LexLint.ioBeta

Know the law your code answers to.

Law / Kazakhstan

Digital Code, rights to deletion, anonymization and restriction of personal data

Digital Code No. 255-VIII (), Arts. 37(4)-(6), 41

In force since .

A data subject rights rule binding public and private bodies.

Audit expectation
none

What it requires

  • An app that holds or processes the personal data of individuals in Kazakhstan must, when a data subject demands it, delete, anonymize or restrict the processing of that data, as the personal data legislation provides, unless a listed ground such as protecting the life, health or rights of third persons, a legal proceeding or a public interest set by law requires keeping it. A data subject also has the right of access to the data, control over it, and information on the purposes, legal bases and methods of its processing.

These lines are LexLint's reading of the law's text.

Who enforces it

Settledness

As of

What it makes you log

Logging duty

Articles 37 and 41 give a data subject rights over personal data and oblige the owner of a digital object or other processor to meet a deletion, anonymization or restriction demand. They state no duty to create, keep or produce a log or record.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 41(1) of the Digital Code lets a person whose personal data is placed or processed in the digital environment require its deletion, anonymization or restriction of processing, whatever the basis on which it was obtained, except in cases the laws of Kazakhstan provide. Article 41(2) obliges the owner of a digital object, or another person who processes personal data, to meet that demand in the manner the personal data legislation sets.

Article 37(4) adds that a data subject has the right to access, control, delete and restrict the processing of the digital data and to receive information on the purposes, legal bases and methods of processing. Article 41(4) lists the grounds on which a demand need not be met, among them protection of the life, health, rights and legitimate interests of third persons. The Code entered into force on , six months after its first official publication on (Art. 106).

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .