Where we work · Kazakhstan
ISO and GRC certification consulting in Kazakhstan
Achieve ISO and GRC certification in Kazakhstan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Kazakhstan
Clients include
In short
ISO and GRC certification in Kazakhstan at a glance
Kazakhstan's Law "On Personal Data and their Protection" (No. 94-V of 21 May 2013) has been amended repeatedly, most recently by Law No. 326-VIII of 24 June 2026, and it now works alongside a ministry that writes the rules, keeps the registers and exercises state control. Around it sit the National Accreditation Centre, which describes itself as the national accreditation body for conformity assessment, the Kazakhstan Institute of Standardization and Metrology for national standards, the Public Procurement Law of 2024, an Environmental Code that rewards adopters of environmental management system standards and a Health Code that names ISO 13485 for contract manufacturing. Buyers in oil and gas, mining and metals, energy, agri-food, logistics and financial services ask suppliers for certificates, and the Astana International Financial Centre runs its own data protection regulations under a Commissioner. Certificates come from accredited certification bodies, never from Sterling. Sterling's Dubai office serves clients in Kazakhstan on site where the work needs it and remotely otherwise, bringing 20+ years and 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
Explore
ISO and GRC standards Sterling delivers in Kazakhstan
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
ISO 22301Sterling guide to the standardISO 37001Sterling guide to the standardISO 37301Sterling guide to the standard
Financial services, payments & AML
Food safety & agriculture
FSSC 22000Sterling guide to the standardHACCPSterling guide to the standardISO 22000Sterling guide to the standard
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Kazakhstan (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law of the Republic of Kazakhstan "On Personal Data and their Protection" dated 21 May 2013 No. 94-V The Law's 'authorised body in the field of personal data protection' is the central executive body responsible for supervising the personal data protection field (Article 1). Government Decree No. 846 of 9 October 2025 approves the Regulation on the Ministry of Artificial Intelligence and Digital Development, which lists among its functions approving the rules for collecting and processing personal data, maintaining the register of persons who collect or process personal data and the register of personal data security breaches, and exercising state control over compliance with the personal data legislation. The Law also gives bodies of the Prosecutor's Office supreme supervision (Article 28) and local executive bodies state control over private business entities in their territory (Article 27) | Applies to collection, processing and protection of personal data by owners, operators and third parties, except purely personal and family use, national archive and state-secret matters and listed security activities (Article 3); other laws and the Digital Code of the Republic of Kazakhstan, which the Law cites, add specific rules. Consent is given in writing, through a state service, through a non-state service or in another manner that confirms it, and must state the owner or operator, the validity period, whether data go to third parties or across borders and the list of data collected (Article 8). Collection without consent is limited to the cases listed in Article 9. Hard copies of identity documents may be collected only in the exceptional cases the Law lists (Article 7). Personal data are stored in a database or digital storage located within the territory of Kazakhstan (Article 12). Cross-border transfer is allowed only to states that ensure protection under the Law, or without that protection in listed cases such as the subject's consent or a ratified treaty (Article 16). Data subjects may ask to know, correct, block, anonymise, delete and revoke consent (Article 24), and an owner or operator must stop processing or give a reasoned refusal after withdrawal (Article 8). Owners and operators must adopt a personal data policy document, protect the data, notify the competent authority of a security breach from the moment of detection, give evidence of consent and appoint a person responsible for organising processing where they are legal entities (Article 25), and masking and hashing are applied to digital assets (Article 23). Automated processing that affects rights needs consent and a right to object (Article 19-1). Amendments by Law No. 326-VIII add a notification to the authority before processing starts and ends, with small and medium-sized owners and operators exempt, and a classification of owners and operators by the number of unique data subjects (Articles 10-1 and 25-1). The Law does not itself state fines: liability follows other laws (Article 29). | |
