A new draft law has been introduced in Kazakhstan that will significantly change the conditions for working with personal data and strengthen data protection. In this brief overview, we cover what you need to know about the expected changes and how they will affect your business.

1. All companies that collect or process personal data will be obliged to notify the authorities on the collection and processing¹

Based on these notifications, the unified register of operators will be created. It is expected that the notifications will have to be filed within one year from the date the draft law becomes effective². Operators will not be able to collect or process personal data only upon a subject’s consent – it will be necessary to notify the authority on the collection and processing.

2. The procedure for obtaining a data subject’s consent for collection and processing is changing

The draft law provides for new conditions under which a consent is considered legitimate. A consent should (1) be given by a clear affirmative action; and (2) be voluntary, definite and unambiguous. A list of information that the consent form must contain is also established.

3. The service for ensuring personal data protection

It is planned to introduce a unified platform (an electronic service) containing citizens’ personal data. Through this service, data subjects can give and revoke their consent for data collection and processing, and operators can notify the authority and gain access to personal data of a subject after receiving the relevant consent. In addition, through the service, data subjects will have an opportunity to file complaints about the actions of operators to the authority.

4. The authority will be able to inspect all organizations that collect or process personal data

The draft law’s planned changes include giving authorization to the Ministry of Digital Development, Innovations and Aerospace Industry for conducting inspections of every company that collects or processes personal data. Such inspections can be started both at the subjects’ request and on the ministry’s own initiative³. 

The draft law has passed the stage of public discussion and is to be discussed in the Parliament of Kazakhstan. We are monitoring this and will keep you updated on all changes. If you have any questions about this alert, please contact us.

1. New Article 7-1 to the Law of the Republic of Kazakhstan On Personal Data and its Protection the “Law”) is introduced.
2. New Article 30-1 to the Law is introduced.
3. New Article 138.117 to the Entrepreneurial Code of the Republic of Kazakhstan.