Kazakhstan has not joined any agreement with binding commitments to open transfers of data across borders.

Law No. No. 94-V provides a comprehensive regime of data protection in Kazakhstan. The Personal Data Law provides general regulations on the collection and processing of personal data and notably includes broad requirements for data localisation. In addition, the Amendment Law was introduced in July 2020, significantly extending data protection obligations for organisations. The Amendment Law introduces, among other things, further requirements for data collection and processing, obligations for data operators (similar to data processors), and redefines key concepts. The Amendment Law further establishes the competency of the data protection authority, including its powers and role.

As per the requirements of the Law on Amendments and Additions to Certain Legislative Acts of the Republic of Kazakhstan on Information and Communications (2017), users have been required to identify themselves using government-issued digital signature technology or SMS verification in order to comment on domestic websites.
The law requires website operators to make it mandatory for users to enter into a formal agreement before they are permitted to post comments on local websites. The information provided in the agreement needs to be retained by the website and handed over to the authorities whenever asked.

According to Art. 25.2(10) of Law No. 94-V, an owner and/or operator of a personal data database, which is a legal entity, should appoint a person responsible for organising the processing of personal data (this requirement does not apply to the activities of courts). According to Art. 25.3, such a person is entrusted with the following duties:
- Exercise internal control over observance by the owner and/or operator of a personal data database and its employees of Kazakh law requirements in relation to personal data and its protection;
- Inform the employees of an owner and/or operator of the provisions of Kazakh law with respect to processing and protection of personal data;
- Exercise control over receipt and processing of applications from personal data subjects or their legal representatives.

In 2016, the country formally removed a 49% limit on foreign ownership of telecom companies, except for KazakhTeleCom. As of April 2024, the state-owned 71.3% of Kazakhtelecom through Samruk-Kazyna, its sovereign wealth fund.

As of April 2024, the state held a 71.3% stake in the country’s principal telecommunications operator, Kazakhtelecom, through its sovereign wealth fund, Samruk-Kazyna.

It is reported that Kazakhstan does not mandate accounting separation for operators with significant market power (SMP) in the telecom market. However, functional separation has been an obligation since 2013.

It is reported that the telecommunication companies are required to purchase and install equipment related to the state’s System for Operational Investigative Measures (SORM) and to cover costs related to the database of International Mobile Equipment Identity (IMEI) codes and to pay regular fees to the State Radio Frequency Service, which is the IMEI database operator. These obligations may deter new players from entering the market.

Pursuant to the Law of the Republic of Kazakhstan "On Licensing" and the Law on Permissions and Notifications, the companies providing telecommunications services require an operating license from the Ministry of Digital Development, Innovation, and Aerospace. It is reported that all telecommunications operators are legally obliged, as part of the licensing requirement, to connect their channels to a public network controlled by KazakhTelecom.

Kazakhstan has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Kazakhstan has a telecommunications authority: The Telecommunications Committee of the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan. However, it is reported that this entity's decision-making process is not fully independent of the government.

Art. 56-1 of the Law on Informatization requires that internet resources with ".kz" and ".қaz" domains must be hosted on hardware and software complexes located in Kazakhstan. In other words, an internet resource (website, web application, web service) using a ".kz" or ".қaz" domain must be hosted on a server (owned/rented/cloud hosted/VDS hosted/virtually hosted) in a data centre (server/office) located in Kazakhstan. The server must also be connected to a Kazakh internet provider and use a (dedicated or shared) Kazakhstan IP address.
A similar requirement has been in place since 2005, as established in Clauses 7 and 8 of the Regulations for the Allocation of Domain Space in the Kazakhstan Segment of the Internet. These clauses provided that an application for domain name registration may be refused or registration may be cancelled if the domain servers were not located inside Kazakhstan.

Paragraph 6-1 of Resolution No. 246 prohibited the storage of telecommunication subscriber information outside the country. The Resolution was repealed in July 2023.

In accordance with Art. 12.2 of Law No. 94-V, personal data must be stored in a database situated within the territory of Kazakhstan by the owner and/or operator, as well as by third parties. Pursuant to Art. 27-1, the Rules for the Implementation of Measures to Protect Personal Data by the Owner, Operator, and Third Parties were approved. According to Paragraph 8 of these Rules, the collection and processing of personal data with restricted access must be conducted via information facilities located within the Republic of Kazakhstan. The storage and transfer of such data should be carried out using cryptographic protection tools that meet at least the third level of security, as defined by the standard established in Kazakhstan. Personal data of restricted access includes all personal data, except for that which the data subject has made publicly available or that which is publicly accessible by explicit provision of the law. A similar provision was already in effect since 2021 in Rules bearing the same name, repealed in 2023, under its Paragraph 10.

Art. 21 of the Law of the Republic of Kazakhstan on Communications stipulates that operators of communication networks of all categories included in the unified telecommunications network of the Republic of Kazakhstan shall be obliged to create at their own expense a system of centralised management of their networks, which must be located on the territory of the Republic of Kazakhstan.