Database

Browse Database

KAZAKHSTAN

Since April 2004, last amended in December 2022
Since March 2015, as amended in July 2019, last amended September 2022
Since January 2015, last amended in October 2022

Pillar Online sales and transactions  |  Sub-pillar Licensing scheme for e-commerce providers
Law No. 544 on the Regulation of Trading Activities (Қазақстан Республикасының 2004 жылғы 12 сәуірдегі N 544 Заңы Сауда қызметін реттеу туралы)

Order No. 264 on the Approval of the Rules of Domestic Trade (№ 264 бұйрығы Ішкі сауда қағидаларын бекіту туралы)

Order No. 4 on the Approval of the Forms of Messages and the Principles of Receiving Messages by State Bodies, as well as on Determining the State Bodies That Carry Out the Reception of Messages ( бұйрығы № 4 Хабарламалар нысандарын және Мемлекеттік органдардың хабарламаларды қабылдау қағидаларын бекіту туралы, сондай-ақ хабарламаларды қабылдауды жүзеге асыратын мемлекеттік органдарды айқындау туралы)
In accordance with subparagraph 4-1 of Art. 7 of Law No. 544, the Minister of National Economy of Kazakhstan ordered the approval of the Rules of Domestic Trade (Order No. 264). Arts. 105-1 and 106-1 of the Rules mandate e-commerce sellers to indicate their BIN (business identification number), address of business operations on the territory of Kazakhstan and mobile telephone number registered in Kazakhstan in order to operate in the country. Additional information on this requirement is found in Annex 3-10 of Order No. 4.
Coverage E-commerce sector

KAZAKHSTAN

Since July 2018, entry into force in July 2019, last amended in January 2020

Pillar Online sales and transactions  |  Sub-pillar Restrictions on online payments
Law No. 167-VІ SAM on Currency Regulation and Currency Control (Закон Республики Казахстан от 2 июля 2018 года № 167-VІ ЗРК)
According to Art. 7 of Law No. 167-VІ SAM on Monetary Regulation and Foreign Exchange Control (which repealed Law No. 57 of 2005 on Monetary Regulation in July 2018), the use of a local bank is mandatory for settlements in foreign currency between residents of the KR and non-residents. Exceptions are settlements made from a foreign bank account of a non-resident, carried out on account of the performance of obligations of a resident (e.g. when a foreign parent company pays its local branch in the KR) and settlements with non-residents made from the resident's account in a foreign bank. Also, settlements between residents of the KR (including local branches of foreign non-financial legal entities considered residents) must be made in local currency.
Coverage Horizontal

KAZAKHSTAN

Since December 2017

Pillar Online sales and transactions  |  Sub-pillar Threshold for ‘De Minimis’ rule
Law No. 115-VI ЗРК of the Republic of Kazakhstan on The Ratification of the Treaty on the Customs Code of the Eurasian Economic Union (Қазақстан Республикасының Заңы 2017 жылғы 13 желтоқсандағы № 115-VI ҚРЗ Еуразиялық экономикалық одақтың Кеден кодексі туралы шартты ратификациялау туралы)
According to Art. 136 of Law No. 115-VI ЗРК of the Republic of Kazakhstan, imports placed under the customs procedure for domestic consumption with a total customs value not exceeding the threshold of EUR 200 (approx. 219 USD) are exempt from import duties and taxes.
Coverage Horizontal

KAZAKHSTAN

Since November 2015, last amended in December 2023

Pillar Online sales and transactions  |  Sub-pillar Restrictions on domain names
Law No. 418-V ZRK of the Republic of Kazakhstan on Informatization (Қазақстан Республикасының Ақпараттандыру туралы Заңы 2015 жылғы 24 қарашадағы № 418-V ҚРЗ)
According to Art. 56 of the Law on Informatization requires that internet resources with ".kz" and ".қaz" domains must be hosted on hardware and software complexes located in Kazakhstan. In other words, an internet resource (website, web application, web service) using a ".kz" or ".қaz" domain must be hosted on a server in a data centre located in Kazakhstan. The server must also be connected to a Kazakh internet provider and use a (dedicated or shared) Kazakhstan IP address. It is reported that the owners of Internet resources were originally required to start using Kazakhstan's data centres by November 2020; however, since the related transition required additional costs and time, the deadline for meeting this requirement was extended to February 2021.
Coverage Internet resources with ".kz" and ".қaz" domain

