Kazakhstani Law No. 94-V on Personal Data and its Protection ('the Law') came in force on 26 November 2013, imposing new data protection requirements and regulating the collection and processing of personal data, data subjects' rights, access and confidentiality requirements, data processing without data subject's consent and cross-border data transfer rules, among other things.
The Law defines 'personal data', 'database owner' and 'database operator' among others. The Law also stipulates that personal data may only be collected and processed for specific purposes. Furthermore, unless an exception applies, companies must obtain data subject's consent either in writing, within an electronic document with a verified digital signature or another method that meets Kazakhstan legal requirements.
It is not clear how data would be transferred internationally and stored in international servers.
The Law prohibits data transfers to countries that do not have an adequate level of personal data protection unless the consent of the individual is obtained.
''[T]here are some issues that the companies [will] face while trying to comply with the Law'', Azim Usmanov, Partner at Colibri Law Firm, told DataGuidance. ''These issues refer to territoriality of the Law; [lack of] availability of any other forms, except for written form [for obtaining consent]. Besides, it is not clear how the data would be transferred internationally and stored in international servers and how the international companies would bear administrative liability for failure to fulfill the requirements of the Law. The competent authority is also not stipulated by the Law.''
The Law also impacts several other laws in Kazakhstan, including the Civil Code, Labor Code, Code on Public Health and Health Care System and the Law on Informatisation.
Usmanov said, ''[C]ompanies [should] develop the special policy on protection of personal data, internal documents related to collection and processing of personal data as well as a written form [for obtaining individual's consent].''