The framework
The operative statute in Kazakhstan is the Law on Personal Data and its Protection (2013), enforced by the Ministry of Artificial Intelligence and Digital Development.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Law on Personal Data and its Protection
A consent-plus-localization regime in the Russian mold: personal data of Kazakh citizens must be stored on in-country servers, and cross-border transfers face adequacy-style limits.
Marketing and advertising
Consent-based with formal requirements; amendments have tightened biometric and digital-ID handling. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Restricted to states ensuring protection; consent otherwise. Domestic storage requirement for databases containing citizens' data.
Enforcement and penalties
Administrative fines; criminal exposure for unlawful dissemination.