KazakhstanLaw on Personal Data and Their Protection, biometric data provisions
Law No. 94-V (), Arts. 6, 7(12), 11(3), 12(2)
In force since , effective .
A biometric privacy rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app is not exempt from Kazakhstan's Law on Personal Data merely because biometric data has no dedicated definition in the Act. Collecting biometric data in a public place for identification purposes is restricted to constitutional-order, public-order, rights, health, or morality grounds unless the subject consents, and biometric data stored on Kazakhstani subjects must sit in a database and/or digital storage facility located inside Kazakhstan like any other personal data. Confidentiality of biometric data specifically is deferred to other Kazakh legislation, which the Act does not name and which is not identified here.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Which legislation of the Republic of Kazakhstan sets the confidentiality of biometric data that Article 11(3) says "shall be established by the legislation of the Republic of Kazakhstan"?
- Does "public places" in Article 7(12), where "technological means for collecting biometric data and identifying the subject" may be used only for the listed purposes unless the subject consents, include online services and platforms, or only physical locations?
- Does a facial biometric vector that can no longer be reconstructed to its original values count as an identifier under Article 6, which lists "the data owner's facial biometric vector or its derivatives, which can be reconstructed to their original values"?
What it makes you log
Logging duty
Article 7(12) limits the use of biometric collection in public places to stated purposes unless the subject consents, Article 11(3) defers biometric confidentiality to other legislation, and Article 12(2) requires personal data to be stored in a database or digital storage facility inside Kazakhstan. None of these provisions requires a log or record to be created, kept or produced. The period for which personal data may be kept in Article 12(2) limits the personal data itself, not a record about it. Article 6 lists identifiers and sets no record duty. The cited sections carry no territorial scope clause.
- Kind
- None
- As of
What this law does
The Act has no dedicated special-category article and never defines biometric data as a term; it regulates biometric processing through four scattered clauses instead.
Art. 7(12) restricts collecting biometric data in public places to constitutional-order, public-order, rights, health, or morality purposes unless the subject consents; this clause was reworded by Law No. 96-VII (, in force ), so the currently quoted text has been in effect since that date, not since the Act's 2013 commencement.
Art. 11(3) defers biometric confidentiality entirely to other Kazakh legislation, which it does not name, and carries no amendment footnote of its own, so it has stood unchanged since the base Act's commencement.
Art. 12(2)'s domestic-storage duty applies to biometric data as ordinary personal data; that duty was itself introduced by Law No. 419-V, in force , with no biometric-specific carve-out or heightening found; Law No. 326-VIII of now words it as storage in a database and/or digital storage facility located within the territory of Kazakhstan.
Art. 6, as amended by Law No. 326-VIII, lists the data owner's facial biometric vector or its derivatives, and an image of the face, among the personal data identifiers used to identify a subject. The only biometric modality the Act names is the face, at Article 6.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .