Collection and processing of personal data

29.01.2025

Is it necessary to tick the box on websites about consent to the collection and processing of personal data?

Let’s figure out what is considered personal data:

• Publicly available personal data are personal data or information that, in accordance with the laws of the Republic of Kazakhstan, are not subject to confidentiality requirements, access to which is free with the consent of the subject (full name, residential address, telephone number, i.e. data provided voluntarily)
• Personal data of limited access are personal data, access to which is limited by the legislation of the Republic of Kazakhstan.
  Article 7 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” establishes that “The collection and processing of personal data is carried out by the owner and (or) operator, as well as a third party with the consent of the subject or his legal representative in the manner determined by the authorized body”

In accordance with this law, operators (websites, companies and other organizations) are obliged to:

• Inform users about the purposes of collecting personal data
• Obtain explicit consent for their processing
• Ensure the security of this data

Thus, the website must provide the user with the opportunity to consent to the processing of personal data, usually through a checkbox (or similar mechanism), before they are collected or processed.

Violation of legislation in the field of personal data entails administrative liability, namely fines in the amount of 10 to 70 MCI depending on the category of the business entity (Article 79 of the Code of Administrative Offenses of the Republic of Kazakhstan).