New Requirements of the Personal Data Law: Consent Form

Home
Knowledge
New Requirements of the Personal Data Law: Consent Form

New Requirements of the Personal Data Law: Consent Form

{FE65FB3E-8350-466A-B290-288052679E55}

February 24, 2022

In May 2021, we addressed the planned changes¹ to the Personal Data Law². At the end of 2021, the president of the Republic of Kazakhstan signed a law on amendments and additions to some legislative acts, including to legislation on personal data protection³.

We have prepared a series of brief overviews of the changes and amendments on personal data (PD) issues that will become effective as of March 2, 2022. This review looks at the new forms of providing consent for PD collection and processing.

Four forms of consent for PD collection and processing

Article 8 of the Personal Data Law (effective until March 2, 2022)	Article 8 of the Personal Data Law (in effect from March 2, 2022)
1. Written	1. written (as before)
2. through an electronic document	2. through the state service (new)
3. through the PD security service	3. through a non-state service (new)
4. other ways with the implementation of protective elements which do not contradict effective legislation	4. other ways that allow for a verification of consent (modified)

As seen from the table above, starting from March 2, 2022, the list of consent forms will undergo significant changes. Forms of consent through the PD security service will no longer be used.

Currently, we do not have information about the launching of the state and non-state services. Thus, as we understand, for the time being, two consent forms can be used: written and other form (for example, by the current practice of companies where users agree to the company’s PD collection and processing policy by ticking a box on the website, and then the company sends the user an electronic confirmation that consent has been provided).

Additionally, starting from March 2, 2022, the exact information to include in the consent form for PD collection and processing is set in law. Among other things, there must be 1) the data operator’s name (full name, BIN/IIN), 2) the data subject’s full name, 3) the period of validity of the consent.

Before this date, no specifics were provided for this. That said, in practice, many companies already included items from the above list.

This review has been prepared based on our analysis and changes and additions to the Law and does not constitute legal advice. Should you have any questions, please contact us.

"New rules for working with personal data in Kazakhstan," Dentons insights, May 6, 2021 ↩
The Law of the Republic of Kazakhstan “On Personal Data and its Protection” dated May 21, 2013 ↩
The Law of the Republic of Kazakhstan No. 96-VII “On introducing changes and additions to several legislative acts of the Republic of Kazakhstan on trade activities, stock trading and personal data protection issues” dated December 30, 2021 ↩