In Kazakhstan, the Law¹ on introducing certain changes into the legislation, including the Personal Data Law² will come into effect on March 2, 2022.

We have prepared a series of brief reviews³ of these changes related to personal data (PD) issues. This review addresses the new obligations of companies in respect of PD collection and processing.

Starting from March 2, 2022, companies that collect and process PD (owners, operators and third parties) are obliged to register and record the following information: 

1. The period of validity of the consent for PD collection and processing;
2. Whether the data operator will transfer the PD to a third party(ies);
3. Whether the PD will be transferred cross border;
4. Whether the PD will be disseminated using publicly available sources.

At present, no procedure has been established for registering and recording the above information. We understand that, at least for the time being, companies will be left to establish a procedure themselves.

Additionally, the following obligations for owners and/or operators have been introduced: 

1. To adopt a policy on collection, processing and protection of PD;
2. To provide information—at the request of the authorized body within the procedure of examination of individuals’ and legal entities’ applications—on the ways and procedures used to ensure owners’ and (or) operators’ compliance with the requirements of the Personal Data Law.

Generally speaking, most companies already adhere to the requirements related to preparation and adoption of policies on PD collection, processing and protection. Dentons’ Kazakhstan office already has significant experience developing these policies.

The amendments also affect the terms, by which companies must respond to data subject queries. The current term of three business days for providing data subjects their information or a reasoned refusal will change on March 2, 2022. From this point, companies are obliged to respond within the term set out in the legislation on administrative procedures—i.e. 15 business days from the date of the data subject’s query.

This review has been prepared based on our analysis and changes and additions to the Law and does not constitute legal advice. Should you have any questions, please contact

1. The Law of the Republic of Kazakhstan No. 96-VII “On introducing changes and additions to several legislative acts of the Republic of Kazakhstan on trade activities, stock trading and personal data protection issues” dated December 30, 2021 ↩
2. The Law of the Republic of Kazakhstan “On Personal Data and its Protection” dated May 21, 2013 ↩
3. Dentons - New Requirements of the Personal Data Law: Consent Form ↩