Changes in Kazakhstan legislation related to personal data protection

CHANGES IN KAZAKHSTAN LEGISLATION RELATED TO PERSONAL DATA PROTECTION

In Kazakhstan new adjustments have been made in Data Protection Act and other regulations. New amendments in Kazakhstan data protection legislation must apply from July 5, 2020. Our lawyers prepared brief outlook what are those changes and what business should do.

Prohibition for collecting, processing and storing excessive information

New amendments prohibit collecting, storing and processing personal data in excessive approach. This means that business companies could collect only those personal data that:

1) are corresponds to business needs;

2) are corresponds to precise aims.

For instance, before amendments companies could store all information related to personal data. Now with new changes any irrelevant information or excessive should be removed and terminated from storage.

Trends for discloser individuals rights for personal data

We could note the tendency more companies prefer to indicate all rights individual have in terms of personal data. We suppose this corresponds to main principles of data protection. Another reasons that any provisions related to personal data information should be clear and understandable to any person. The more provisions are clear the better for a company in any dispute in the future.

Data protection officer

The controller or possessor must designate a data protection officer. At present time there is no any requirement for officer’s expert knowledge or degree in data protection or any other detailed regulations for this position.

Depersonalization of personal data

New requirements oblige companies to remove and terminate all information related to personal data if a company conducted marketing research, statistics, science, marketing research or analysis.

This legal insight was prepared by Synergy Partners lawyers Nurzhan Stamkulov and Aidana Satimova.