| AIFC Data Protection Regulations (AIFC Regulations No. 10 of 2017), with amendments as of 1 April 2025 Commissioner of Data Protection of the Astana International Financial Centre, who supervises and enforces the AIFC data protection laws, keeps a Register of Notifications, issues permits for transfers out of the AIFC and for processing sensitive personal data, and reviews complaints (aifc.kz) | Applies within the jurisdiction of the AIFC, including controllers and processors incorporated in the AIFC and those that process personal data in the AIFC as part of arrangements other than on an occasional basis (section 5). The Regulations cover conditions of consent, designation of a Data Protection Officer, data protection impact assessments, transfers out of the AIFC, data breach notification to the Commissioner and to data subjects, and certification schemes. They are separate from the national Law, which applies outside the AIFC; organisations with both AIFC and national operations should map which regime covers each activity. | |
| State body in the field of sanitary and epidemiological welfare of the population, under the Law "On Food Products Safety" dated 21 July 2007 No. 301; the Eurasian Economic Commission publishes the technical regulation TR CU 021/2011 Food producers, processors and importers | The Law defines the system of hazard analysis and critical control points (HACCP) and lists among the rights of subjects the development and maintenance of HACCP-based procedures and the introduction of quality and food safety management systems (Article 10). The technical regulation "On safety of food products" (TR CU 021/2011), approved by Customs Union Commission Decision No. 880 of 9 December 2011 and co-developed by Kazakhstan's Ministry of Agriculture according to the Commission's page, requires a manufacturer to develop, implement and maintain procedures based on HACCP principles (Article 10, paragraph 2); the Commission's page records its entry into force on 1 July 2013 with exceptions for milk and dairy, meat and fish products. | HACCP |
| The authorised body for the regulation, control and supervision of the financial market and financial institutions, under the Law dated 4 July 2003 No. 474 "On state regulation, control and supervision of the financial market and financial organisations" (the Law's text calls it the authorised body and describes it as a state body directly subordinate and accountable to the President) Banks, insurers and other financial institutions | Article 13-6 sets out its role as the information security authority for financial institutions: it approves the procedure for assessing the level of protection against information security threats, the methodology for assessing information security risks, requirements for information security incident response and adopts acts that bind financial organisations. The Law also gives it the task of monitoring and supervising compliance with information security requirements and supervising the use of artificial intelligence systems by financial institutions. The Law does not name ISO standards. | |
| State body in the field of circulation of pharmaceuticals and medical devices, under the Code of the Republic of Kazakhstan dated 7 July 2020 No. 360-VI "On the health of the people and the healthcare system" Pharmaceutical, medical device and cosmetics makers and importers | The Code subjects pharmaceuticals and medical devices produced in or imported into Kazakhstan to state registration and provides that products for the customs territory of the Eurasian Economic Union are registered under uniform Union rules. It defines contract manufacturing of pharmaceuticals and medical devices as production at facilities that ensure full compliance with good manufacturing practice (GMP) for pharmaceuticals and with the international quality management system standard ISO 13485 for medical device manufacturers. | ISO 13485 |
| Government of the Republic of Kazakhstan, Decree dated 20 December 2016 No. 832 "On approval of unified requirements in the field of information and communication technologies and ensuring information security", issued under the Law "On Informatization" State bodies, state legal entities, the quasi-state sector and owners of non-state systems integrated with state systems | The unified requirements bind the listed organisations on information security. Paragraph 29 directs them to follow the national standard ST RK ISO/IEC 27002-2023 when organising, ensuring and managing information security, and risk assessment follows ST RK ISO/IEC 27005-2022. Chapter 4, added by Decree No. 119 of 25 February 2026, sets documentation duties for owners and operators of critically important information and communication infrastructure that run industrial process control systems, including a continuity and recovery plan with downtime and data loss targets. The text names ISO/IEC 27002 and 27005 through national standards, not ISO/IEC 27001 certification. | iso-27002, iso-27005 |
