides general regulations on the collection and processing of personal data and notably includes broad requirements for data localisation. In addition, Law No. 347-VI of 25 June 2020 on "Amendments and Additions to Some Legislative Acts on the Regulation of Digital Technologies" was introduced in July 2020, significantly extending data protection obligations for organisations. Law No. 347-VI introduces, among other things, further requirements for data collection and processing, obligations for data operators (similar to data processors), and redefines key concepts. Law No. 347-VI further establishes the competency of the data protection authority, including its powers and role.

Under Art. 15(1)(2) of Law No. 567-II “On Communications” of 5 July 2004, telecommunications operators and/or owners of communications networks are required to collect and retain service information relating to subscribers and/or users of communications services. This obligation is implemented through Order No. 220/НҚ of 30 June 2023, which approved the Rules for the Collection and Storage by Telecom Operators of Service Information on Subscribers and/or Users of Communication Services.
The Rules require telecommunications operators to retain the relevant service information for a period of two years, after which it must be destroyed. The information subject to retention includes subscriber numbers, IIN/BIN identifiers, device identification codes, billing information, the location of subscriber devices, data-network addresses, addresses and identifiers of internet resources accessed, and data-transmission protocols.

According to Art. 25.2(10) of Law No. 94-V, an owner and/or operator of a personal data database, which is a legal entity, should appoint a person responsible for organising the processing of personal data (this requirement does not apply to the activities of courts). According to Art. 25.3, such a person is entrusted with the following duties:
- Exercise internal control over observance by the owner and/or operator of a personal data database and its employees of Kazakh law requirements in relation to personal data and its protection;
- Inform the employees of an owner and/or operator of the provisions of Kazakh law with respect to processing and protection of personal data;
- Exercise control over receipt and processing of applications from personal data subjects or their legal representatives.

In July 2019, the government introduced the Qaznet Trust Certificate under the Law on Communications, a machine-in-the-middle (MITM) technology that enables it to monitor users’ online activities. The certificate requires every internet user in the country to install a backdoor, allowing the government to conduct surveillance. This allows the government to conduct a so-called “man-in-the-middle” attack, which allows the government to intercept every secure connection in the country and see web browsing history, usernames and passwords, and even secure and HTTPS-encrypted traffic.
KazakhTelecom, the country’s largest telecommunications company, has said that citizens are “obliged” to install a “national security certificate” on every device, including desktops and mobile devices.
It is reported that the commentators and experts inside the country and abroad almost unanimously consider the certificate a government-initiated technology for the interception of encrypted user traffic via MITM attacks. Some of the 37 websites that University of Michigan researchers identified as targets of the certificate included Facebook, Gmail, Instagram, Mail.ru, OK, Twitter, VK, and YouTube, suggesting that its purpose was to “surveil users on social networking and communication sites.”
On 21 August 2019, Mozilla and Google simultaneously announced that their Firefox and Chrome web browsers would not accept the government-issued certificate, even if installed manually by users. Later, Apple announced that it would make similar changes to its Safari browser and that the certificate would not be installed. After this, the requirement for the installation of the certificate was postponed.
While required, the certificate appeared to affect a fraction of connections passing through the country’s largest ISP, Kazakhtelecom. This means that some, but not all, of the Kazakh Internet population was affected.
In December 2020, Kazakhstan once again tried to enforce the installation of the certificate. However, the enforcement once again halted after the protest of the major internet browsers. Although not enforced, the provisions for mandatory installation of the certificate remain in Kazakhstan's regulations.

A basic legal framework on intermediary liability for copyright infringement is absent in Kazakhstan's law and jurisprudence. However, the Agreement on Enhanced Partnership between the EU and the Republic of Kazakhstan, signed in March 2016, provides a safe harbour to European companies under several conditions. According to the agreement, an information intermediary is not liable, for example, if it does not initiate the transfer, if the end-user always takes the initiative, if it does not choose the recipient of the transfer if it does not choose or change the information contained in the transfer if it complies with the conditions of access to information, observes rules for updating information, does not interfere with the lawful use of generally recognised technologies, immediately deletes information or stops access to it, after receiving a notice.