According to the Art. 7 of the Advertisement Law, an advertisement that contains a comparison of the advertised goods (works, services) with the goods (works, services) of other individuals or legal entities, as well as statements, images discrediting their honour, dignity, and business reputation, is prohibited. Advertisements, regardless of the form or used means of distribution (placement), should be reliable and recognisable without special knowledge or the use of special tools directly at the time of its presentation.

Licensing procedures are applied to the importation of certain digital goods to the territory of the Eurasian Economic Union, including Kazakhstan. These digital goods include (i) Civil radio-electronic equipment and/or high-frequency devices, including those which are built-in or form a part of other goods; (ii) Special hardware meant for secret information acquisition; (iii) Encryption devices.

In accordance with Art. 12.2 of Law No. 94-V, personal data must be stored in a database situated within the territory of Kazakhstan by the owner and/or operator, as well as by third parties. Pursuant to Art. 27-1, the Rules for the Implementation of Measures to Protect Personal Data by the Owner, Operator, and Third Parties were approved. According to Paragraph 8 of these Rules, the collection and processing of personal data with restricted access must be conducted via information facilities located within the Republic of Kazakhstan. The storage and transfer of such data should be carried out using cryptographic protection tools that meet at least the third level of security, as defined by the standard established in Kazakhstan. Personal data of restricted access includes all personal data, except for that which the data subject has made publicly available or that which is publicly accessible by explicit provision of the law. A similar provision was already in effect since 2021 in Rules bearing the same name, repealed in 2023, under its Paragraph 10.

According to Art. 7.6 of the Informatization Law, the central executive body carrying out state regulation in the field of electronic industry is tasked with establishing a unified register of trusted software and electronic products. According to Art. 54.3.1, for the purposes of state security, only approved software may be used for public procurement and for critical information and communication infrastructure, whether state-owned or private, including telecommunication infrastructure. In addition, it is reported that the local content for this software must not be less than 70%.

Art. 21 of the Law of the Republic of Kazakhstan on Communications stipulates that operators of communication networks of all categories included in the unified telecommunications network of the Republic of Kazakhstan shall be obliged to create at their own expense a system of centralised management of their networks, which must be located on the territory of the Republic of Kazakhstan.

In addition to the legal requirement of local processing of personal data in Kazakhstan introduced in 2015 in the Personal Data Law (Art. 12.2), pursuant to Art. 16.2 of the Law, a copy of personal data may only be transferred from Kazakhstan to a foreign country (including for purposes of processing) without prior permission from the personal data subject only if the recipient of the personal data is located in a country that protects personal data (at either the national level (by adopting national laws and regulations) or the international level (through international treaties). Pursuant to Art. 16.3 of the Personal Data Law, if no such protection is available, cross-border transfers of personal data are only possible if:
- The subject gives specific consent;
- In cases specified by international treaties ratified by Kazakhstan;
- In cases stipulated in the laws of Kazakhstan in order to protect the constitutional order, public order, rights and freedoms of an individual and a citizen, and public health and morality; and
- In the case of the protection of the constitutional rights of an individual and citizen, where getting the consent of the subject or their legal representative is impossible.
It is reported that national legislation does not specify a list of countries to which the transfer of data is prohibited, nor are there any criteria listed for determining the countries that provide a proper level of protection of personal data.

Kazakhstan has not joined any agreement with binding commitments to open transfers of data across borders.

Law No. No. 94-V provides a comprehensive regime of data protection in Kazakhstan. The Personal Data Law provides general regulations on the collection and processing of personal data and notably includes broad requirements for data localisation. In addition, the Amendment Law was introduced in July 2020, significantly extending data protection obligations for organisations. The Amendment Law introduces, among other things, further requirements for data collection and processing, obligations for data operators (similar to data processors), and redefines key concepts. The Amendment Law further establishes the competency of the data protection authority, including its powers and role.

As per the requirements of the Law on Amendments and Additions to Certain Legislative Acts of the Republic of Kazakhstan on Information and Communications (2017), users have been required to identify themselves using government-issued digital signature technology or SMS verification in order to comment on domestic websites.
The law requires website operators to make it mandatory for users to enter into a formal agreement before they are permitted to post comments on local websites. The information provided in the agreement needs to be retained by the website and handed over to the authorities whenever asked.

It is reported that Kazakhstan has no obligation for passive infrastructure sharing in the country to deliver telecom services to end users, and it is not practised in the mobile sector and in the fixed sector based on commercial agreements.

In 2016, the country formally removed a 49% limit on foreign ownership of telecom companies, except for KazakhTeleCom. As of April 2024, the state-owned 71.3% of Kazakhtelecom through Samruk-Kazyna, its sovereign wealth fund.

As of April 2024, the state held a 71.3% stake in the country’s principal telecommunications operator, Kazakhtelecom, through its sovereign wealth fund, Samruk-Kazyna.

It is reported that Kazakhstan does not mandate accounting separation for operators with significant market power (SMP) in the telecom market. However, functional separation has been an obligation since 2013.

It is reported that the telecommunication companies are required to purchase and install equipment related to the state’s System for Operational Investigative Measures (SORM) and to cover costs related to the database of International Mobile Equipment Identity (IMEI) codes and to pay regular fees to the State Radio Frequency Service, which is the IMEI database operator. These obligations may deter new players from entering the market.

Pursuant to the Law of the Republic of Kazakhstan "On Licensing" and the Law on Permissions and Notifications, the companies providing telecommunications services require an operating license from the Ministry of Digital Development, Innovation, and Aerospace. It is reported that all telecommunications operators are legally obliged, as part of the licensing requirement, to connect their channels to a public network controlled by KazakhTelecom.