Article 7. Conditions for the collection and processing of personal data and the specifics of the collection and processing of personal data of the Law on Personal Data and Their Protection

Home / Laws / Article 7. Conditions for the collection and processing of personal data and the specifics of the collection and processing of personal data of the Law on Personal Data and Their Protection

1. Personal data is collected and processed by the owner and (or) the operator, as well as by a third party with the consent of the subject or his legal representative in accordance with the procedure determined by the authorized body, except for the cases provided for in paragraph 5 of this Article and Article 9 of this Law.

2. The collection and processing of personal data of a deceased (recognized by a court as missing or declared dead) subject is carried out in accordance with the legislation of the Republic of Kazakhstan.

3. The dissemination of personal data in publicly available sources is permitted with the consent of the subject or his legal representative.

3-1. In the case of the dissemination of personal data in publicly available sources by the subject himself or his legal representative without providing the owner and (or) operator, as well as a third party, with the consent provided for in paragraph 3 of this Article, the obligation to confirm the legality of the subsequent collection, dissemination or other processing of such personal data is assigned to each person who collected, distributed or other processing.

4. The requirements of paragraph 3 of this article do not apply to owners and (or) operators, as well as to third parties, in the event that personal data is disseminated through publicly available sources, the obligation to publish which is established by the laws of the Republic of Kazakhstan.

At the same time, owners and (or) operators, as well as third parties, are obliged to ensure the protection of personal data that is not subject to dissemination in accordance with the legislation of the Republic of Kazakhstan, by masking it when placing information in publicly accessible sources.

Access to personal data disseminated on the basis of the first part of this clause is granted to the subject or their legal representative after the completion of authorization and identification procedures, unless otherwise provided for by the laws of the Republic of Kazakhstan.

5. Subsequent collection, processing, and dissemination of personal data by third parties, published on the basis of clauses 3, 3‑1, and 4 of this article, is permitted, provided that a reference to the source of the information is provided.

6. The processing of personal data in the form of cross‑border transfer of personal data, except in cases provided for in Article 16 of this Law, the dissemination of personal data in publicly accessible sources, as well as their transfer to third parties, is carried out subject to the consent of the data subject.

7. The specifics of collecting and processing personal data in digital resources containing personal data are established in accordance with the digital legislation of the Republic of Kazakhstan, taking into account the provisions of this Law.

8. The collection and processing of personal data must be limited to achieving specific, predetermined, and lawful purposes.

The collection and processing of personal data for the purpose of causing property damage and (or) moral harm, restricting the exercise of the rights, freedoms and legitimate interests of the subject is prohibited.

9. Personal data, the content and volume of which are excessive in relation to the purposes of their processing, are not subject to processing.

10. The collection and processing of copies of identity documents in paper form are prohibited, except in cases where there is no integration with digital objects of government bodies and (or) state legal entities, where it is impossible to identify the subject using technological means, and in other cases provided for by the laws of the Republic of Kazakhstan.

Exceptional cases involving the collection and processing of copies of identity documents on paper, as provided for in the first part of this clause, do not apply to the use and presentation of identity documents generated through the digital document service.

11. The collection and processing of personal data for the creation or expansion of databases and (or) digital objects through the non‑targeted extraction of personal data from publicly available sources are prohibited.

12. The use of technological means for collecting biometric data and identifying individuals, as well as the collected biometric data and identification information, in public places may be carried out solely for the purpose of protecting the constitutional order, maintaining public order, safeguarding human rights and freedoms, and protecting the health and morality of the population, except in cases where the subject’s consent has been obtained.

The Law of the Republic of Kazakhstan dated May 21, 2013 N 94-V.

The article was amended and supplemented by the Law of the Republic of Kazakhstan dated June 24, 2026, No. 326-VIII SAM

This Law regulates public relations in the field of personal data, as well as defines the purpose, principles and legal basis of activities related to the collection, processing and protection of personal data.

President

Republic of Kazakhstan

Constitution Law Code Standard Decree Order Decision Resolution Lawyer Almaty Lawyer Legal service Legal advice Civil Criminal Administrative cases Disputes Defense Arbitration Law Company Kazakhstan Law Firm Court Cases