KazakhstanLaw on Personal Data and Their Protection, protection duties of owners and operators
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- Take the protection measures Article 22 of Kazakhstan's Law on Personal Data and Their Protection requires of an owner or operator of personal data, including the registration and recording of the actions that a consent states under Article 8(4)(3) to (6), and the timely detection of unauthorized access to the data.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Logging duty
Article 22(1)(5) requires the owner and operator to ensure the registration and recording of the actions under Article 8(4)(3) to (6): the term of the consent, transfer to third parties, cross-border transfer and dissemination in publicly available sources. The clause names no fields of the record, no retention period and no person to whom the record goes, so none is coded. Article 22(1)(2), the timely detection of unauthorized access, is a protection measure and states no record. Article 22(1)(4) gives the state technical service access to audit the security of the processes that hold restricted-access personal data; that is an audit of processes and not a reading of the record, so no access to the record is coded. Neither Article 22 nor the Article 3 scope clause states a territorial test, so the hook is empty.
- Kind
- Explicit
- As of
- Provision
- Law No. 94-V, Art. 22(1)(5)
- Trigger
- personal_data_processing
What this law does
Article 22(1) requires the owner and operator, and any third party, to implement the measures the law and the competent authority's procedure require to protect personal data, ensuring the prevention of unauthorized access and the timely detection of unauthorized access that could not be prevented. Article 22(1)(5) adds the registration and recording of the actions under Article 8(4)(3) to (6).
Those are the particulars that a consent must state: its term or period, whether the owner or operator may transfer the data to third parties, whether the data crosses borders, and whether the owner or operator may disseminate it in publicly available sources.
Article 22(1)(4) also has the owner and operator grant the state technical service access to digital objects that hold restricted-access personal data, so that it can audit the security of the processes for storing, processing and disseminating that data. The protection obligations arise when the personal data is collected and remain in force until it is destroyed, deleted, anonymised or depersonalised.
Article 22 has been amended by Law No. 399-VI of , Law No. 96-VII of , Law No. 223-VII of , Law No. 256-VIII of and Law No. 326-VIII of , and its footnote does not say which of them added sub-paragraph (5).
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings or processes biometric data.