| Authorised body under the Law dated 13 January 2012 No. 541-IV "On Energy Saving and increase of Energy Efficiency", which keeps the State Energy Register Large energy consumers and energy service firms | Subjects of the State Energy Register report consumption data and energy saving action plans annually, and those consuming energy above the Law's stated threshold must undergo a mandatory energy audit at a set interval (Article 16). The Law defines an 'express energy audit' as an abbreviated audit confirming energy analysis carried out within a management system in the field of energy saving. The former Article 10 on energy management was excluded by Law No. 279-V of 14 January 2015, and the Law does not name ISO 50001. | |
| Authorised body in the field of environmental protection, under the Environmental Code of the Republic of Kazakhstan dated 2 January 2021 No. 400-VI Operators with environmental permits and inspections | Article 46 provides that the introduction of international standards of the environmental management system by individuals and legal entities is stimulated, including through a lower degree of risk in state environmental control for persons who have introduced such a standard and hold a document confirming it, and through economic incentive measures provided for by other laws. The Code does not name ISO 14001 by number. | ISO 14001 |
| Authorised state body for labour, under the Labour Code of the Republic of Kazakhstan dated 23 November 2015 No. 414-V Employers (occupational safety and health) | The Code defines an occupational health and safety management system as interconnected measures for labour safety policy, compliance and occupational risk management, and Article 201 makes internal control include organising the creation and implementation of an occupational safety management system. Article 200 provides for a declaration of employer activity, and employers recognised as compliant receive a certificate of confidence that is taken into account when preventive control lists are formed. The Code does not name ISO 45001. | |
| Authorised body for anti-corruption policy, under the Law dated 18 November 2015 No. 410-V "On Combating Corruption" Quasi-state entities and their suppliers (anti-corruption) | Article 16 provides that quasi-public sector entities define a structural unit or responsible person performing the functions of an anti-corruption compliance service, acting independently of the executive body, while business entities outside the quasi-public sector have the right to create such a service and associations may develop prevention standards. Article 10 provides for anti-corruption standards approved by state bodies and quasi-public entities. The Law does not name ISO 37001 or ISO 37301. | |
| Kazakhstan Institute of Standardization and Metrology, designated the national standardisation body by Government Decree No. 885 of 25 December 2018 under the Law "On Standardisation" of 5 October 2018 Standardisation (national standards) | Standards role only: the Institute's own site says it develops and introduces national standards and takes part in accreditation of laboratories and certification bodies as part of its wider work. National standards carry the ST RK prefix, as in ST RK ISO/IEC 27002-2023, which the unified information security requirements cite. |
Accreditation and recognition
- National Accreditation Centre (NCA): National accreditation body — NCA's own site says it is the single national accreditation body for conformity assessment defined by the Government (Resolution No. 439 of 28 June 2021) and that it works under the Law of 5 July 2008 "On accreditation in the field of conformity assessment" and ISO/IEC 17011.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Law of the Republic of Kazakhstan No. 106-VIII of 1 July 2024 "On Public Procurement" (State customers and organisers, under rules set by the competent authority): Article 11 lists the qualification requirements for potential suppliers: legal capacity, financial stability and no significant tax debt, no bankruptcy or liquidation proceedings, sufficient material, labour and financial resources, and work experience. It bars qualification requirements not listed, with exceptions for certain tender types. Tender and auction documentation is prepared in Kazakh and Russian and must refer to national standards (or interstate standards where none exist) in the technical specification, and the supplier must furnish documents proving that goods conform to technical regulations and standards. An ISO management system certificate is not among the listed qualification requirements, so any such request sits in the individual tender documents.
Economic zones
- Astana International Financial Centre (AIFC), Astana: financial services, fintech, insurance, Islamic finance, professional services
- Special economic zone Seaport Aktau, Aktau: port and logistics, warehousing, manufacturing, tourism
- Special economic zone Khorgos – Eastern Gate: cross-border trade, logistics, warehousing
- Special economic zone Ontustik: textiles and light industry, chemicals, petrochemicals, mechanical engineering
- Special economic zone Qyzyljar: agricultural machinery assembly
Sterling in Kazakhstan
Sterling delivers in Kazakhstan from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Kazakhstan clients ask
Is Kazakhstan's personal data law in force, and who supervises it?
