Consent to the collection and processing of personal data

In short

Personal data are collected and processed with the consent of the data subject or their legal representative. The exceptions are the cases in Article 9 and further use of published data under Article 7(5) (Art. 7(1)). The Digital Code repeats this rule (Art. 37(3)). Consent is given in writing, through the state or a non-state service, or in another way that allows confirmation that it was obtained (Art. 8(1)). It can be withdrawn at any time. The operator must stop processing within 15 working days unless the law requires processing to continue (Art. 8(7)).

Form of consent

• General rule — in writing, through the state service, a non-state service, or in another way that allows confirmation that consent was obtained (Art. 8(1); Collection Rules, para 6).
• Data in state digital objects — consent only through the state service (Art. 8(1)). An operator that interacts with such objects must integrate its systems with the state service, save for certain Article 9 cases (Art. 8-1(1)). The service handles giving and withdrawing consent, notifying the subject of actions with their data and showing who holds their consent (Art. 8-1(2)). The subject receives the request and responds via the 1414 SMS gateway or e-government (State Service Rules, para 3).
• Non-state service — optional for the operator where there is no interaction with state objects. It is used to give consent and to receive notifications of actions with the data and of third-party access (Art. 8-2).

The Digital Code adds a general standard: relations in the digital environment rest on “the free, informed and expressed will of the person” (Art. 5(2)).

What the consent must contain

The Law lists the mandatory content (Art. 8(4)):

1. name and BIN (IIN) of the owner and/or operator;
2. full name of the data subject;
3. the term or period of the consent;
4. whether the owner or operator may transfer the data to third parties;
5. whether cross-border transfer takes place;
6. whether the data may be disseminated in public sources;
7. the list of data collected;
8. other information at the owner’s or operator’s discretion.

The consent may not last longer than needed to achieve the purposes, unless a law or contract provides otherwise (Art. 8(5)). If no term is stated, the consent is valid until the purposes of processing are achieved (Art. 8(6)).

When specific consent is needed

The Law requires consent — separately or expressly stated in the consent — for:

• dissemination in public sources (Art. 7(3));
• transfer to third parties, cross-border transfer (except in the cases of Article 16) and dissemination in public sources (Art. 7(6); Collection Rules, para 4-5);
• dissemination beyond the stated purposes (Art. 15(2));
• biometric identification in public places, except to protect the constitutional order, public order, rights, health and morals (Art. 7(12)).

Withdrawal of consent

The data subject may withdraw consent to collection, processing, dissemination in public sources, transfer to third parties and cross-border transfer (Art. 24(1)(5)). Notifying the owner, operator or third party is enough. Within 15 working days they must stop processing, unless storage or processing is required by law, or give a reasoned refusal (Art. 8(7); Collection Rules, para 6-3).

Consent cannot be withdrawn where this would contradict the law or where there is an unfulfilled obligation (Art. 8(2)).

Interpretation. The “unfulfilled obligation” exception is broad: an outstanding loan or an incomplete delivery would qualify. It allows processing needed to perform the obligation to continue. But it presumably does not allow using the data for other purposes, such as marketing.

Proof of consent

The owner and operator must provide proof that consent was obtained (Art. 25(2)(5)). Yet the Retention Schedule sets a retention period of 1 year for employees’ consent forms (item 467).

Interpretation. If an employee’s consent form is kept for only a year, there will be nothing to prove consent with by the end of an employment that may last decades. It is more sensible to keep consent for the whole processing period plus the limitation period, treating the one-year term as a minimum.

Comparison with the GDPR

Question	Kazakhstan	GDPR
Role of consent	The main ground; without consent only under Art. 9	One of six grounds (Art. 6(1))
Form	In writing, via a service, or another verifiable way	Any clear form, but the controller must be able to prove consent (Art. 7(1))
Content	Closed list of 8 items (Art. 8(4))	Specific, informed, unambiguous (Art. 4(11))
Withdrawal	Stop processing within 15 working days; exceptions apply	At any time, as easily as given (Art. 7(3))
Freely given	No express ban on bundling consent	Consent must not be a condition of a contract unless necessary (Art. 7(4))
Children	Through the legal representative; no age set	For online services from 16; Member States may lower to 13 (Art. 8)

Interpretation. Since Kazakhstan has almost no other grounds, consent is collected for nearly everything, including performance of contracts. Under the GDPR that approach would be considered a mistake; in Kazakhstan it is often the only option.

Open questions

Open question: freely given consent of employees. Employees depend on their employer. Is their consent free, and what happens if an employee refuses? The Labour Code provides no separate ground for processing employee data.

Open question: age. From what age can a child give consent alone, for example in an online service? The Law speaks only of the legal representative.

Open question: “another way that allows confirmation”. Is a tick box on a website or a button in an app enough? The Law does not say, and the burden of proof lies with the operator.

Still to research

• Rules on the operation of non-state services and requirements for them.
• Regulator guidance on the form of electronic consent.
• Inspection practice under item 1 of the inspection checklist (collection and processing with consent).

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.