The Law “On personal data and their protection” was adopted in 2013 in

Kazakhstan. Despite adopting such law, many companies in Kazakhstan still do

not know how to collect, process, store, transfer individuals` personal data.

In this article you

may find answers to the most relevant questions on personal data protection in

Kazakhstan.

What is personal data in Kazakhstan?

In Kazakhstan there are no

limits on how to understand “personal data”. Any information that refers to a

particular person is considered as personal data, according to the Law “On personal data and their protection” [1] (hereinafter – the “Personal Data Protection Act”) [2].

Any information may be

considered as personal data including but not limited to:

1.

Surname, name;

2.

Individual Identification

Number, identity card number;

3.

Date of birth

4.

Citizenship;

5.

Criminal, administrative records;

6.

Education;

7.

Foreign languages skills;

8.

Taste preferences;

9.

Health information;

10.

Property information;

11.

Address of residence; work

address;

12.

Income amount;

13.

Nationality,

religion;

14.

Mobile phone number;

15.

Family status;

16.

Any other personal information

which can identify a person.

Which laws in Kazakhstan regulate personal data usage?

In Kazakhstan, the protection

of personal data is regulated by following laws:

1

Law of the Republic of Kazakhstan on Personal data and

their protection [3] (hereinafter - the “Personal Data Protection Act”);

2

Rules of personal data protection [4]

and Rules for determining the personal data list [5]

(hereinafter - the “Rules”).

What should companies do to comply with Personal Data

Protection Act?

Companies shall take certain

measures before using personal data of individuals.

Such measures are described in

the Personal Data Protection Act and

in the Rules mentioned above.

One of such measures is to

obtain an individual`s consent on collecting,

processing, storing his personal data. Such consent may be made in written or in

electronic form.

Once the Company has obtained

such consent, the Company shall take all measures to protect the individual’s

personal data.

Are there any restrictions on the storage of personal

data?

According to Article 12.2 of

the Personal Data Protection Act,

personal data that originates from Kazakhstan must be stored in Kazakhstan database.

Thus, companies should store

personal data in Kazakhstan database, if such personal data is originated in

Kazakhstan.  However various

international companies store such personal data on abroad servers in order to

save resources.

If the Company does not comply

with the requirements of Personal Data

Protection Act and Rules, the

Company or its officials may bear civil, criminal, administrative liability.

Which authority regulates personal data protection in

Kazakhstan?

In Kazakhstan as of today there

is no specialized authority that regulates personal data protection.

However, the Kazakhstan Prosecutor's

Office is the most competent authority, which inspects companies’ compliance

with Personal Data Protection Act.

What liability is provided in Kazakhstan for violation

of Personal Data Protection Act?

In Kazakhstan, there are administrative, civil and criminal liabilities

for violation of the Personal Data

Protection Act and Rules. Please

see details below.

Administrative and criminal liability

Administrative liability for

violation of personal data protection acts is provided in Article 79 of the Administrative Offences Code of Kazakhstan.

A fine for administrative

violations could be from 140 US dollars to 7000 US dollars. [6]

However, if a damage to

individual from such violation exceeds 600 US dollars, administrative case

could proceed to a criminal case.

In criminal case, the fines could

go up to 35 000 US dollars. Or alternatively to this fine, the responsible

person could be restricted or deprived of liberty for up to 5 years.

Civil liability

Civil liability is directly

related to administrative and criminal liability.

An individual, whose rights

were violated, could proceed with a court claim to recover losses, damages or

harm from that violation.

Companies shall take

all measures to protect individuals’ personal data to avoid such civil,

administrative and criminal liability.

-----

[1] Law of the Republic of Kazakhstan on Personal data and their protection

dated 21 May 2013 № 94-V

[2] Article 1.2 of Personal Data Protection Act

[3] Law of the Republic of Kazakhstan on Personal data and their protection

dated 21 May 2013 № 94-V

[4] Rules of implementation by the owner and (or) the operator and a third

party measures for the personal data protection, approved by the Kazakhstan

government № 909 dated 3 September 2013

[5] Rules for determining by the owner and (or) operator the list of

personal data necessary and sufficient to perform their tasks, approved by the

Kazakhstan government № 1214 dated 12 November 2013

[6] for your convenience, we rounded the numbers

----

By Ms. Anar Kubeyeva, Ms. Symbat Tursyngali

Associates, Synergy Partners Law Firm LLC

SYNERGY PARTNERS

ANSWERS. SOLUTIONS. RESULTS