Principles of personal data processing

In short

The purpose of the Law is to protect human and civil rights and freedoms in the collection and processing of personal data (Art. 2). Article 5 names five principles: respect for constitutional rights and freedoms, lawfulness, confidentiality of restricted-access data, equal rights of data subjects, owners and operators, and ensuring the security of the individual, society and the state (Art. 5). The working rules that the GDPR calls principles are written in Kazakhstan as separate requirements in Arts 7, 12–14, 20 and 25 and in secondary acts.

The principles in Article 5

“Collection, processing and protection of personal data are carried out in accordance with the principles of: 1) respect for constitutional human and civil rights and freedoms; 2) lawfulness; 3) confidentiality of restricted-access personal data; 4) equal rights of data subjects, owners and operators; 5) ensuring the security of the individual, society and the state.” — Law No. 94-V, Art. 5 (unofficial translation)

Interpretation. Two principles are unusual for a European reader. “Equal rights of data subjects, owners and operators” puts the individual and the company on the same level, although the point of data protection law is to protect the weaker party. “Security of the individual, society and the state” brings the public interest directly into the principles of processing. In practice neither is used much as a stand-alone rule, but both can serve as arguments for limiting data subjects’ rights.

Where to find the “European” principles

GDPR principle	Kazakhstan rule
Lawfulness	Principle of lawfulness (Art. 5(2)); processing with consent, except in Art. 9 cases (Art. 7(1))
Purpose limitation	Processing is limited to “specific, predetermined and lawful purposes” (Art. 7(8)); use only for previously stated purposes (Art. 14); purposes in the data inventory must be “unambiguous, lawful” (Data Inventory Rules, para 4)
Data minimisation	Excessive data are not processed (Art. 7(9)); only data “necessary and sufficient” for the tasks are collected (Art. 12(1)); a mandatory data inventory (Art. 25(2)(1))
Storage limitation	The retention period is defined by the date the purposes are achieved (Art. 12(2)); destruction once the purpose is achieved (Art. 25(2)(4))
Accuracy	Correction and supplementing at the subject’s request (Art. 13); correction within one working day (Art. 25(2)(8))
Integrity and confidentiality	Principle of confidentiality of restricted-access data (Art. 5(3)); processing only where protection is ensured (Art. 20(2))
Accountability	Processing and protection policy (Art. 25(2)(1-1)); proof of consent (Art. 25(2)(5)); information on procedures at the regulator’s request (Art. 25(2)(3-1))
Transparency	Content of the consent (Art. 8(4)); the right to know about one’s data (Art. 24(1)(1)); transparency of algorithmic decisions (Digital Code, Art. 5(3))

The data inventory as a tool

In Kazakhstan, minimisation and purpose limitation take a practical form — the inventory of personal data necessary and sufficient for the tasks. Every owner and operator must approve one (Art. 25(2)(1)). The procedure is set out in the Data Inventory Rules:

• before collection, analyse the organisation’s tasks for their use of personal data, and repeat the analysis as needed (para 3);
• for each task, state the purposes of processing and the data; leave out excessive data (para 4);
• make the inventory accessible (para 5).

A template is annexed to the Rules: task, purposes, data items, and the documents or rules from which the task follows. Collection and processing are allowed within the scope of this inventory (Collection Rules, para 5).

Interpretation. The inventory resembles the record of processing activities under GDPR Art. 30, but it is organised around the organisation’s tasks rather than processing operations. It is a useful basis for the processing policy and consent wording: if data are not in the inventory, they may not be collected.

Express prohibitions

Alongside the principles, the Law contains specific bans:

• processing to cause material or moral harm or to restrict the subject’s rights and freedoms (Art. 7(8));
• collecting and processing paper copies of identity documents, save for listed exceptions (Art. 7(10));
• “non-purposive extraction” of data from public sources to create or expand databases (Art. 7(11));
• biometric technologies in public places — only to protect the constitutional order, public order, rights, health and morals, unless the subject consents (Art. 7(12)).

Principles of the Digital Code

The Digital Code adds its own principles (Art. 4), including respect for human rights in the digital environment, free circulation of digital data, a balance of private and public interests and technological neutrality. Human rights and freedoms in the digital environment are recognised as the highest value. Relations rest on free, informed and expressed will, and algorithmic decisions must be transparent, non-discriminatory and subject to human control (Art. 5).

Interpretation. The Code’s “free circulation of digital data” and the closed, consent-based regime of the Personal Data Law pull in different directions. The Code itself says personal data are processed with consent or under a law (Art. 37(3)), so for personal data the special statute appears to prevail.

Comparison with the GDPR

In the GDPR all seven principles sit in one article and apply directly (Art. 5); breaching them attracts the highest fines. In Kazakhstan the Article 5 principles are rather declaratory, and the real weight lies in specific duties — the data inventory, deadlines, consent, security measures. For a compliance check, it is more practical to follow the table above than Article 5.

Open questions

Open question: “equal rights”. How does the principle of equal rights of data subjects, owners and operators fit with the new Article 21 of the Constitution, which guarantees data protection specifically to the individual?

Open question: inventory and consent. Must the data inventory match the list of data in the subject’s consent (Art. 8(4)(7)), and what if they differ?

Open question: a new purpose. The Law allows use only for previously stated purposes (Art. 14) and dissemination beyond them only with consent (Art. 15(2)). There is no “compatible purpose” test as in the GDPR. Is new consent needed for any change of purpose?

Still to research

• Regulator and court practice applying the Article 5 principles as a stand-alone ground.
• Requirements on the form and publication of the processing policy.
• How the Digital Code’s principles will apply to automated processing and AI.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.