Form, content and withdrawal of consent; state and non-state access control services.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
Consent is given in writing, through a state or non-state service, or in another way that allows its receipt to be confirmed. It must state who processes the data, the person's full name, the term of consent, whether data may be passed to third parties or abroad, whether they will be published, and the list of data collected. If data come from state systems, consent is given only through the state service.
More in the note «Consent to the collection and processing of personal data»
A person may withdraw consent at any time simply by notifying the company. The company then has 15 working days to stop processing or give a reasoned refusal — for example, if the law requires the data to be kept. Consent cannot be withdrawn if that would contradict the law or an obligation is still outstanding (say, an unpaid loan).
More in the note «Consent to the collection and processing of personal data»
When a company obtains data from state bodies' information systems. The person then confirms consent through the state service — by SMS from number 1414 or via e-government — and the company's system must be integrated with that service. Certain state functions are exempt.
More in the note «Consent to the collection and processing of personal data»
The law does not say whether a tick box or a button is enough — it requires that receipt of consent can be confirmed, and the company bears the burden of proof. In practice that means a consent text with all mandatory details, a separate tick the person sets themselves, and a stored record of who agreed, when and to which version of the text.
More in the note «Consent to the collection and processing of personal data»
Note
Three layers of rules on automated decisions: Article 19-1 of the Personal Data Law (prohibited without consent or a statutory basis, right to object with a response within three working days), Article 43 of the Digital Code (explanation and human review) and the 2025 AI Law (prohibited functions, transparency, training data). Plus the 2026 standard on AI in schools: teachers, not systems, decide on grades.
Note
In Kazakhstan consent is the main ground for processing, not one of many. This note covers the form of consent, its required content, when separate consent is needed, how the state and non-state services work, how consent is withdrawn, and why proving consent is harder than it seems.
Note
What rights data subjects have under the Personal Data Law and the Digital Code, how quickly the operator must respond (from one to fifteen working days), how a request is made and where to complain. A summary table of deadlines and a comparison with the GDPR, noting the absence of data portability and a general right to object.
Note
How the Law distinguishes disclosure to specific persons from publication in public sources, when consent is needed, what the rules on self-published data and the ban on "non-purposive extraction" change, and why Kazakhstan law has no familiar "processor" figure.
Note
A summary table of 20 issues showing where Kazakhstan's personal data rules resemble the GDPR and where they differ fundamentally — legal grounds, localisation, cross-border transfers, deadlines, the responsible person, fines. Plus a list of what a GDPR-compliant company must additionally do for Kazakhstan.
Note
When data may be processed without consent: the closed list of Article 9 and the special rules for published data. What the list lacks compared with the GDPR — contract, legitimate interest, vital interests — and what that means for employers and ordinary businesses.
Note
What the Labour Code says about personal data: a closed list of documents on hiring, a ban on asking for more, the unified system for recording employment contracts. When an employer needs consent and when the law suffices, how to handle applicants' data, how long to keep HR records and why identity documents should not be photocopied.
Note
How personal data law interacts with banking secrecy, microcredit secrecy, credit history rules and AML/CFT in banks, microfinance organisations and credit bureaus. The new 2026 Banking Law, biometric authentication through the National Bank and retention of customer files.
Note
The special regime for personal medical data under the Health Code: medical confidentiality and when it may be lifted, the electronic health passport, who may access patient data and when, and Ministry of Health rules on consent, patient notification and storage in Kazakhstan.
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
Detailed rules on collection and processing: consent for public dissemination, disclosure and cross-border transfer (para 4-5), a three-working-day deadline to answer data subjects (para 16), irreversible de-identification (paras 20–21), blocking and deletion (para 25).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceConsentCross-border transfersData subject rightsDeletion and anonymisationDisclosure to third partiesPurpose, scope and retention
How the state service for consent to access data in state digital objects works: requests answered via the 1414 SMS gateway or e-government, withdrawal, a list of who holds consent, and notifications of actions with the data (para 3).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial