New rules for working with personal data in Kazakhstan



A new draft law has been introduced in Kazakhstan that will significantly change the conditions for working with personal data and strengthen data protection. In this brief overview, we cover what you need to know about the expected changes and how they will affect your business.

1. All companies that collect or process personal data will be obliged to notify the authorities on the collection and processing1

Based on these notifications, the unified register of operators will be created. It is expected that the notifications will have to be filed within one year from the date the draft law becomes effective2. Operators will not be able to collect or process personal data only upon a subject’s consent – it will be necessary to notify the authority on the collection and processing.

2. The procedure for obtaining a data subject’s consent for collection and processing is changing

The draft law provides for new conditions under which a consent is considered legitimate. A consent should (1) be given by a clear affirmative action; and (2) be voluntary, definite and unambiguous. A list of information that the consent form must contain is also established.

3. The service for ensuring personal data protection

It is planned to introduce a unified platform (an electronic service) containing citizens’ personal data. Through this service, data subjects can give and revoke their consent for data collection and processing, and operators can notify the authority and gain access to personal data of a subject after receiving the relevant consent. In addition, through the service, data subjects will have an opportunity to file complaints about the actions of operators to the authority.

4. The authority will be able to inspect all organizations that collect or process personal data

The draft law’s planned changes include giving authorization to the Ministry of Digital Development, Innovations and Aerospace Industry for conducting inspections of every company that collects or processes personal data. Such inspections can be started both at the subjects’ request and on the ministry’s own initiative3

The draft law has passed the stage of public discussion and is to be discussed in the Parliament of Kazakhstan. We are monitoring this and will keep you updated on all changes. 


  1. New Article 7-1 to the Law of the Republic of Kazakhstan On Personal Data and its Protection the “Law”) is introduced.
  2. New Article 30-1 to the Law is introduced.
  3. New Article 138.117 to the Entrepreneurial Code of the Republic of Kazakhstan.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Dentons | Attorney Advertising

Written by:


Dentons on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.