On amendments and additions to some legislative acts of the Republic of Kazakhstan on artificial intelligence and digitalization

Home / Changes / On amendments and additions to some legislative acts of the Republic of Kazakhstan on artificial intelligence and digitalization

The Law of the Republic of Kazakhstan dated November 17, 2025 No. 231-VIII SAM

IZPI's note!

For the procedure of implementation, see art. 2.

Article 1. To make amendments and additions to the following legislative acts of the Republic of Kazakhstan:

1. To the Law of the Republic of Kazakhstan dated September 15, 1994 "On operational investigative activities":

add article 24-1 as follows:

"Article 24-1. Licensing in the field of special technical equipment intended for conducting operational search activities

1. Activities in the field of special technical means intended for conducting operational search activities are subject to licensing in accordance with the procedure established by the legislation of the Republic of Kazakhstan on permits and notifications.

2. Licensees in the field of special technical means intended for conducting operational search activities shall submit to the licensor reports, notices, a list, forms and frequency of which are determined by the licensor within the framework of qualification requirements.".

2. To the Law of the Republic of Kazakhstan dated December 21, 1995 "On National Security Agencies of the Republic of Kazakhstan":

Add subparagraph 21-9) to article 13 as follows:

"21-9) to carry out state control over issued permits in the areas of information security and special technical means intended for conducting operational search activities, in the form of inspections conducted for compliance with qualification or licensing requirements for issued permits, and unscheduled inspections in accordance with the Business Code of the Republic of Kazakhstan;".

3. To the Law of the Republic of Kazakhstan dated April 12, 2004 "On Regulation of Trading activities":

Add subparagraph 2-3) to paragraph 1 of article 31 as follows:

"2-3) in the retail sale of goods marked with means of identification in accordance with the procedure established by the legislation of the Republic of Kazakhstan on the regulation of trading activities, to record transactions through cash registers with the function of recording and (or) transmitting data by reading means of identification;".

4. To the Law of the Republic of Kazakhstan dated July 5, 2004 "On Communications":

In subparagraph 9) of Article 2, the words "authorized body and approved by the Government of the Republic of Kazakhstan" should be replaced with the words "and approved by the authorized body".

5. To the Law of the Republic of Kazakhstan dated May 4, 2010 "On Consumer Rights Protection":

Add paragraph 6 to article 27 as follows:

"6. The seller (manufacturer, contractor) is obliged to inform the consumer about the possible risk and about the conditions of safe use of the goods (work, service) containing components of artificial intelligence (produced, performed and /or provided by an artificial intelligence system), indicating the necessary information in the documentation attached to the product (work, service), on consumer containers, labels or in any other way accepted for certain types of goods (works, services).".

6. To the Law of the Republic of Kazakhstan dated May 21, 2013 "On Personal Data and their Protection":

1) in article 1:

In subparagraph 2), the word "information" should be replaced by the words "data, including biometric data".;

add subparagraph 2-3) as follows:

"2-3) automated processing of personal data – processing of personal data by an object of informatization, excluding the participation of the owner and (or) operator, as well as a third party in the processing process;";

2) in article 7:

In the title, the words "from publicly available sources" should be deleted.;

Paragraph 8 should be worded as follows:

"8. The collection and processing of personal data should be limited to achieving specific, predetermined and legitimate goals.

The collection and processing of personal data for the purpose of causing property damage and (or) moral harm, restricting the exercise of the rights, freedoms and legitimate interests of the subject is prohibited.";

add paragraphs 11 and 12 as follows:

"11. The collection and processing of personal data for the creation or expansion of databases through inappropriate extraction of personal data from publicly available sources is prohibited.

12. The use of technological means in public places to collect biometric data and identify the subject, as well as the collected biometric data and identification information, may be carried out solely for the purpose of protecting the constitutional order, protecting public order, human rights and freedoms, public health and morals, except in cases where the consent of the subject has been obtained.";

3) add paragraphs 5, 6 and 7 to Article 8 as follows:

"5. The period of validity of the consent to the processing of personal data may not exceed the period necessary to achieve the purposes of collecting and processing personal data, unless otherwise established by the laws of the Republic of Kazakhstan or the contract.

6. If the period of validity of the consent to the collection and processing of personal data is not specified, it is considered valid until the purposes of processing are achieved, as defined when it was provided.

7. The subject or his legal representative has the right to revoke consent to the collection and processing of personal data by notifying the owner and/or operator, as well as a third party.

