Purpose, scope and retention of personal data

In short

Processing is limited to specific, predetermined and lawful purposes (Art. 7(8)). Data are used only for previously stated purposes (Art. 14) and collected to the extent “necessary and sufficient” for the tasks (Art. 12(1)). The retention period is defined by the date the purposes are achieved, unless legislation provides otherwise (Art. 12(2)). Mandatory periods for standard documents of organisations are set by the 2025 Retention Schedule (Schedule, item 461).

Purposes

• Purposes must be specific, predetermined and lawful. Processing aimed at causing harm or restricting the subject’s rights is prohibited (Art. 7(8)).
• Data are used only for previously stated purposes (Art. 14; Collection Rules, para 17).
• Dissemination beyond the stated purposes requires consent (Art. 15(2); Collection Rules, para 18).
• In the data inventory, purposes are stated for each task and must be “unambiguous, lawful” (Data Inventory Rules, para 4).

Scope

Collection is limited to data necessary and sufficient for the tasks (Art. 12(1)); excessive data are not processed (Art. 7(9)). The tool is the data inventory that every owner and operator approves (Art. 25(2)(1)):

• before collection the tasks are analysed, and the analysis is repeated as needed (Data Inventory Rules, para 3);
• excessive data are left out of the inventory (para 4);
• access to the inventory is ensured (para 5);
• collection and processing are allowed within the scope of the inventory (Collection Rules, para 5).

More on the inventory in the note “Principles of personal data processing”.

Retention period

The Law sets two levels:

1. General rule — the period is defined by the date the purposes of collection and processing are achieved (Art. 12(2)). Once the purpose is achieved, the data are destroyed or deleted (Art. 25(2)(4); Art. 18(1)).
2. Otherwise provided by legislation — mandatory retention periods for documents. Where such a period exists, data may not be deleted at the subject’s request; instead, access is restricted and processing suspended (Digital Code, Art. 41(3)).

The term of consent is also tied to the purposes: it may not exceed the time needed to achieve them unless a law or contract provides otherwise, and if no term is stated, consent is valid until the purposes are achieved (Art. 8(5)–(6)).

Retention periods for HR documents

Since July 2025 a new List of standard documents with retention periods has applied, approved by Order of the Minister of Culture and Information No. 279-NK of 17 June 2025. The previous list (Order No. 263 of 2017) is no longer in force. For documents relating to employees’ personal data:

Item	Documents	Period
460	Internal acts (regulations, instructions) on employees’ personal data	Permanently
461	Employment contracts	75 years
462	Personnel files (for most categories)	75 years
463	Employee record cards	75 years
464	Documents of rejected applicants	Until no longer needed
467	Employees’ statements of consent to the processing of personal data	1 year

Interpretation. A one-year period for consent statements fits poorly with the operator’s duty to prove consent (Art. 25(2)(5)): employment and processing last for years. The Schedule presumably sets a minimum retention period for the document, not a ban on keeping it longer. It is safer to keep consent for the whole processing period.

Interpretation. “Until no longer needed” for applicants’ documents is, in effect, a reference to the general rule of Article 12(2): once the selection is over, the purpose is achieved, and rejected applicants’ data should be deleted unless there is consent to keep them.

Comparison with the GDPR

Question	Kazakhstan	GDPR
Purpose limitation	Specific, predetermined, lawful purposes (Art. 7(8), Art. 14)	Specified, explicit, legitimate purposes (Art. 5(1)(b))
New purpose	Dissemination beyond the purposes only with consent (Art. 15(2))	A compatible purpose is allowed under the criteria of Art. 6(4)
Minimisation	A data inventory in a prescribed form	A principle without a mandatory form (Art. 5(1)(c))
Retention	Until the purposes are achieved; mandatory periods under the Schedule	No longer than necessary for the purposes (Art. 5(1)(e)); periods under national law

Open questions

Open question: compatible purpose. Can data be used without new consent for a purpose close to the original one, for example service-quality analytics? The Law contains no compatibility test as in the GDPR.

Open question: retention of consent forms. How does a one-year retention period for consent statements fit with the duty to prove consent for the whole processing period?

Open question: backups. Does the duty to delete data once the purpose is achieved extend to backups whose lifetime is set by technical policy?

Still to research

• Retention periods under tax and accounting legislation and how they relate to the Schedule.
• Retention periods for CCTV recordings.
• Regulator practice in checking data inventories.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.