KAZAKHSTAN

Since May 2010

Pillar Online sales and transactions  |  Sub-pillar Framework for consumer protection applicable to online commerce
Law of the Republic of Kazakhstan dated 4 May 2010 No. 274-IV on Protection of Consumer Rights (Қазақстан Республикасының 2010 жылғы 4 мамырдағы № 274-IV Заңы Тұтынушылардың құқықтарын қорғау туралы)
The Law on Protection of Consumer Rights provides a comprehensive framework for consumer protection that also applies to online transactions. Art. 33 of the Law on Protection of Consumer Rights includes provisions for the protection of e-consumers. Additionally, e-consumers enjoy all other privileges of the normal consumers.
Coverage Horizontal

KAZAKHSTAN

N/A

Pillar Online sales and transactions  |  Sub-pillar Ratification of the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts
Lack of signature of the UN Convention on the Use of Electronic Communications in International Contracts
Kazakhstan has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.
Coverage Horizontal

KAZAKHSTAN

N/A

Pillar Online sales and transactions  |  Sub-pillar Adoption of United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce
Lack of adoption of UNCITRAL Model Law on Electronic Commerce
Kazakhstan has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.
Coverage Horizontal

KAZAKHSTAN

N/A

Pillar Online sales and transactions  |  Sub-pillar Adoption of United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures
Lack of adoption of UNCITRAL Model Law on Electronic Signatures
Kazakhstan has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.
Coverage Horizontal

KAZAKHSTAN

Since August 2012

Pillar Quantitative trade restrictions for ICT goods and online services  |  Sub-pillar Other import restrictions, including non-transparent/discriminatory import procedures
Decision No. 134 of the EEC Board on the Single List of Goods Subject to Prohibitions or Restrictions on Import or Export by the Customs Union Member States within the EurAsEC When Trading with Third Countries and Provisions on the Application of Restrictions, 16 August 2012
Licensing procedures are applied to the importation of certain digital goods to the territory of the Eurasian Economic Union, including Kazakhstan. These digital goods include (i) Civil radio-electronic equipment and/or high-frequency devices, including those which are built-in or form a part of other goods; (ii) Special hardware meant for secret information acquisition; (iii) Encryption devices.
Coverage Encryption devices, radio-electronic equipment, special hardware

KAZAKHSTAN

Since May 2013, as amended in November 2015, last amended in 2024
Since June 2023, last amended in 2024

Pillar Cross-border data policies  |  Sub-pillar Ban to transfer and local processing requirement
Law of the Republic of Kazakhstan No. 94-V about Personal Data and their Protection (Қазақстан Республикасының 2013 жылғы 21 мамырдағы № 94-V Заңы Дербес деректер және оларды қорғау туралы)

Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan, No. 179/NK, on Approval of the Rules for the Implementation by the Owner and (or) the Operator, as well as by a Third Party, of Measures to Protect Personal Data (Қазақстан Республикасының Цифрлық даму, инновациялар және аэроғарыш өнеркәсібі министрінің 2023 жылғы 12 маусымдағы № 179/НҚ бұйрығы Меншік иесінің және (немесе) оператордың, сондай-ақ үшінші тұлғаның дербес деректерді қорғау жөніндегі шараларды жүзеге асыру қағидаларын бекіту туралы)
In accordance with Art. 12.2 of Law No. 94-V, personal data must be stored in a database situated within the territory of Kazakhstan by the owner and/or operator, as well as by third parties. Pursuant to Art. 27-1, the Rules for the Implementation of Measures to Protect Personal Data by the Owner, Operator, and Third Parties were approved. According to Paragraph 8 of these Rules, the collection and processing of personal data with restricted access must be conducted via information facilities located within the Republic of Kazakhstan. The storage and transfer of such data should be carried out using cryptographic protection tools that meet at least the third level of security, as defined by the standard established in Kazakhstan. Personal data of restricted access includes all personal data, except for that which the data subject has made publicly available or that which is publicly accessible by explicit provision of the law. A similar provision was already in effect since 2021 in Rules bearing the same name, repealed in 2023, under its Paragraph 10.
Coverage Horizontal

