On 17 September 2026 the acting Minister of Artificial Intelligence and Digital Development of Kazakhstan signed Order No. 556/НҚ, amending the Rules on the collection and processing of personal data approved by Order No. 395/НҚ of the Minister of Digital Development, Innovation and Aerospace Industry of 21 October 2020. The order was registered with the Ministry of Justice the same day under No. 39902, and its text is published in the Әділет legal information system. It takes effect ten calendar days after its first official publication; the Kazakh legal news services Uchet.kz and Prosud.kz both give the date as 2 October 2026.
Among its changes, the order adds definitions of deletion, anonymisation and masking of personal data, and the definition of personal data now names biometric data explicitly. For this material we single out two paragraphs that matter to anyone who keeps records about employees, and a corporate training department is one of them.
The two paragraphs
Paragraph 11 is restated: personal data is stored by the owner and/or the operator, and also by a third party, in a database and/or digital object located on the territory of the Republic of Kazakhstan.
A new paragraph 4-5: cross-border transfer of personal data (except in the cases set out in Article 16 of the personal data law), dissemination in publicly available sources and transfer to third parties take place on condition of the data subject's consent. This material deals with the cross-border part.
The order does not say that the storage requirement is new — it gives paragraph 11 a new wording — so we do not describe it as a new ban. The restated paragraph places the storage duty on the owner and/or the operator and also on a third party. In our reading, for a company that runs its training on a platform somebody else hosts, that third party is the platform.
Why a training record is part of this
A learning platform is a register of people. It holds who was assigned which course, when they passed or failed a test, and which certificate they hold. Under the rules' own definition — data relating to an identified or identifiable person, on electronic, paper or any other medium — that is personal data. Our reading, not legal advice, is that the employer's training records sit inside the scope of paragraph 11 like any other personnel record, and that a platform storing them outside Kazakhstan would need each sync abroad accounted for under paragraph 4-5.
Where a training record is kept, read against paragraphs 4-5 and 11 of the amended rules. © Vardix Group
In heavy industry the question is sharper still. A mine or a field site often has no reliable connection, so a platform that only works online is already a poor fit there, before any rule about where the data lives. The amendment adds a second reason to ask the same question: where, physically, does the platform keep its database?
Three questions to put to any learning platform
Where is the database that holds the training records, and in which country?
Which features send data anywhere else — video hosting, analytics, automated assistance — and can they be switched off or run locally?
Can the platform be installed inside the company's own network and keep working at a site without internet access?
In our experience the second question is the one that takes time. A deployment inside the customer's perimeter is a scoping decision, not a checkbox: every feature that calls an outside service has to be either brought inside, replaced, or left out, and that is agreed for each deployment rather than assumed.
Where KNOWIKA fits
KNOWIKA is the group's corporate learning platform for Kazakhstan, built for mining, oil and gas and heavy industry. It starts with the courses Kazakhstan law makes mandatory, then adds the employer's side of training: inviting staff, assigning courses, following progress in reports and issuing certificates. Interface, content, tests and certificates are in Kazakh, Russian and English, and training works on a phone, with an offline mode for sites without a connection.
For companies that need it, KNOWIKA can be deployed within the corporate network, so that the training records stay inside the customer's perimeter. Features that call an outside service — video hosting, automated assistance — are scoped for each such deployment: brought inside, replaced or left out, as described above, rather than promised wholesale. Where the records live is the answer the amended rules make worth having in writing.
KNOWIKA: a corporate university platform for Kazakhstan's mining, oil and gas and heavy industry. © Vardix Group — KNOWIKA
For integrators and training partners
The amendment gives integrators, training providers and system partners in Kazakhstan a concrete conversation to open with an industrial customer: not "move your training online", but "where are your training records stored today, and can your current platform answer the three questions above?" If you work with industrial companies in Kazakhstan and want to bring KNOWIKA to them, the partnership form is the place to start.