Cases where data may be collected and processed without the data subject's consent.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
Only the cases on a closed list — the work of courts and law enforcement, statistics, tax and customs administration, financial market supervision, implementing international treaties, journalism and creative work, publication required by law and a few others, plus "other cases established by law". Separately, data already lawfully published may be reused with a reference to the source.
No. Kazakhstan law recognises neither "legitimate interest" nor "performance of a contract". If no specific statutory provision covers the processing, the person's consent is needed.
Some employee data are processed under the law without consent — taxes, contributions, compulsory insurance, recording employment contracts; everything else requires consent. Data of counterparties' representatives are usually also processed with consent; a separate ground exists only for the business partner register — entrepreneurs' data relating to their business.
Note
In Kazakhstan consent is the main ground for processing, not one of many. This note covers the form of consent, its required content, when separate consent is needed, how the state and non-state services work, how consent is withdrawn, and why proving consent is harder than it seems.
Note
A summary table of 20 issues showing where Kazakhstan's personal data rules resemble the GDPR and where they differ fundamentally — legal grounds, localisation, cross-border transfers, deadlines, the responsible person, fines. Plus a list of what a GDPR-compliant company must additionally do for Kazakhstan.
Note
When data may be processed without consent: the closed list of Article 9 and the special rules for published data. What the list lacks compared with the GDPR — contract, legitimate interest, vital interests — and what that means for employers and ordinary businesses.
Note
What the Labour Code says about personal data: a closed list of documents on hiring, a ban on asking for more, the unified system for recording employment contracts. When an employer needs consent and when the law suffices, how to handle applicants' data, how long to keep HR records and why identity documents should not be photocopied.
Note
How personal data law interacts with banking secrecy, microcredit secrecy, credit history rules and AML/CFT in banks, microfinance organisations and credit bureaus. The new 2026 Banking Law, biometric authentication through the National Bank and retention of customer files.
Note
The Communications Law's special regime for subscriber data: what counts as service information (numbers, IMEI, IIN, billing, location, IP addresses), the absolute ban on transferring it abroad, access by state bodies, secrecy of communications and device registration. The 2026 amendments and a pilot project running to the end of 2027.
The Code says little about employee data: employees have a right to protection of their data (Art. 22), employers must process it under personal data law (Art. 23(2)(24)) and report contracts to the unified system (Art. 23(2)(27)). Only documents listed in Art. 32 may be required on hiring.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceProcessing without consentEmployment
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures