Awe CheckPersonal data storage in Kazakhstan: where the server must be
The law requires databases with Kazakh citizens’ data to stay in Kazakhstan. What counts as a database, how to find the server country, and Cloudflare.
Checked against sources: 1 October 2026
- Art. 12(2): database in Kazakhstan
- 865,000 ₸up to, large business
- 259,500 ₸from, small business
What the law says
Article 12(2) of the Law on Personal Data and Their Protection: a database holding personal data of Kazakh citizens must be located in Kazakhstan.
Personal data means a name, phone, email, delivery address, IIN: anything that identifies a person. A website lead or a store order is already personal data.
What counts as a database in practice
- The server that runs the site and stores leads and orders.
- The CRM that receives leads: cloud amoCRM, Bitrix24 and similar.
- The mailbox or spreadsheet the form forwards data to.
- If the site is in Germany but leads go to a Kazakh CRM, only the CRM complies: the copy on the foreign server is still an issue.
How to find the server country
Awe Check finds the server country from the site’s IP address via the public IP registry (RDAP) and shows it in the report.
If the site is behind Cloudflare, DDoS-Guard or another CDN, you see the CDN address, not the server. Check the country in your hosting panel or with support.
What to do
- Move the site to a Kazakh host: PS.kz, Hoster.kz, QazCloud and others.
- If moving the site is costly, keep at least the leads and orders database in Kazakhstan.
- State in the privacy policy where data is stored.
Fine
Breaching personal data law is Article 79 of the Administrative Code: under part 1, 60 to 200 MCI depending on business size, 259,500 to 865,000 ₸ in 2026.
Frequently asked
Is a Tilda or Wix site a breach?
Site builders store form data on their own foreign servers. It is safer to send leads straight to a Kazakh CRM or mailbox and not keep them in the builder.
Does this apply to a site without forms?
If the site collects no names, phones or emails, there is nothing to store in Kazakhstan. Analytics sees IP addresses, but the database rule is applied in practice to leads, orders and accounts.
