Article 8. Procedure for giving (revoking) consent of a subject to the collection and processing of personal data of the Law on Personal Data and Their Protection

Home / Laws / Article 8. Procedure for giving (revoking) consent of a subject to the collection and processing of personal data of the Law on Personal Data and Their Protection

1. The subject or their legal representative gives (withdraws) consent to the collection and processing of personal data in writing, via a public service, a non‑public service, or in any other way that allows confirming the receipt of consent.

When collecting and/or processing personal data contained in digital objects of government agencies and/or government legal entities, consent is provided through a public service.

2. A subject or his legal representative may not revoke consent to the collection or processing of personal data in cases where this is contrary to the laws of the Republic of Kazakhstan, or if there is an unfulfilled obligation.

3. Repealed by Law No. 96-VII of the Republic of Kazakhstan dated December 30, 2021 (entered into force sixty calendar days after its first official publication).

4. Consent to the collection and processing of personal data includes:

1) name (surname, first name, patronymic (if it is indicated in the identity document), business identification number (individual identification number) the owner and (or) the operator;

2) last name, first name, patronymic (if it is indicated in the identity document) of the subject;

3) the term or period during which the consent to collect and process personal data is valid;4) information about the possibility (or lack thereof) for the owner and/or operator to transfer personal data to third parties;5) information about the presence or absence of cross‑border transfer of personal data in the process of their processing;6) information about the possibility (or lack thereof) for the owner and/or operator, as well as a third party, to disseminate personal data in publicly accessible sources.

7) the list of collected data related to the subject;

8) other information determined by the owner and (or) the operator.

5. The period of validity of the consent to the processing of personal data may not exceed the period necessary to achieve the purposes of collecting and processing personal data, unless otherwise established by the laws of the Republic of Kazakhstan or the contract.

6. If the period of validity of the consent to the collection and processing of personal data is not specified, it is considered valid until the purposes of processing defined when it was provided are achieved.

7. The subject or his legal representative has the right to revoke consent to the collection and processing of personal data by notifying the owner and/or operator, as well as a third party. Within fifteen working days, the owner and (or) the operator, as well as a third party, are obliged to stop processing personal data if their storage or processing is not required in accordance with the legislation of the Republic of Kazakhstan, or to provide a reasoned refusal.al.

The Law of the Republic of Kazakhstan dated May 21, 2013 N 94-V.

The article was amended and supplemented by the Law of the Republic of Kazakhstan dated June 24, 2026, No. 326-VIII SAM

This Law regulates public relations in the field of personal data, as well as defines the purpose, principles and legal basis of activities related to the collection, processing and protection of personal data.

President

Republic of Kazakhstan

Constitution Law Code Standard Decree Order Decision Resolution Lawyer Almaty Lawyer Legal service Legal advice Civil Criminal Administrative cases Disputes Defense Arbitration Law Company Kazakhstan Law Firm Court Cases