Yes. The Law "On Personal Data and their Protection" of 21 May 2013 (No. 94-V) is published on Adilet in a version updated to October 2026, with amendments through 2026. Supervision sits with the authorised body, the central executive body for personal data protection, and the Regulation on the Ministry of Artificial Intelligence and Digital Development lists those functions, while prosecutors supervise the law. Confirm which amendments apply to you with counsel.
Can personal data of people in Kazakhstan be kept on servers abroad?
Not freely. The Law places personal data databases and digital storage within Kazakhstan, so a foreign cloud region alone is risky for data about people in the country. Transfers across borders have their own conditions, including protection in the receiving state or listed cases. Ask counsel to review hosting before you migrate systems.
Which accreditation body stands behind a Kazakhstan ISO certificate?
The National Accreditation Centre is the national body for conformity assessment, and its own site lists recognitions for testing and calibration laboratories, product certification and management system certification in quality, environmental and food safety management. A certification body may also hold accreditation from another body within the international arrangements. Ask for the accreditation certificate and check that its scope covers your standard.
Do Kazakhstan government tenders require an ISO certificate?
Not as a general rule. The Public Procurement Law of 2024 lists supplier qualification requirements covering legal capacity, financial stability, bankruptcy status, resources and experience, and an ISO management system certificate is not among them. Tender documents, prepared in Kazakh and Russian, set their own conformity requests for goods, so read each document and ask the buyer where you are unsure.
Does the Astana International Financial Centre follow different data protection rules?
Yes. The AIFC has its own Data Protection Regulations (AIFC Regulations No. 10 of 2017, as amended to April 2025) supervised by a Commissioner of Data Protection, with duties such as consent conditions, a Data Protection Officer, impact assessments and breach notification. They apply within the AIFC jurisdiction, while the national Law applies outside it, so firms with both footprints should map each activity.
In what language are certification audits in Kazakhstan conducted?
Agree it with the certification body when you apply. Kazakh and Russian both appear in legislation and public tenders, while the Astana International Financial Centre publishes its rules in English. Choose the working language of audits, any interpreter and controlled documents at the start, and tell the body which language site staff will speak.
Next step
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law of the Republic of Kazakhstan "On Personal Data and their Protection" dated 21 May 2013 No. 94-V — adilet.zan.kz; old.adilet.zan.kz (accessed 17 Oct 2026)
- AIFC Data Protection Regulations (AIFC Regulations No. 10 of 2017), with amendments as of 1 April 2025 — aifc.kz (accessed 17 Oct 2026)
- The Law defines the system of hazard analysis and critical control points (HACCP) and lists among the rights of subjects the development and maintenance of HACCP-based procedures and the introduction of quality and food safety management systems (Article 10). The technical regulation "On safety of food products" (TR CU 021/2011), approved by Customs Union Commission Decision No. 880 of 9 December 2011 and co-developed by Kazakhstan's Ministry of Agriculture according to the Commission's page, requires a manufacturer to develop, implement and maintain procedures based on HACCP principles (Article 10, paragraph 2); the Commission's page records its entry into force on 1 July 2013 with exceptions for milk and dairy, meat and fish products — old.adilet.zan.kz; eec.eaeunion.org (accessed 17 Oct 2026)
- Article 13-6 sets out its role as the information security authority for financial institutions: it approves the procedure for assessing the level of protection against information security threats, the methodology for assessing information security risks, requirements for information security incident response and adopts acts that bind financial organisations. The Law also gives it the task of monitoring and supervising compliance with information security requirements and supervising the use of artificial intelligence systems by financial institutions. The Law does not name ISO standards — old.adilet.zan.kz (accessed 17 Oct 2026)
