Guest Wi-Fi in Kazakhstan: a compliance guide for international companies

If your company runs a hotel, restaurant, store, coworking space or office in Kazakhstan and offers Wi-Fi to visitors, local rules apply that most global guest Wi-Fi products were not built for. Every user must be identified before going online, the rules name only two identification methods, and guests' personal data must be stored in Kazakhstan. This guide sums up what that means in practice.

The short version

• Any place that gives visitors internet access is a "public internet access point", and access there is granted only after the user is authorized (Communication Services Rules, clause 108)
• Since 12 July 2026 two methods are allowed: a one-time password sent by SMS to the user's phone number, or sign-in through Kazakhstan's eGov portal with a digital signature (clauses 110–112)
• An open network, a password on a sign, a click-to-accept splash page or social login do not meet the requirement on their own
• Guest phone numbers are personal data; under Article 12(2) of the Law on Personal Data and Their Protection the database holding them must be located in Kazakhstan
• The duty sits with the venue — the owner of the access point — not with the ISP that brought the line into the building

Who this applies to

Cafes and restaurants, hotels and guesthouses, malls and stores, business centres, coworking spaces, waiting areas, event venues. That includes international chains, franchises and foreign-owned local entities. The rules speak of places where users are given internet access, paid or free. A closed corporate network for your own staff usually falls outside that definition, while a guest network in the same office usually falls inside it. Borderline cases are worth discussing with local counsel.

Why a global captive portal may not fit as-is

Many international guest Wi-Fi platforms — the splash page your group already uses in other countries — let people in by email, social account or an accept button. In Kazakhstan that raises two issues.

1. Sign-in method. You need a one-time SMS code to the phone number, or eGov with a digital signature. Email and social login are not named in the rules
2. Where the data lives. If the platform stores guest data in a US or EU cloud, that conflicts with the requirement to keep the database in Kazakhstan. Cross-border transfer is governed separately, by Article 16 of the same law

Before rolling out the group standard, put both questions to your vendor. Often the practical answer is a local authorization layer in front of the same hardware: the access points stay, only the login page and the data location change.

Foreign guests and phone numbers

The rules refer to a subscriber number belonging to the user and do not restrict it to Kazakh numbers. So for tourists and business travellers the practical route is SMS to a foreign number. Check two things: whether your SMS gateway delivers internationally, and what it costs. eGov sign-in with a digital signature is only available to people who hold a Kazakh digital signature — mostly residents, not tourists.

Where there is no mobile coverage at all, clause 115 of the rules allows access against an identity document with an electronic log of the user's name and session start and end times.

What about fines?

The "up to 100 MCI" figure often quoted online comes from subclause 9-1 of Article 637 of the Administrative Offences Code, which was repealed in 2017. Liability for breaches of communications law under Article 637 does exist, but the classification and amount depend on the situation — a question for local counsel, covered on the law page. In practice, a request for connection data — for example after an incident committed through your network — is more common than an inspection. You need to be able to export the log quickly when it comes.

Rollout checklist

1. List every network guests can join: lobby, meeting rooms, conference halls, shared SSIDs
2. Put a captive portal with SMS-code sign-in on every guest network
3. Confirm that SMS reaches foreign numbers and find out the price
4. Confirm that guest data is stored in Kazakhstan
5. Turn on a session log exportable for any period — see log retention
6. Separate the guest network from the corporate one — see guest network isolation
7. Show a consent text for personal data processing on the login page
8. Name a local contact who can answer a written request

Where TheLink fits

TheLink.kz is a Kazakhstan-based guest Wi-Fi authorization platform. It runs on top of your existing hardware (MikroTik, Keenetic, TP-Link Omada, UniFi, plus Cisco and Aruba via RADIUS) and handles SMS-code sign-in, the session log and a branded login page. Its servers and guest data are located in Kazakhstan, so the Article 12 storage requirement is met without extra setup. How to choose a vendor in general is covered in the article on choosing an authorization provider. You can reach us through the contacts page.

This material is for reference and is not legal advice. Check the current wording of the acts on adilet.zan.kz.