Checklist: handling customer data when implementing AI in Kazakhstan

An AI assistant on WhatsApp is essentially a new system that collects and processes your conversations with clients: names, phone numbers, sometimes medical or financial details. In Kazakhstan this falls under the Law “On Personal Data and Their Protection” (No. 94-V), and introducing AI does not exempt you from these requirements. Below is the practical checklist we go through on every project.

This is not legal advice. The wording of the privacy policy and consent for your company should be reviewed by a lawyer. Here we provide a practical map of what needs to be covered in the first place.

1. Where the data is physically stored

The assistant’s knowledge base, conversation history and CRM records must be kept on a server located in Kazakhstan. This is not a “nice to have” but a requirement of the law on localization of the personal data of Kazakhstani citizens. In practice this means a VPS in Kazakhstan, not an off-the-shelf foreign SaaS without a local setup.

2. Consent: explicit and before data collection

The client must explicitly consent to data processing before their first message reaches your system. Usually this is a checkbox on the website and a short message at the start of the conversation with the assistant with a link to the privacy policy.

3. The assistant must disclose that it is AI

The Law of the Republic of Kazakhstan “On Artificial Intelligence” came into force on January 18, 2026 and requires informing users that they are interacting with an AI system. In practice, one line in the greeting message is enough: “You are being assisted by the company’s AI assistant…”.

4. Cross-border data transfer

If the assistant uses a foreign language model API (OpenAI, Anthropic and similar), part of the conversation technically leaves Kazakhstan. This is a cross-border transfer of personal data, and it requires a separate legal basis (usually the data subject’s consent) and a mention in the privacy policy. A practical way to reduce the risk: send the model the minimum of personal data, not a full dump of the conversation.

5. Register of data processing activities

Under the current rules, the operator must keep a record of what happens to the data: to whom it is transferred, when, and on what basis, including cross-border transfers. For a small business this can be a simple spreadsheet, but it must exist and be kept up to date.

6. Contract with the contractor

If the assistant is built by an outside contractor (for example, us), the contract must state explicitly: what data is processed, for what purpose, where it is stored, who else sees it (the hosting provider, the language model provider) and what happens to the data after the engagement ends.

7. Incident response plan

Even a simple assistant should have a clear answer to the question “what do we do if the database leaks or a conversation ends up in the wrong place”: who is notified, within what time frame, and what clients are told.

What happens if you skip this step

Fines for violations in this area have grown several times over in recent years, and in serious cases they can reach tens of millions of tenge. Beyond the fine, there is reputational risk: clients in Kazakhstan are sensitive to personal data leaks, especially in healthcare and finance.