OneTrust DataGuidance confirmed, on 25 October 2019, with Nataliya Shapovalova, Senior Associate at Dentons, that there is an ongoing public discussion about the Draft Law on Regulation of Digital Technologies ('the Draft Law'), which would amend the Law of 21 May 2013 No. 94-V ZRK on Personal Data and its Protection ('the Personal Data Law'). In particular, Shapovalova outlined that, "The amendments will affect the letter of consent for collection and processing of personal data, the use of personal data by smart cities, and [...] propose to introduce the right to be forgotten."Moreover, Shapovalova highlighted that, "It is envisaged [among other things] that consent for the collection and processing of data may be issued in an electronic form [...]. [Moreover], businesses often use very broad wording for the purposes of collection and processing of personal data and leave the list of purposes open. [However], in case of the adoption of the Draft Law, the letter of consent will [have to] contain specific purposes that must be predetermined [...], and any additional purpose of using the data and will require additional consent from the data subject."

Furthermore, Shapovalova noted that, "The Draft Law proposes to oblige companies to depersonalise personal data for big data analytics, [...] [and introduces] the right to be forgotten allowing a data subject to demand the removal of his personal data from publicly available data sources. [...] The issue of creating a regulator in the area of collecting and processing personal data [in Kazakhstan is also] being discussed."