Types of personal data

In short

By accessibility, personal data are either publicly available or restricted-access (Art. 6). Publicly available data are those to which laws do not apply confidentiality requirements and access to which is free with the subject’s consent. Restricted-access data are those “access to which is restricted by legislation”. There is no closed list of the second group, so whether particular information is restricted-access has to be worked out from other laws. The answer determines security measures, the place of processing and even the operator’s category.

Publicly available data

“Publicly available personal data are personal data or information to which, under the laws of the Republic of Kazakhstan, confidentiality requirements do not apply and access to which is free with the consent of the subject.” — Law No. 94-V, Art. 6 (unofficial translation)

What matters:

• public availability arises with the subject’s consent: publication in public sources generally requires consent (Art. 7(3));
• data collected unlawfully are removed from public sources within one working day at the request of the subject, a court or an authorised body (Art. 6);
• if the subject published the data themselves, each subsequent processor must prove that its processing is lawful (Art. 7(3-1)).

More on dissemination in the note “Disclosure of personal data to third parties and publication”.

Restricted-access data

The Law does not list such data; it refers to legislation. Other laws provide several reference points:

Source	What it says	How it works
Fingerprint and Genomic Registration Law, Art. 8	Fingerprint and genomic information is restricted-access personal data	Express rule
Health Code, Art. 273	Personal medical data, the fact of seeking care, health status and diagnosis constitute medical secrecy	Through a protected secret
Access to Information Law, Art. 1	Restricted-access information covers state secrets, personal, family, banking and commercial secrets, medical secrecy and other protected secrets, restricted-access personal data, and restricted official information	A general “vocabulary” of protected secrets
Constitution, Art. 21(2)	Secrecy of banking operations, deposits, correspondence and communications is protected by law	Constitutional level

Interpretation. On this basis it is reasonable to treat at least medical information, information covered by banking secrecy, and genetic and fingerprint data as restricted-access. But apart from fingerprint and genomic information, this is a conclusion drawn through a chain of rules rather than an express statutory rule. For other information — the IIN, salary data or family status — the answer is less obvious.

Why it matters. Restricted-access data carry additional requirements:

• confidentiality — they may not be disseminated without consent or another legal ground (Art. 11);
• a separate set of security measures, including cryptography, logs and integrity control (Protection Rules, para 15);
• collection and processing only through digital objects in Kazakhstan (para 16);
• the operator’s category goes up one level (Art. 25-1; Rules, para 17).

Identifiers

Since 2026 the Law singles out identifiers — full name (taken together), IIN, facial image and facial biometric vector (Art. 6). They define personal data themselves (Art. 1(2)), and anonymisation is described as irreversible transformation of identifiers (Art. 1(2-5)). The Digital Code calls the IIN the unique identifier of an individual (Art. 45). More on the definition in the note “Scope and key terms”.

Biometric data

The current Personal Data Law has no separate definition of biometric data. Biometrics appears in several provisions:

• the facial image and facial biometric vector are identifiers (Art. 6);
• biometric technologies in public places — only to protect the constitutional order, public order, rights, health and morals, unless the subject consents (Art. 7(12));
• confidentiality of biometric data is set by legislation (Art. 11(3)).

The Digital Code adds that biometric data used for digital authentication are personal data; mandatory biometric processing is allowed only where laws provide; biometric authentication for public services goes through the national system, and for financial institutions follows rules of the financial regulator and the National Bank (Art. 48).

Comparison with the GDPR

Question	Kazakhstan	GDPR
Main split	Publicly available and restricted-access	Ordinary and special categories
Sensitive data	No list; derived from other laws	Closed list: health, genetics, biometrics for identification, racial or ethnic origin, political opinions, religion, trade union membership, sex life (Art. 9)
Criminal records	No separate regime in the Law	Special regime (Art. 10)
Public data	Publication requires consent; special rules for further use	Remain personal data; an ordinary legal basis is needed

Interpretation. GDPR special categories are defined by the content of the information and the risk of discrimination. Kazakhstan’s “restricted-access” status depends on whether legislation contains a confidentiality rule. That is why political opinions or religious beliefs are not expressly named as restricted, although by European logic they are among the most sensitive data.

Open questions

Open question: the IIN. Is the IIN on its own restricted-access data? It is both an identifier and a widely used public detail. No clear rule has been found.

Open question: banking and commercial secrets. If client information is a banking secret, does it automatically become “restricted-access personal data” with all the consequences — local processing, cryptography, a higher category?

Open question: defining biometrics. The Personal Data Law has no general definition of biometric data. It does not say where the line runs between a photograph and a “biometric vector”.

Still to research

• Banking secrecy rules and their link to restricted-access data.
• Employment law on employees’ personal data.
• The rules on collecting and processing biometric data for authentication in public services.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.