Within fifteen working days, the owner and (or) the operator, as well as a third party, are obliged to stop processing personal data if their storage or processing is not required in accordance with the legislation of the Republic of Kazakhstan, or to submit a reasoned refusal.";

4) add paragraph 3 to Article 17 as follows:

"3. When collecting and processing personal data for the national artificial intelligence platform, depersonalization of personal data is carried out by the operator of the national artificial intelligence platform in accordance with the data management requirements approved by the Government of the Republic of Kazakhstan, except for the case when the depersonalization of personal data is carried out by the owner and (or) the operator independently.";

5) add article 19-1 to Chapter 2 as follows:

"Article 19-1. Requirements for automated personal data processing

1. Automated processing of personal data is prohibited, as a result of which the subject's rights and legitimate interests arise, change or terminate, except in the case when the subject's consent is obtained, or in cases provided for by the laws of the Republic of Kazakhstan.

2. The owner and (or) the operator, as well as a third party, are obliged to explain to the subject the procedure for automated processing of his personal data and possible consequences, provide an opportunity to object to the automated processing of his personal data, as well as explain the procedure for the subject's protection of his rights, freedoms and legitimate interests.

3. The owner and (or) the operator, as well as a third party, are obliged to consider the objection referred to in paragraph 2 of this article within three working days from the date of its receipt and notify the subject of the results of consideration of such objection.

The subject has the right to appeal against actions (inaction) owners and (or) the operator, as well as a third party in accordance with the procedure established by the laws of the Republic of Kazakhstan.".

7. To the Law of the Republic of Kazakhstan dated May 16, 2014 "On Permits and Notifications":

1) add paragraph 5 to article 52 as follows:

"5. Licenses for the provision of services for the identification of technical channels of information leakage and special technical means intended for conducting operational search activities, as well as within the framework of the activities of the operational center for information security and the activities of the information security incident response service, licenses in the field of special technical means intended for conducting operational search activities, and for the development of cryptographic information protection certificates issued indefinitely are subject to renewal within six months., Starting from January 1, 2026, licenses with a limited period of validity are issued in accordance with Appendix 1 to this Law.";

2) lines 27, 28 and 29 of Appendix 1 should be worded as follows:

27.

License for the development of cryptographic information protection tools

Inalienable;

The license is valid for 5 years.;

Class 1

28.

License to provide services for the identification of technical channels of information leakage and special technical means intended for conducting operational search activities, as well as within the framework of the activities of the operational center for information security and the activities of the information security incident response service

1. Identification of technical channels of information leakage and special technical means intended for conducting operational search activities.

2. Identification of technical channels of information leakage and special technical means intended for conducting operational search activities within the framework of the operational information security center.

3. Identification of technical channels of information leakage and special technical means intended for conducting operational search activities within the framework of the activities of the information security incident response service.

Inalienable;

The license is valid for 3 years.;

for subspecies, the license period is 3 years; Class 1

29.

License to carry out activities related to the development, production, repair and sale of special technical equipment intended for operational search activities

1. Development and production of special technical means intended for conducting operational search activities.

2. Repair and sale of special technical equipment intended for conducting operational search activities.

Inalienable; the license is valid for 5 years;

for subspecies, the license is valid for 5 years.;

Class 1

8. To the Law of the Republic of Kazakhstan dated November 24, 2015 "On Informatization":

1) in article 1:

subparagraph 30-6) after the words "legal entity," add the words "being a resident of the Republic of Kazakhstan without the participation of foreign individuals and legal entities,";

in subparagraph 30-7), replace the words "carrying out activities" with the words "being a resident of the Republic of Kazakhstan without the participation of foreign individuals and legal entities responding to an information security incident";

Sub-paragraphs 43-1), 54) and 55) should be deleted;

2) paragraph 1 of Article 7-2 should be supplemented with subparagraph 10-1) as follows:

"10-1) has the right to process personal data whose security has been violated in order to inform the subjects of personal data;";

3) add article 9-1 as follows:

"Article 9-1. Licensing in the field of information security

1. Information security activities are subject to licensing in accordance with the procedure established by the legislation of the Republic of Kazakhstan on permits and notifications.

