To the attention of users!
For the convenience of using the RCPI, a TABLE of CONTENTS has been created
This Law regulates public relations in the field of personal data, and also defines the purpose, principles and legal bases of activities related to the collection, processing and protection of personal data.
Chapter 1. GENERAL PROVISIONS
Article 1. Basic concepts used in this Law
The following basic concepts are used in this Law:
1) biometric data – personal data that characterize the physiological and biological characteristics of the subject of personal data, on the basis of which it is possible to establish his identity;
2) personal data – information related to a certain or determined on their basis subject of personal data, recorded on electronic, paper and (or) other material media;
2-1) the state service for access control to personal data (hereinafter referred to as the state service) is a service that provides information interaction of owners and (or) operators, third parties with the subject of personal data and the authorized body when accessing personal data contained in the objects of informatization of state bodies and (or) state legal entities, including receiving from the subject of personal data consent to the collection, processing of personal data or their transfer to third parties;
2-2) non–state service for access control to personal data (hereinafter – non-state service) - a service that provides information interaction of owners and (or) operators, third parties with the subject of personal data when accessing personal data contained in non-state informatization facilities, including obtaining consent from the subject of personal data to collect, process personal data or their transfer to third parties;
3) blocking of personal data – actions to temporarily stop the collection, accumulation, modification, addition, use, dissemination, depersonalization and destruction of personal data;
4) accumulation of personal data – actions to systematize personal data by entering them into a database containing personal data;
5) collection of personal data – actions aimed at obtaining personal data;
6) destruction of personal data – actions as a result of which it is impossible to restore personal data;
7) depersonalization of personal data – actions, as a result of which it is impossible to determine the identity of personal data to the subject of personal data;
8) a database containing personal data (hereinafter referred to as the database) is a set of ordered personal data;
9) the owner of a database containing personal data (hereinafter referred to as the owner) is a state body, an individual and (or) a legal entity exercising, in accordance with the laws of the Republic of Kazakhstan, the right to own, use and dispose of a database containing personal data;
10) the operator of the database containing personal data (hereinafter referred to as the operator) is a state body, an individual and (or) a legal entity that collects, processes and protects personal data;
11) protection of personal data – a set of measures, including legal, organizational and technical, carried out for the purposes established by this Law;
11-1) authorized body in the field of personal data protection (hereinafter referred to as the authorized body) – the central executive body that provides guidance in the field of personal data protection;
11-2) Excluded by the Law of the Republic of Kazakhstan dated 30.12.2021 No. 96-VII (effective after sixty calendar days after the date of its first official publication).
12) processing of personal data – actions aimed at accumulation, storage, modification, addition, use, distribution, depersonalization, blocking and destruction of personal data;
13) use of personal data – actions with personal data aimed at realizing the goals of the owner, operator and third party;
14) storage of personal data – actions to ensure the integrity, confidentiality and availability of personal data;
15) dissemination of personal data – actions that result in the transfer of personal data, including through the mass media or the provision of access to personal data in any other way;
16) the subject of personal data (hereinafter referred to as the subject) is an individual to whom personal data relate;
17) third party – a person who is not a subject, owner and (or) operator, but is connected with them (him) by circumstances or legal relations for the collection, processing and protection of personal data.
Footnote. Article 1 as amended by the Laws of the Republic of Kazakhstan dated 25.06.2020 No. 347-VI (effective ten calendar days after the date of its first official publication); dated 30.12.2021 No. 96-VII (effective sixty calendar days after the date of its first official publication).
Article 2. Purpose of this Law
The purpose of this Law is to ensure the protection of human and civil rights and freedoms in the collection and processing of his personal data.
Article 3. Operation of this Law
1. This Law regulates relations related to the collection, processing and protection of personal data.
2. The specifics of the collection, processing and protection of personal data may be regulated by other laws and acts of the President of the Republic of Kazakhstan.
3. This Law does not apply to relations arising under:
1) collection, processing and protection of personal data by subjects exclusively for personal and family needs, if the rights of other individuals and (or) legal entities and the requirements of the laws of the Republic of Kazakhstan are not violated;
2) formation, storage and use of documents of the National Archival Fund of the Republic of Kazakhstan and other archival documents containing personal data in accordance with the legislation of the Republic of Kazakhstan on the National Archival Fund and archives;
3) collection, processing and protection of personal data classified as state secrets in accordance with the Law of the Republic of Kazakhstan "On State Secrets";
4) collection, processing and protection of personal data in the course of intelligence, counterintelligence, operational and investigative activities, as well as the implementation of security measures to ensure the safety of protected persons and objects within the limits established by the laws of the Republic of Kazakhstan.
Article 4. Legislation of the Republic of Kazakhstan on personal data and their protection
1. The legislation of the Republic of Kazakhstan on personal data and their protection is based on the Constitution of the Republic of Kazakhstan and consists of this Law and other regulatory legal acts of the Republic of Kazakhstan.
2. If an international treaty ratified by the Republic of Kazakhstan establishes rules other than those contained in this Law, the rules of the international treaty shall apply.
Article 5. Principles of personal data collection, processing and protection
The collection, processing and protection of personal data are carried out in accordance with the principles of:
1) respect for the constitutional rights and freedoms of man and citizen;
2) legality;
3) confidentiality of restricted access personal data;
4) equality of rights of subjects, owners and operators;
5) ensuring the security of the individual, society and the state.
Chapter 2. COLLECTION AND PROCESSING OF PERSONAL DATA
Article 6. Availability of personal data
Personal data on accessibility is divided into public and restricted access.
Publicly available personal data are personal data or information that, in accordance with the laws of the Republic of Kazakhstan, are not subject to confidentiality requirements, access to which is free with the consent of the subject.
Information about the subject, the collection and processing of which was made in violation of the legislation of the Republic of Kazakhstan, is excluded from publicly available sources of personal data within one working day at the request of the subject or his legal representative or by a court decision or other authorized state bodies.
At the same time, the costs arising from the destruction of personal data from publicly available sources of personal data are borne by the owner and (or) the operator, a third party.
The amount of expenses incurred when withdrawing the consent of the subject or his legal representative to the dissemination of his personal data in publicly available sources of personal data related to the destruction of personal data from publicly available sources of personal data, as well as the persons to whom these costs are imposed, if necessary, are determined in court.
Personal data of restricted access is personal data, access to which is restricted by the legislation of the Republic of Kazakhstan.
Footnote. Article 6 - as amended by the Law of the Republic of Kazakhstan dated 25.06.2020 No. 347-VI (effective after ten calendar days after the date of its first official publication); as amended by the Laws of the Republic of Kazakhstan dated 30.12.2021 No. 96-VII (effective after sixty calendar days after the date of its first official publication); from 07/14/2022 No. 141-VII (effective after ten calendar days after the date of its first official publication).
Article 7. Conditions for the collection and processing of personal data and features of the collection and processing of personal data from publicly available sources