SaaS and foreign AI models: where to store data and what the law on personal data in Kazakhstan allows

In a previous article for The Tech, Chingis Oralbayev analyzed whether it is permissible to use artificial intelligence at work, which data must not be shared with third-party services, and what responsibilities the employer bears.

In this new material, the author continues the topic of data protection and explains where data can be stored, under what conditions cross-border transfer is permitted, and what companies need to check before launching AI features.

Chingis Oralbayev, LL.M., Managing Partner of SOLIS Partners LLPSOLIS Partners, Member of the Chamber of Legal Consultants of the Republic of Kazakhstan

A Kazakhstani company provides a cloud service to corporate clients. An AI assistant feature has been added to the product: the user formulates a query, attaches a document or photo, and receives an answer within seconds. The database is hosted in Almaty, while the response is generated by a language model hosted on the infrastructure of a foreign provider.

When concluding the first contract, the client’s legal department asks three questions:

— where are the personal data stored?
— are they transferred outside Kazakhstan?
— who is responsible if the query contains personal data of third parties?

The answer “the server is located in Kazakhstan” addresses only part of the issue.

Legislation regulates not only the place of storage but also every transfer of personal data to the territory of a foreign state.

Storage and cross-border transfer are two separate obligations.

In the context of AI service architecture, two provisions of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” (hereinafter referred to as “the Law”) are key, although they are often conflated in practice.

The first is paragraph 2 of Article 12. As of August 25, 2026, following amendments introduced by Law No. 326-VIII dated June 24, 2026, personal data must be stored “in a database and/or a digital object located on the territory of the Republic of Kazakhstan.” The previous version referred only to a “database,” leaving room for debate regarding the applicability of the provision to cloud environments. The new version eliminates this ambiguity: platforms, applications, and cloud environments are considered digital objects. No transition period is provided for existing operators.

The second is Article 16, which regulates cross-border transfer, i.e., the transfer of personal data to the territory of foreign states. It determines whether such transfer is permissible and on what legal basis. Hosting a server in Kazakhstan ensures compliance with Article 12, but not with Article 16: if a query containing personal data is sent to a foreign provider’s model, a cross-border transfer occurs—regardless of whether the provider retains the received data.

Is hosting the main database in Kazakhstan sufficient?

Yes, provided that the Kazakhstani database is the primary and current one, not an archival copy. The law does not prohibit the parallel storage of personal data in Kazakhstan and abroad. The position of the authorized body is that the database on the territory of the Republic of Kazakhstan must remain up-to-date as the database located abroad is populated. This is stated in a letter from the Committee for Information Security dated May 6, 2024.

Practical rule: all personal data collected by the service must initially and in full volume enter the Kazakhstani infrastructure. A common mistake is to localize only registration data, while the history of inquiries, uploaded files, and technical logs are maintained with a foreign cloud provider. Such information also constitutes personal data if it allows for the identification of the subject.

The same conditions apply to backup copies. Storing a copy abroad is permissible if the main database is located in Kazakhstan and the copy itself is transferred to the territory of a foreign state on a lawful basis. Since a backup copy reproduces the entire database, it is advisable to ensure its encryption while keeping the keys with the Kazakhstani company and to regulate access and deletion procedures in the contract with the provider.

Query to the model: storage or transfer?

Transfer. Sending text or a file containing personal data to a model located outside Kazakhstan means that the data enters the territory of a foreign state. The duration of processing does not affect this conclusion.

A more complex question concerns data retained by the model provider: cache, query logs, and information for monitoring abuse. The Law does not establish a special regime for “short-term” storage. In our assessment, such copies should be regarded as an element of cross-border transfer and regulated under general rules: select provider conditions that exclude the use of queries for model training and limit the retention period of logs; stipulate in the contract the retention periods, deletion procedures, and notification of incidents; before sending a query, exclude from it information not required to obtain the answer—such as surnames, phone numbers, and document details.

The same conclusion applies to personnel. If developers, analysts, or support staff located outside Kazakhstan have access to the production database, such access also constitutes a cross-border transfer—even if the server is located within the Republic of Kazakhstan.

To which states is transfer permissible and when is consent required?

Article 16 establishes a two-tier rule. Transfer to the territory of states ensuring the protection of personal data is permitted. Transfer to other states is possible only in cases explicitly listed in the Law; for commercial services, the most applicable case is the subject’s consent. States that are members of the EU and apply Regulation (EU) 2016/679 may be reasonably considered as ensuring protection; however, since there is no officially approved list of such states, this conclusion should be supported by a written justification.

Regardless of the destination state, information about the presence or absence of cross-border transfer is a mandatory element of consent according to subparagraph 5 of paragraph 4 of Article 8 of the Law. The text of the consent should separately indicate the fact of transfer outside Kazakhstan, its purpose, the categories of recipients, and the list of data processed exclusively within the territory of the Republic of Kazakhstan.

Consent must be verifiable: it is given in writing, via a state or non-state service, or by any other method that allows confirmation of its receipt, according to paragraph 1 of Article 8. The construction “by continuing to use the service, the user expresses consent” does not, in our assessment, meet this requirement. The operator should preserve evidence: the date, version of the consent text, and user identifier.

Requirements of subordinate acts

In addition to the Law, the architecture of the AI service is defined by orders of the authorized body. The Rules for Implementing Measures to Protect Personal Data, approved by Order No. 179/NQ in the edition dated June 22, 2026, and effective from July 12, 2026, provide for:

— paragraph 13: collection and processing of restricted-access personal data are carried out using digital objects located on the territory of the Republic of Kazakhstan. The Law classifies as restricted-access data those to which access is limited by legislation; under a broad interpretation, this covers most personal data that are not publicly available. If a query to a foreign model includes Individual Identification Numbers (IIN), health information, or facial images, this paragraph, together with Article 12, constitutes a strong basis for refraining from such transfer.

