The Rules for collection and processing of personal data have been approved

By the Order of the Minister of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan the Rules for the collection and processing of personal data of 21.10.2020 No. 395/NK (hereinafter – the “Rules”) were approved. The Rules became effective on 08.11.2020.

The Rules regulate the relationships arising between owners, operators, data subjects, and also third parties in the process of collection and processing of personal data.

The Rules establish that the collection and processing of personal data by the owner and (or) operator of personal data shall be allowed to the extent specified by the list of personal data necessary and sufficient to perform the corresponding tasks. According to the Rules, the data subject or his/her legal representative may be entitled to apply to the authorized body in order to check on the owner and (or) operator, as well as a third party for compliance with the requirements for the collection and processing of personal data.

Consent or withdrawal to the collection, processing of personal data may be provided by the data subject:

• in writing;
• in the form of an electronic document;
• through a personal data security service;
• through the user’s account on the “electronic government” web portal;
• through the data subject’s cellular subscriber number registered on the “electronic government” web portal;
• otherwise, using elements of protective measures that do not contradict the legislation of Kazakhstan.

It worth noting, that the storage of personal data shall be carried out by the owner and/or operator and also by a third party in the database located on the territory of Kazakhstan. At the same time, the storage period for personal data shall be determined by the date of achievement of the goals of their collection and processing, unless otherwise stipulated by legislative acts of the Republic of Kazakhstan.

According to the Rules, the data subject may be entitled to demand from the owner and/or operator to change and supplement his/her personal data based on confirming documents.

In accordance with the Rules, personal data shall be pseudonymised in order to conduct statistical, sociological, scientific and marketing researches. The procedure of pseudonymisation shall exclude the possibility of reverse recovery of the original personal data. Reimbursement of the expenses incurred by the owner and/or operator or a third party in the process of the pseudonymisation shall be carried out at the expense of the person initiating this request, unless otherwise is determined by an agreement with the owner and/or operator or a third party.