KAZAKHSTAN

Since November 2015, last amended in December 2023

Pillar Quantitative trade restrictions for ICT goods and online services  |  Sub-pillar Local content requirements (LCRs) on ICT goods for the commercial market
Law No. 418-V ZRK of the Republic of Kazakhstan on Informatization (Қазақстан Республикасының Ақпараттандыру туралы Заңы 2015 жылғы 24 қарашадағы No. 418-V ҚРЗ)
According to Art. 7.6 of the Informatization Law, the central executive body carrying out state regulation in the field of electronic industry is tasked with establishing a unified register of trusted software and electronic products. According to Art. 54.3.1, for the purposes of state security, only approved software may be used for public procurement and for critical information and communication infrastructure, whether state-owned or private, including telecommunication infrastructure. In addition, it is reported that the local content for this software must not be less than 70%.
Coverage Horizontal

KAZAKHSTAN

Since July 2004, last amended in September 2022

Pillar Cross-border data policies  |  Sub-pillar Infrastructure requirement
Law of the Republic of Kazakhstan of July 5, 2004 No. 567-II "On Communications" (Қазақстан Республикасының 2004 жылғы 5 шілдедегі N 567 Заңы Байланыс туралы)
Art. 21 of the Law of the Republic of Kazakhstan on Communications stipulates that operators of communication networks of all categories included in the unified telecommunications network of the Republic of Kazakhstan shall be obliged to create at their own expense a system of centralised management of their networks, which must be located on the territory of the Republic of Kazakhstan.
Coverage Telecommunications sector

KAZAKHSTAN

Since May 2013, as amended in December 2017, entry into force in January 2018, last amended in 2022

Pillar Cross-border data policies  |  Sub-pillar Conditional flow regime
Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V on Personal Data and Its Protection (Қазақстан Республикасының 2013 жылғы 21 мамырдағы № 94-V Заңы Дербес деректер және оларды қорғау туралы)
In addition to the legal requirement of local processing of personal data in Kazakhstan introduced in 2015 in the Personal Data Law (Art. 12.2), pursuant to Art. 16.2 of the Law, a copy of personal data may only be transferred from Kazakhstan to a foreign country (including for purposes of processing) without prior permission from the personal data subject only if the recipient of the personal data is located in a country that protects personal data (at either the national level (by adopting national laws and regulations) or the international level (through international treaties). Pursuant to Art. 16.3 of the Personal Data Law, if no such protection is available, cross-border transfers of personal data are only possible if:
- The subject gives specific consent;
- In cases specified by international treaties ratified by Kazakhstan;
- In cases stipulated in the laws of Kazakhstan in order to protect the constitutional order, public order, rights and freedoms of an individual and a citizen, and public health and morality; and
- In the case of the protection of the constitutional rights of an individual and citizen, where getting the consent of the subject or their legal representative is impossible.
It is reported that national legislation does not specify a list of countries to which the transfer of data is prohibited, nor are there any criteria listed for determining the countries that provide a proper level of protection of personal data.
Coverage Horizontal

KAZAKHSTAN

N/A

Pillar Cross-border data policies  |  Sub-pillar Participation in trade agreements committing to open cross-border data flows
Lack of participation in agreements with binding commitments on data flows
Kazakhstan has not joined any agreement with binding commitments to open transfers of data across borders.
Coverage Horizontal

KAZAKHSTAN

Since May 2013, last amended in 2022
Since July 2020

Pillar Domestic data policies  |  Sub-pillar Framework for data protection
Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V on Personal Data and Its Protection (Қазақстан Республикасының 2013 жылғы 21 мамырдағы № 94-V Заңы Дербес деректер және оларды қорғау туралы)

Law on Amendments and Additions to Some Legislative Acts of the Republic of Kazakhstan on the Regulation of Digital Technologies (Қазақстан Республикасының Заңы 2020 жылғы 25 маусымдағы № 347-VI ҚРЗ Қазақстан Республикасының кейбір заңнамалық актілеріне цифрлық технологияларды реттеу мәселелері бойынша өзгерістер мен толықтырулар енгізу туралы)
Law No. No. 94-V provides a comprehensive regime of data protection in Kazakhstan. The Personal Data Law provides general regulations on the collection and processing of personal data and notably includes broad requirements for data localisation. In addition, the Amendment Law was introduced in July 2020, significantly extending data protection obligations for organisations. The Amendment Law introduces, among other things, further requirements for data collection and processing, obligations for data operators (similar to data processors), and redefines key concepts. The Amendment Law further establishes the competency of the data protection authority, including its powers and role.
Coverage Horizontal

Report issue     Report new measure