- The Code subjects pharmaceuticals and medical devices produced in or imported into Kazakhstan to state registration and provides that products for the customs territory of the Eurasian Economic Union are registered under uniform Union rules. It defines contract manufacturing of pharmaceuticals and medical devices as production at facilities that ensure full compliance with good manufacturing practice (GMP) for pharmaceuticals and with the international quality management system standard ISO 13485 for medical device manufacturers — old.adilet.zan.kz (accessed 17 Oct 2026)
- The unified requirements bind the listed organisations on information security. Paragraph 29 directs them to follow the national standard ST RK ISO/IEC 27002-2023 when organising, ensuring and managing information security, and risk assessment follows ST RK ISO/IEC 27005-2022. Chapter 4, added by Decree No. 119 of 25 February 2026, sets documentation duties for owners and operators of critically important information and communication infrastructure that run industrial process control systems, including a continuity and recovery plan with downtime and data loss targets. The text names ISO/IEC 27002 and 27005 through national standards, not ISO/IEC 27001 certification — old.adilet.zan.kz (accessed 17 Oct 2026)
- Subjects of the State Energy Register report consumption data and energy saving action plans annually, and those consuming energy above the Law's stated threshold must undergo a mandatory energy audit at a set interval (Article 16). The Law defines an 'express energy audit' as an abbreviated audit confirming energy analysis carried out within a management system in the field of energy saving. The former Article 10 on energy management was excluded by Law No. 279-V of 14 January 2015, and the Law does not name ISO 50001 — old.adilet.zan.kz (accessed 17 Oct 2026)
- Article 46 provides that the introduction of international standards of the environmental management system by individuals and legal entities is stimulated, including through a lower degree of risk in state environmental control for persons who have introduced such a standard and hold a document confirming it, and through economic incentive measures provided for by other laws. The Code does not name ISO 14001 by number — old.adilet.zan.kz (accessed 17 Oct 2026)
- The Code defines an occupational health and safety management system as interconnected measures for labour safety policy, compliance and occupational risk management, and Article 201 makes internal control include organising the creation and implementation of an occupational safety management system. Article 200 provides for a declaration of employer activity, and employers recognised as compliant receive a certificate of confidence that is taken into account when preventive control lists are formed. The Code does not name ISO 45001 — old.adilet.zan.kz (accessed 17 Oct 2026)
- Article 16 provides that quasi-public sector entities define a structural unit or responsible person performing the functions of an anti-corruption compliance service, acting independently of the executive body, while business entities outside the quasi-public sector have the right to create such a service and associations may develop prevention standards. Article 10 provides for anti-corruption standards approved by state bodies and quasi-public entities. The Law does not name ISO 37001 or ISO 37301 — old.adilet.zan.kz (accessed 17 Oct 2026)
- Standards role only: the Institute's own site says it develops and introduces national standards and takes part in accreditation of laboratories and certification bodies as part of its wider work. National standards carry the ST RK prefix, as in ST RK ISO/IEC 27002-2023, which the unified information security requirements cite — old.adilet.zan.kz; ksm.kz (accessed 17 Oct 2026)
- National Accreditation Centre (NCA) — nca.kz (accessed 17 Oct 2026)
- Public procurement under the Law of the Republic of Kazakhstan No. 106-VIII of 1 July 2024 "On Public Procurement" — old.adilet.zan.kz (accessed 17 Oct 2026)
- Astana International Financial Centre (AIFC), Astana — aifc.kz (accessed 17 Oct 2026)
- Special economic zone Seaport Aktau, Aktau — primeminister.kz (accessed 17 Oct 2026)
- Special economic zone Khorgos – Eastern Gate — primeminister.kz (accessed 17 Oct 2026)
- Special economic zone Ontustik — primeminister.kz (accessed 17 Oct 2026)
- Special economic zone Qyzyljar — primeminister.kz (accessed 17 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice