Kazakh law requires to carry out collection and processing of personal data with the consent of a personal data subject or his / her legal representative. Such consent should be given in writing, via the state service, non-state service or other method that allows to confirm the receipt of consent. The consent should be given via the state service when collecting and / or processing personal data contained in the databases of the state bodies and / or state legal entities.

As a general rule, personal data subjects or their representatives may revoke their consent. However, the consent may not be revoked in cases where such revocation contradicts requirements of Kazakh law or there are any unfulfilled obligations.

Consent to the collection and processing of personal data should include:

• full name, business identification number (individual identification number) of the personal data database operator;
• full name of the personal data subject;
• the term and period during which the consent is effective;
• information on whether the operator may transfer the personal data to third parties or not;
• information on whether there is a cross-border transfer of personal date in the process of its processing or not;
• information on dissemination of personal data in public resources;
• list of data being collected on the personal data subject;
• other information as determined by the owner and / or operator.

Kazakh law allows the collection and processing of personal data without the consent of a personal data subject or his / her legal representative in cases explicitly prescribed by Kazakh law. Such cases may include, inter alia:

• implementation of activities of law enforcement bodies and courts;
• implementation of state statistical activities;
• use of depersonalised personal data by the state authorities for statistical purposes;
• implementation of international treaties ratified by Kazakhstan;
• protection of constitutional rights and freedoms of a person, if obtaining the consent of a personal data subject or his / her legal representative is impossible;
• carrying out legal professional activities of a journalist, carrying out tv-channel, radio-channel, news agency, mass media, online media, scientific, literary or other creative activities, subject to compliance with requirements of Kazakh law;
• publication of personal data in accordance with Kazakh law, including personal data of candidates for elective public offices;
• failure by a personal data subject to fulfil its obligation to provide personal data in accordance with Kazakh law;
• receipt by the state authority regulating, controlling and supervising financial market and financial organisations of information from individuals and legal entities in accordance with Kazakh law;
• receipt by the state revenue authorities of information from individuals and legal entities for purposes of tax administering and control;
• storage of a backup copy of electronic information resources containing limited access personal data to a national backupplatform for storing electronic information resources in cases provided for by Kazakh law;
• the use of personal data of entrepreneurs related directly to their business activities to form a register of business partners, subject to compliance with the requirements of Kazakh law;
• the use of personal data of a Kazakhstani national for the purposes of bankruptcy procedure.

Under the Law, processing of personal data should be limited to the achievement of specific, predetermined and legitimate goals. Processing of personal data that is incompatible with the purposes of collecting personal data is not allowed. Personal data, the content and volume of which is excessive in relation to the purposes of its processing, should not be processed.

Under Kazakh law, access to personal data is determined by the terms of consent for collection and processing of personal data, unless otherwise provided by Kazakh law. A person should be denied access to personal data if he / she refuses to assume obligations to ensure compliance with the requirements of the Law or may not ensure it.

Persons having access to limited access personal data should ensure its confidentiality.

Under Kazakh law, accumulation of personal data is carried out by collecting personal data that is necessary and sufficient to fulfil the tasks performed by an owner and / or an operator of a database containing personal data and by a third-party having access to such database.

Personal data should be stored in databases located in Kazakhstan.

The period for retention of personal data is determined by the date of fulfilment of the purpose(s) for collection and processing of the personal data, unless otherwise provided by Kazakh law.

Kazakh law provides for additional requirements in respect of electronic resources containing personal data and integration between personal data databases of private entities and the personal data databases of state bodies and state legal entities via the state service.