Domestic law and policy

The Digital Code of the Republic of Kazakhstan No. 255-VIII ZRK, adopted on 9 January 2026, creates a unified legal framework for digital development, codifies digital rights, regulates biometric and other forms of digital authentication, and expressly guarantees a right to digital identity and its protection.^[24] This new code builds on earlier legislation, notably the Law On Documents of Identification, which governs the issuance, replacement and destruction of identity cards and passports for citizens, foreigners and stateless persons.^[25]

Complaint and redress mechanisms for digital-ID-related issues are provided both through general public-service appeal procedures and through specific supervisory powers created by the Digital Code. Under the ‘Government for Citizen’ state corporation, individuals can submit video appeals or online complaints to heads of state bodies, with a statutory obligation to respond within 15 days. These channels also support biometric or EDS authentication for accessing information and services.^[26] The Law on Public Services, which governs ID-card and digital-document issuance, already contains administrative complaint and appeal procedures for refusals, delays or mishandling of applications.^[27] In addition, the Digital Code requires the Ministry to review complaints from citizens and companies concerning biometric authentication and data processing. It must conduct unscheduled inspections and impose administrative fines for violations.^[28]

Data Protection

The Law On Personal Data and Their Protection No. 94-V (2013), sets out principles for the lawful collection, processing, storage and confidentiality of personal data, including by state bodies.^[29] As stated above, the Digital Code explicitly recognizes the right to digital identity and introduces rights to deletion, anonymization, restriction of processing, and tools for citizens to track which entities have accessed their data via eGov Mobile.^[30]

The personal data law defines biometric data as personal data characterizing physical and biological features capable of identifying a person and provides that confidentiality conditions for biometric data must be established by Kazakh legislation.^[31] Amendments adopted by Law No. 230-VIII of 17 November 2025 allow the collection and use of biometric data via technological means in public places for specified aims such as protection of constitutional order, public order, rights and freedoms, health and morals, unless the data subject consents.^[32] The same amendments require biometric authentication tools when working with ‘limited-access personal data’ in databases containing more than 100,000 records, which would cover large digital ID registers. However, these provisions function mainly as security and access-control requirements rather than a comprehensive special-category regime for biometrics.^[33]

Kazakh law does not explicitly prohibit government access to data collected for digital ID.^[34] It permits processing by state bodies on legal grounds and frames access through requirements of legality, purpose, necessity and proportionality.^[35] The Digital Code reiterates that any limitations on digital rights must meet the tests of legality, necessity and proportionality. Additionally it introduces transparency tools for citizens to see who accessed their data, but it does not create an outright ban on government accessing digital ID data.^[36]

International Commitments

Kazakhstan is not a party to any international framework, agreement, or treaty setting obligations on digital IDs. Kazakhstan has ratified ICCPR, ICESCR, CEDAW, CRPD, CRC, CERD, the 1951 Refugee Convention and 1967 Protocol, 1954 Statelessness Convention, and 1961 Reduction of Statelessness Convention.^[37]

As a signatory to international treaties, the country is obliged to ensure birth registration (ICCPR Article 24(2); and CRC Article 7), non-discrimination (ICCPR Article 2, 26; ICESCR Article 26; and CRC Article 2), and access to essential services like health (ICESCR Article 12), education (ICESCR Article 13), and social security (ICESCR Article 9).^[38] Furthermore, in its General Comment No. 25, the CRC Committee states that digital systems should be designed to enable all children to safely access essential digital public services and educational services without discrimination.^[39]

UNHCR and civil-society submissions to the UPR note that Kazakhstan’s Statelessness Determination Procedure and naturalization process impose heavy documentation burdens, that many stateless persons cannot meet.^[40]