Personal data on websites in Kazakhstan
A lead form collects personal data. That means you need consent in the form the law sets, proof of that consent, and leads stored on a server in Kazakhstan. We go article by article through what this means for the form and the database.
Checked against adilet.zan.kz on 13.11.2026What the law says.
Law of the Republic of Kazakhstan No. 94-V of 21 May 2013, as amended by Law No. 326-VIII of 24 June 2026.
- Collection only with consent
The owner or operator collects and processes personal data with the data subject’s consent, except in cases expressly named in the law (Art. 7(1)).[1]
- Consent you can prove
Consent is given in writing, through a state or non-state service, or in another way that makes it possible to confirm it was obtained (Art. 8(1)). The operator must provide proof that consent was obtained (Art. 25(2)(5)).[1]
- What the consent must contain
The operator’s name and BIN, the data subject’s full name, the period of validity, whether data may be transferred to third parties, whether there is cross-border transfer, whether data may be disseminated in publicly available sources, and the list of data (Art. 8(4)).[1]
- Withdrawal within fifteen working days
A person has the right to withdraw consent. Within fifteen working days the operator stops processing or gives a reasoned refusal (Art. 8(7)).[1]
- Storage in Kazakhstan
Personal data are stored in a database or digital object on the territory of the Republic of Kazakhstan. The storage period is determined by achieving the purposes of collection (Art. 12(2)).[1]
- Transfers abroad and to third parties
Cross-border transfer and transfer to third parties take place with the data subject’s consent (Art. 7(6)). Transfer to countries that do not ensure data protection is possible, in particular, with the data subject’s consent (Art. 16(3)(1)).[1]
- Operator duties
Approve the list of data and documents on the processing policy, take legal, organisational and technical protection measures, and, for a legal entity, appoint a person in charge (Art. 25(2)). Categories of operators by number of data subjects were added in Art. 25-1.[1]
What to do on the website.
The minimum for a lead form that collects a name, phone number or e-mail. A consent log and handling cookies separately are practice, not a word-for-word requirement of the law.
- Full name fieldThe consent names the data subject by surname, first name and patronymic (Art. 8(4)(2)). Without a name, the consent can’t be tied to a person.
- A separate consent checkboxNot pre-ticked, with a link to the full consent text next to it. The form won’t submit without it.
- Consent logWith each lead we store the fact of consent, the date and time, and the version of the text. That is the proof under Art. 25.
- Server in KazakhstanThe lead database sits on a server in Kazakhstan. A copy in a foreign CRM or mailbox is already a cross-border transfer.
- An honest consent textOnly the transfers that actually happen: hosting, e-mail, messengers, analytics. Plus how to withdraw consent.
- Cookies separatelyAnalytics and ads with cookies run on separate consent in a banner, not on the same checkbox as the lead form.
Where people usually get it wrong.
Common cases we see on websites before a rebuild.
How to get your website in order.
The order we follow on our projects.
- Data inventory
Which forms and fields exist and where each lead goes: database, e-mail, CRM, messenger.
- Operator documents
The list of data, the processing policy, the person responsible for processing. The company approves them, a lawyer drafts the text.
- Consent text
Item by item under Art. 8(4): operator and BIN, list of data, period, third parties, cross-border transfer, withdrawal procedure.
- Form and database
Full name, checkbox, link to the consent, a record of the time and the text version. Leads stored on a server in Kazakhstan.
This is not legal advice.
This is not legal advice: we have summarised the law as worded on the date of the check and shown how we build forms ourselves. Your lawyer approves the policy and consent for your company. The law changes, so check the current version on adilet.zan.kz before launch.
Further reading.
Our documents and related guides.
Checked on 13 November 2026
This is not legal advice. Laws change: before launch, check the current version on adilet.zan.kz and talk to a lawyer or accountant.
Short and to the point.
Do I need consent if the form only asks for a name and phone number?
Yes. A name and phone number are personal data, and they are collected with the data subject’s consent (Art. 7(1) of Law No. 94-V). The exceptions are listed in the law (Art. 9): whether your case fits them is for a lawyer to decide.
Can we store leads in a foreign CRM?
The law requires personal data to be stored in a database on the territory of Kazakhstan (Art. 12(2)). Sending data to a foreign service is a cross-border transfer: it takes place with the data subject’s consent and is stated in the consent text (Art. 7(6), Art. 8(4)(5)).
How do I prove that a person gave consent?
The law allows any method that makes it possible to confirm consent was obtained (Art. 8(1)). On a website, that is a database record: who ticked consent, when, and which version of the text they saw.
How long should leads be kept?
Until the purposes of collection are achieved, unless legislation requires otherwise (Art. 12(2)). It’s worth stating the period in the consent and the policy, and then deleting old leads.
Do analytics cookies need a separate checkbox?
We found no separate rule on cookies in Law No. 94-V. But analytics collects data about the device, and if the service is foreign, that is a cross-border transfer. We ask for separate consent in the cookie banner.
Shall we check your lead form?
Send us your website address: we’ll look at what the forms collect and where leads go, and tell you what to fix.