Duty LXD-1346
Processes biometric data, in Kazakhstan
Law on Personal Data and Their Protection, localization and cross-border transfersince 1 line
Law No. 94-V (), Arts. 12(2), 16 · Read the law's page
- An app storing or processing the personal data of individuals in Kazakhstan, including a voiceprint or other biometric identifier, must keep it in a database and/or digital storage facility located within Kazakhstan; Kazakhstani law does not on its own text forbid an additional copy abroad. Transferring that data to another country requires that the destination state ensure equivalent protection, or one of four fallback grounds: the subject's consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained.
Law on Personal Data and Their Protection, biometric data provisionssince 1 line
Law No. 94-V (), Arts. 6, 7(12), 11(3), 12(2) · Read the law's page
- An app is not exempt from Kazakhstan's Law on Personal Data merely because biometric data has no dedicated definition in the Act. Collecting biometric data in a public place for identification purposes is restricted to constitutional-order, public-order, rights, health, or morality grounds unless the subject consents, and biometric data stored on Kazakhstani subjects must sit in a database and/or digital storage facility located inside Kazakhstan like any other personal data. Confidentiality of biometric data specifically is deferred to other Kazakh legislation, which the Act does not name and which is not identified here.
Law on Artificial Intelligence, prohibited practicessince 6 lines
Law No. 230-VIII (), Art. 17(3) · Read the law's page
- Do not build or operate an AI system that uses subconscious or manipulative methods to distort a person's behaviour or coerce a harmful decision.
- Do not build or operate an AI system that exploits a person's age, disability, social position or other vulnerability to cause or threaten harm.
- Do not evaluate or classify people over time by their social behaviour or predicted personal traits, unless a Kazakhstani law provides for it.
- Do not classify people by biometric data to infer race, political views, religion or similar traits for the purpose of discrimination.
- Do not determine a person's emotions without their consent, unless a Kazakhstani law provides for it.
- Do not create or distribute an AI-generated output that Kazakhstani law bans.
Digital Code, general cybersecurity duty on digital-object owners and holderssince 3 lines
Digital Code No. 255-VIII (), Arts. 20, 97-98 · Read the law's page
- Protect the confidentiality, integrity and availability of every digital object you own or hold in Kazakhstan, a category that expressly includes software you make available to others.
- Implement technical measures, including cryptographic protection where applicable, together with organizational and legal measures, aimed at preventing, detecting and eliminating cyber threats to that digital object.
- Also follow the specific requirements set by the Law of the Republic of Kazakhstan "On Cybersecurity" and the unified digitalization and cybersecurity requirements adopted under it; their own specific duties are not further detailed here.