Data subject rights

In short

The main list of data subject rights is in Art. 24 of the Law: to know whether one’s data are held and receive information about them; to demand rectification, blocking, anonymisation, destruction or deletion; to withdraw consent; and to protect one’s rights, including claiming compensation. The operator’s corresponding duties and short deadlines are in Art. 25(2) and the Collection Rules, para 16. The Digital Code adds a general right to deletion, anonymisation and restriction of processing “regardless of the ground on which they were obtained” (Art. 41(1)).

Rights of the data subject

Right	Provision	What it means
To know and receive information	Art. 24(1)(1); Collection Rules, para 15	Confirmation of processing, purposes, sources, methods, list of data, processing and retention periods
To access data free of charge	Art. 25(2)(9)	The operator must allow the subject to see their data at no cost
Rectification and completion	Art. 24(1)(2); Art. 13	Where there are grounds confirmed by documents
Blocking or anonymisation	Art. 24(1)(3)	Where there is information that the conditions of collection and processing were breached
Destruction or deletion	Art. 24(1)(4)	Where data were collected or processed unlawfully, and in other cases
Deletion, anonymisation, restriction	Digital Code, Art. 41	Regardless of the ground for obtaining the data, with exceptions
Withdrawal of consent	Art. 24(1)(5)	See the note “Consent to the collection and processing of personal data”
To give or refuse consent to publication	Art. 24(1)(6)	Dissemination in public sources
To object to automated processing	Art. 19-1(2)	See the note on automated processing
To be informed of a transfer to a third party	Art. 19(1)	Only where such a condition has been agreed (for example, in the consent)
Protection and compensation	Art. 24(1)(7)	For non-pecuniary and pecuniary damage

The Digital Code frames the rights more broadly: access to data, control, deletion, restriction of processing, and information on the purposes, legal grounds and methods of processing (Art. 37(4)). The rights are exercised once the identity of the subject or the authority of their representative is confirmed (Art. 37(5)).

How a request is made

A request is submitted to the owner or operator in writing, as an electronic document “or in another way using elements of protective actions” (Art. 10(2); Collection Rules, para 15). Overseeing the receipt and handling of requests is a duty of the person responsible for organising processing (Art. 25(3)(3)).

Response deadlines

Operator’s action	Deadline	Provision
Rectify or complete data on the basis of documents (or delete them if rectification is impossible)	1 working day	Art. 25(2)(8)
Block data where there is information about a breach	1 working day	Art. 25(2)(8)
Destroy or delete once a breach is confirmed; unblock if it is not confirmed	1 working day	Art. 25(2)(8)
Provide information about the subject’s data or a reasoned refusal	3 working days	Collection Rules, para 16
Consider an objection to automated processing	3 working days	Art. 19-1(3)
Notify of a transfer to a third party (where agreed)	10 working days	Art. 19(1)
Stop processing after withdrawal of consent or give a reasoned refusal	15 working days	Art. 8(7)

Interpretation. One working day is among the shortest deadlines in the world for such requests. In practice it is realistic only if requests feed into a well-established process: an assigned handler, response templates and access to systems. For comparison, the GDPR allows one month.

The right to deletion under the Digital Code

The owner of a digital object must comply with a request for deletion, anonymisation or restriction in the manner established by personal data legislation (Art. 41(2)). Where a mandatory retention period applies, access is restricted and processing suspended instead of deletion (Art. 41(3)). The request is not complied with where the data are needed, in particular, to protect the rights of third parties, to deal with offences, for justice, for a public interest expressly set by law, or for state functions (Art. 41(4); Collection Rules, para 25). More in the note “Deletion, destruction, de-identification and anonymisation”.

Where to complain

• The regulator. The subject may ask the regulator to inspect the operator (Collection Rules, para 24). The regulator considers complaints about whether the content of the data and the processing methods match the purposes, and takes a decision (Art. 27-1(3)). The deadline is 15 working days, extendable to no more than two months (Administrative Procedure Code, Art. 76(1), (3)).
• The courts. Actions of the owner, operator and third party may be challenged, and disputes are resolved, in the manner established by law (Art. 30). Compensation for non-pecuniary and pecuniary damage may be claimed in court (Art. 24(1)(7)).
• Administrative liability. The regulator takes measures to hold violators liable (Art. 27-1(4)). Fines for unlawful collection and processing and for failure to apply protection measures are in Art. 79 of the Code of Administrative Offences.

Comparison with the GDPR

Right	Kazakhstan	GDPR
Access	Information on processing within 3 working days; free access	Copy of data and information on processing (Art. 15)
Rectification	1 working day, on the basis of documents	Without undue delay (Art. 16)
Erasure	Where the law was breached (Art. 24); on request under Digital Code Art. 41	List of grounds and exceptions (Art. 17)
Restriction	Blocking in case of a breach; restriction under Digital Code Art. 41	Art. 18
Portability	None	Art. 20
Objection	Only to automated processing (Art. 19-1)	General right, including to direct marketing (Art. 21)
General response time	1–15 working days depending on the action	One month, extendable by two more (Art. 12(3))
Complaint to the regulator	The regulator, 15 working days	Supervisory authority (Art. 77)

Open questions

Open question: a copy of the data. The Law speaks of the right to “know”, “receive information” and “access”. May the subject obtain a copy of the data themselves, such as an export, rather than only a description of what is processed?

Open question: “elements of protective actions”. Besides a written or electronic document, what counts as an acceptable way to submit a request: an email, an in-app form, a support chat?

Open question: two deletion regimes. How does Art. 24 of the Law (deletion where the law was breached) relate to Digital Code Art. 41 (deletion on request regardless of the ground)? Does the one-day deadline of Art. 25 apply to requests under Art. 41?

Still to research

• Regulator practice on data subjects’ complaints and typical decisions.
• Case law on compensation for non-pecuniary damage for personal data violations.
• How rights are exercised through the state access control service.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.