2. Licensees in the field of information security shall submit to the licensor reports, notices, a list, forms and frequency of which are determined by the licensor within the framework of qualification requirements.";

4) paragraph 1 of Article 13 should be supplemented with subparagraph 17-1) as follows:

"17-1) performs data analysis at the request of information subjects in accordance with the data management requirements approved by the Government of the Republic of Kazakhstan;";

5) Articles 13-2 and 18-1 should be deleted;

6) add paragraph 2-2 to Article 35 as follows:

"2-2. Access to electronic information resources that are confidential to the operator of the national artificial intelligence platform is carried out taking into account the depersonalization of electronic information resources. The data is submitted to the operator of the national artificial intelligence platform in accordance with the data management requirements.";

7) in paragraph 6 of article 36:

The second part should be worded as follows:

"Automated processing of personal data is carried out in accordance with the legislation of the Republic of Kazakhstan on personal data and their protection.";

exclude part three;

8) add paragraph 7 to Article 39 as follows:

"7. The creation and development of artificial intelligence systems classified as e-government informatization facilities are carried out taking into account the specifics established by the legislation of the Republic of Kazakhstan in the field of artificial intelligence.";

9) in paragraph 3-3 of article 54:

in the first paragraph, replace the words "during the year" with the words "within six months";

Add the following paragraphs to the fourth and fifth ones:

"they are undergoing a test procedure for compliance with information security requirements;

provide information on the conducted information security audit to the authorized body in the field of information security.".

9. To the Law of the Republic of Kazakhstan dated April 9, 2016 "On Mail":

Add paragraph 3 to article 23-1 as follows:

"3. The costs (expenses) of the National Postal Operator for the delivery of cash to rural settlements of the Republic of Kazakhstan are reimbursed in accordance with the procedure and on the terms determined by the National Bank of the Republic of Kazakhstan.

Such costs are reimbursed provided that one hundred percent of the shares of the National Postal Operator are directly or indirectly owned by the state.".

10. To the Law of the Republic of Kazakhstan dated February 6, 2023 "On Digital Assets in the Republic of Kazakhstan":

1) in article 1:

add subparagraph 4-1) to read as follows:

"4-1) turnover of a digital asset – making civil law transactions with a digital asset;";

subparagraph 5) should be worded as follows:

"5) digital asset exchanges – legal entities providing organizational and technical support for trading, issuing, calculating and storing digital assets;";

add subparagraph 6-1) as follows:

"6-1) the release of a digital asset is an action aimed at the emergence of a digital asset as an object of civil rights;";

In subparagraph 8), the words "and data processing" should be deleted.;

in subparagraph 9), the words "and an industrial building located" should be replaced by the words "providing the functioning of computing facilities located";

in subparagraph 10), replace the word "received" with the words "originated (created)";

2) in article 8:

Delete paragraph 4;

Paragraph 5 should be worded as follows:

"5. The implementation of digital mining activities on the territory of the Republic of Kazakhstan is allowed to individual entrepreneurs, legal entities of the Republic of Kazakhstan and does not relate to the organization of the turnover of digital assets.";

Delete paragraph 6;

3) in paragraph 4 of article 10:

replace the word "received" with the words "originated (created)";

replace the words "release and turnover" with the words "organization of turnover";

4) in article 11:

Paragraph 1 should be supplemented with the second part as follows:

"The activity of organizing the turnover of digital assets is carried out by digital asset exchanges.";

In paragraph 2, the word "opens" should be replaced by the words ", the National Postal Operator of the Republic of Kazakhstan opens";

Paragraph 5 should be worded as follows:

"5. It is prohibited to organize the turnover of digital assets without an appropriate license or permission to carry out activities related to digital assets issued in accordance with the applicable law of the Astana International Financial Center or the laws of the Republic of Kazakhstan.";

5) in article 14:

in the first paragraph, the words ", with the exception of paragraph 4 of Article 8, which enters into force on January 1, 2024, establishing that this paragraph is valid from January 1, 2024 to January 1, 2025 in the following wording:"delete;

delete the second paragraph.

11. To the Law of the Republic of Kazakhstan dated June 19, 2024 "On Mass Media":

Add paragraph 7 to article 14 as follows:

"7. The distribution of mass media products created using an artificial intelligence system is allowed only if information about such products is provided in accordance with the Law of the Republic of Kazakhstan "On Artificial Intelligence."

Article 2. This Law shall enter into force sixty calendar days after the date of its first official publication, with the exception of paragraph 9 of Article 1, which shall enter into force on January 1, 2025.

President of the Republic of Kazakhstan

President

Republic of Kazakhstan

Constitution Law Code Standard Decree Order Decision Resolution Lawyer Almaty Lawyer Legal service Legal advice Civil Criminal Administrative cases Disputes Defense Arbitration Law Company Kazakhstan Law Firm Court Cases