On approval of the Rules for Third-party Access to Digital Information through the Digital Document Service with mandatory protection of personal data
Order of the Acting Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan dated June 25, 2026 No. 352/NK. Registered with the Ministry of Justice of the Republic of Kazakhstan on June 26, 2026 No. 39096
In accordance with paragraph 4 of Article 64 of the Digital Code of the Republic of Kazakhstan, I ORDER:
1. To approve the attached Rules for Third-party Access to Digital Information through the digital document service with mandatory protection of personal data.
2. The Public Services Committee of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, in accordance with the established legislative procedure, shall ensure:
1) the state registration of this order in the Ministry of Justice of the Republic of Kazakhstan;
2) posting of this order on the Internet resource of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan, after its official publication;
3) within ten working days after the state registration of this order with the Ministry of Justice of the Republic of Kazakhstan, submit to the Legal Department of the Ministry of Artificial Intelligence and Digital Development of the Republic of Kazakhstan information on the implementation of measures provided for in subparagraphs 1) and 2) of this paragraph.
3. Control over the execution of this order is entrusted to the supervising Vice Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan.
4. This order will enter into force on July 12, 2026 and is subject to official publication.
Acting Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan
D. Musaliev
Approved by the Order of the Acting Minister of Artificial Intelligence and Digital Development of the Republic of Kazakhstan on June 25, 2026 No. 352/NK
Rules for third-party access to digital information through a digital document service with mandatory protection of personal data
Chapter 1. General provisions
1. These Rules for Third–party Access to Digital Information through a digital document service with Mandatory Personal Data Protection (hereinafter referred to as the Rules) have been developed in accordance with paragraph 4 of Article 64 of the Digital Code and define the procedure for third-party access to digital information through a digital document service with mandatory personal data protection.
2. The following basic concepts are used in these Rules:
1) one–time password - a password valid only for one session of authentication of subjects receiving services in electronic form.;
2) collection of personal data – actions aimed at obtaining personal data;
3) personal data processing – actions aimed at accumulation, storage, modification, addition, use, dissemination, depersonalization, blocking and destruction of personal data;
4) the subject of personal data (hereinafter referred to as the subject) is an individual to whom personal data relate;
5) A short code is a six–digit code generated by a digital document service to provide access to a digital document.;
6) third party – a person who is not a subject, owner and (or) operator, but is related to them (him) by circumstances or legal relations related to the collection, processing and protection of personal data;
7) a digital document is an intangible digital representation of reliable information generated in a digital environment based on data contained in national registers at the time of request or presentation;
8) digital document service – an object of the digital infrastructure of the "digital government", assigned to the operator and designed to display and use documents in digital form, generated on the basis of information from digital objects;
9) digital information – data contained in national registers and other state digital resources used to verify facts, rights and obligations without issuing a separate document;
10) a digital object is a separate element of the digital environment created, used or transmitted through digital technologies, possessing unique digital characteristics and allowing subjects of the digital environment to exercise ownership, use or disposal powers to the extent established by the legislation of the Republic of Kazakhstan.;
11) the digital government mobile application (hereinafter referred to as the mobile application) is a software product installed and launched on a cellular subscriber device and providing access to government services and services provided in electronic form via cellular communications and the Internet;
12) the digital government operator (hereinafter referred to as the operator) is a legal entity designated by the Government of the Republic of Kazakhstan that ensures the functioning of digital government facilities;
13) QR code is a type of matrix barcodes or two-dimensional barcodes.
Chapter 2. Procedure for third parties' access to digital information through a digital document service with mandatory protection of personal data
3. Access to digital information or digital documents is provided when:
1) the subject's consent (revocation) to the collection and processing of personal data containing information specified in paragraph 4 of Article 8 of the Law "On Personal Data and their Protection";
2) integration of a third-party digital object with the mobile application of the "digital government" in accordance with paragraph 3 of Article 83 of the Digital Code of the Republic of Kazakhstan;
3) the application of a set of measures to ensure the protection of personal data in accordance with the legislation of the Republic of Kazakhstan in the field of personal data and their protection.
When third parties gain access to the subject's digital information or digital documents, a short text message is sent to his subscriber number about gaining access to digital information or digital documents.
4. Access to digital information or digital documents of the subject is carried out in cases of initiation of access to digital information by the subject or a third party.
5. To gain access to the subject's digital information or digital documents to a third party, the subject provides a short code or QR code, the relevance of which does not exceed one minute from the moment of generation.
6. A third party enters a short code or reads a QR code through a digital object, generates and sends a request to the digital government mobile application for the provision of digital information or digital documents of the subject.
7. After receiving a request through the digital Government mobile application, the availability and relevance of a short code or QR code, profile, digital information or digital documents of the subject in the digital government mobile application is checked.
8. If the verification result is positive, digital information or digital documents of the subject are sent to a third-party digital facility via the digital government mobile application.
9. If the verification result is negative, a message is generated and sent via the digital government mobile application about the refusal to provide digital information or digital documents of the subject to a digital object of a third party, and digital information or digital documents of the subject are not provided.
10. If it is necessary to obtain access to digital information or digital documents of a subject, a third party forms and sends a request through a digital object to the digital government mobile application for obtaining the subject's consent to provide his digital data or information to a third party.
11. After receiving the request through the digital government mobile application, the login and password of a third party are verified and the subject's profile, digital information or digital documents are available.
12. If the verification result is negative, a message is generated and sent via the digital government mobile application about the refusal to provide digital information or digital documents of the subject to a digital object of a third party, and digital information or digital documents of the subject are not provided.
13. If the verification result is positive, a one-time password is generated and sent via the Digital Government mobile application to the subject's cellular subscriber number registered on the Digital Government web portal, or a short text message containing the one-time password is sent to the subject's personal account on the Digital Government web portal.
14. After receiving a one-time password or text message, the subject provides them to a third party to form a request for the provision of digital information or digital documents to the digital government mobile application.
15. After receiving the request through the digital Government mobile application, the one-time password is checked, as well as the presence of the profile, digital information or digital documents of the subject in the digital government mobile application.
16. If the verification result is positive, digital information or digital documents of the subject are sent to a third-party digital facility via the digital government mobile application.
17. If the verification result is negative, a message is generated and sent to a third-party digital facility via the digital government mobile application about the refusal to provide digital information or digital documents of the subject, but digital information or digital documents of the subject are not provided.
Constitution Law Code Standard Decree Order Decision Resolution Lawyer Almaty Lawyer Legal service Legal advice Civil Criminal Administrative cases Disputes Defense Arbitration Law Company Kazakhstan Law Firm Court Cases Declaration Decree Order Resolution Decision Report Conclusion Statement Conclusion Convention Contract Memorandum Methodology Norms Note Rules Program Charter Charter Article Commentary Resolution Regulations Protocol Draft Program Rules Messages