— paragraph 14: databases containing personal data are located in server rooms or data centers on the territory of the Republic of Kazakhstan.

— paragraph 12: for restricted-access data, maintenance of system management database event logs and user action logs is required; cryptographic protection tools must be applied during storage at no lower than the third security level according to ST RK 1073-2007; and transfer to other persons is allowed only via secure communication channels. For databases containing more than 100,000 records, user identification and authentication, including biometric, are required.

— paragraph 11: notification of the authorized body about a personal data security breach within one working day from the moment of discovery.

Two other acts supplement these requirements. According to Order No. 199/NQ, the owner and/or operator must approve a list of personal data necessary and sufficient for performing tasks, specifying the purposes, before processing begins. In the context of an AI function, this constitutes an independent position of the list—specifying which data and for what purpose are sent to the model. The Rules for Collection and Processing of Personal Data, approved by Order No. 395/NQ, establish that processing ceases within fifteen working days after withdrawal of consent, and information is provided upon the subject’s request within three working days.

Distribution of responsibility: client, SaaS, and model provider

In a B2B service, three parties are involved: the client transfers personal data of its employees and counterparties and defines the purposes of processing; the SaaS company processes data on behalf of the client; the model provider receives queries from the SaaS company. The Law uses the concepts of owner, operator, and third party, rather than the categories of “controller” and “processor.” Nevertheless, the distribution of roles and obligations by contract is permissible: a Personal Data Processing Agreement (DPA) between the client and the SaaS company is applicable under Kazakhstani law if it is based on Kazakhstani terminology and is not merely a translation of a foreign template.

Three provisions cannot be changed by contract.

— the law does not provide for grounds such as “contract performance” or “legitimate interest.” Processing is permitted with the subject’s consent according to Article 8 or in cases exhaustively listed in Article 9. A contract with a legal entity is not a ground for processing the personal data of its employees.

— the role is determined by factual circumstances. The closest analog to “processor” is the “third party.” However, if the SaaS company independently determines the means of processing—such as choosing the model provider, mailing service, or hosting—it may be recognized as an operator with respect to such operations.

— obligations to protect personal data are imposed on all participants according to Article 22. Each person carrying out processing must confirm its lawfulness according to paragraph 3-1 of Article 7. A counterparty’s guarantee in a contract is not proof of obtaining consent.

In the Personal Data Processing Agreement, it is advisable to stipulate who ensures the obtaining of employees’ consents; the SaaS company’s obligation to process data only according to the client’s instructions and to disclose the list of foreign subcontractors, including the model provider; the prohibition on uploading personal data of third parties without a legal basis and the procedure for their deletion; and the procedure and deadlines for notification in case of a security breach.

Two issues often overlooked

If AI makes decisions. An assistant preparing a draft response for a specialist and a system independently approving applications, distributing orders, or assigning ratings are fundamentally different situations.

Article 19-1 of the Law prohibits automated processing of personal data resulting in the emergence, alteration, or termination of the subject’s rights and legitimate interests, except in cases of obtaining the subject’s consent or as provided by law.

Article 43 of the Digital Code establishes the rights of the subject when algorithmic systems are applied: to receive information about the fact of their application, an explanation of the key factors of the decision without disclosing the algorithms, and to demand a review of the decision with the participation of an authorized specialist. As long as an employee substantively evaluates the result rather than merely formally confirming it, the decision is not fully automated.

Operator category. Article 25-1 of the Law divides owners and operators by the number of unique subjects: small—up to 10,000; medium—up to 500,000; large—500,000 and more.

In the processing of restricted-access personal data, the category increases by one level; a large operator must notify the authorized body before processing begins. Unique physical persons in all digital objects of the company must be taken into account, not records or databases; therefore, splitting data among several systems does not change the threshold value.

The subject’s request to modify, block, or delete data is executed within one working day according to paragraph 2 of Article 25. For a SaaS service, this is an architectural issue: deleting an account must entail the deletion of associated logs and files.

What needs to be done before launching the AI function

1. Create a personal data map: registration data, inquiry history, uploaded files, technical logs with IP addresses, backup copies. For each category, determine the place of storage, the presence of cross-border transfer (including via remote personnel access), and classification as restricted-access data.
2. Approve a list of necessary and sufficient personal data, with a separate position for the AI function.
3. Ensure the placement of the main database for all data categories in a data center on the territory of the Republic of Kazakhstan and its primary update.
4. Minimize personal data in queries to the model; do not transfer restricted-access data.
5. Select provider conditions that exclude training on queries and limit log retention, and stipulate them in the contract.
6. Align consent with Article 8 of the Law: include mandatory elements, information about cross-border transfer, use a verifiable format, and preserve evidence.
7. Determine the number of unique subjects and the operator category; notify the authorized body if necessary.
8. Implement logging, cryptographic protection, and access control; appoint a person responsible for organizing processing; and approve internal documents.
9. In case of decisions made without human involvement, ensure subject consent, information provision, and a procedure for reviewing the decision.
10. Distribute roles with clients in the Personal Data Processing Agreement based on Kazakhstani terminology and ensure compliance with deadlines: data deletion—within one working day; response to the subject—three days; cessation of processing after withdrawal of consent—fifteen days; notification of incident—within one working day.

Legislation does not prohibit the use of AI in a product. The question lies in the processing architecture: which data, where, and on what legal basis are transferred. If this is answered before the feature is released, the legal aspect may take about a week. If after the first complaint from a major client or an inspection—changes will be required in both the product and the contractual framework, and such changes may take significantly more time.