Processing personal data without consent

In short

Data may be processed without consent only in the cases expressly listed in Art. 9 and when further using data published in public sources (Art. 7(5)). The Article 9 list mostly describes state functions and specific organisations, ending with a reference to “other cases established by laws”. There are no general grounds such as performance of a contract or legitimate interest, as in the GDPR.

The Article 9 list

Collection and processing without consent are allowed in the following cases (Art. 9):

Group	Cases
State functions	Law enforcement, courts and bodies dealing with administrative offences, enforcement proceedings (item 1); state statistics (item 2) and use by state bodies for statistics with de-identification (item 3); military registration (item 2-1); financial market supervision (item 9); tax and customs administration (item 9-1)
Treaties and human rights	Implementation of ratified international treaties (item 4); protection of constitutional rights and freedoms where consent cannot be obtained (item 5)
Publicity	Professional work of journalists and media, scientific, literary and other creative activity (item 6); publication required by law, including data on candidates for elected office (item 7)
Subject’s duties	The subject fails to provide data required by law (item 8)
Specific organisations and registers	Unified Accumulative Pension Fund (item 5-1); backups on the national platform (item 9-2); register of business partners (item 9-3); personal bankruptcy (item 9-4); immigrant reference database and state property register (item 9-5); housing construction savings bank (item 9-7)
Other	Other cases established by laws (item 10)

From 1 January 2027 the list will gain item 9-6 (Law No. 311-VIII of 12 June 2026, according to the editorial note on Adilet).

Interpretation. In the current text of Article 9, two different items are numbered 9-5: the immigrant reference database and the state property register. This is a drafting glitch, but it is safer to cite these grounds by description rather than by number alone.

Published data

A separate route without consent concerns data already published in public sources (Art. 7(3)–(5)):

• where publication is required by law, no consent is needed for it (para 4);
• further collection, processing and dissemination by third parties of such data, and of data published with consent or by the subject, are allowed with a reference to the source (para 5);
• but if the subject published the data themselves, whoever processes them later must prove that this is lawful (para 3-1);
• non-purposive extraction from public sources to build databases is prohibited (para 11).

Consequences of processing without a ground

Data collected and processed without consent and without a ground under Art. 7(5) or Art. 9 must be destroyed or deleted (Art. 18(3-1)), and the subject may demand this (Art. 24(1)(4)). The Digital Code likewise allows processing without consent only “in cases expressly provided for by laws” (Art. 37(3)).

What the list lacks

For ordinary businesses, what Article 9 does not contain matters more than what it does:

• performance of a contract with the subject — for example, delivery to a given address or granting a loan;
• legitimate interest — for example, CCTV for security or fraud prevention;
• vital interests in general form — only protection of constitutional rights where consent cannot be obtained (item 5);
• employment — the Labour Code requires employers to process employee data “in accordance with the legislation of the Republic of Kazakhstan on personal data and their protection” (Art. 23(2)(24)) but gives no ground of its own.

Interpretation. For these situations three routes remain: obtain consent; find a specific statutory provision requiring processing (item 10 of Art. 9); or rely on the subject’s duty to provide data (item 8 of Art. 9 and Art. 24(2)). For example, an employer’s duty to keep records and report on taxes and pension contributions can presumably be grounded in special laws, whereas screening a job applicant can rest only on consent.

Comparison with the GDPR

Ground	Kazakhstan	GDPR (Art. 6(1))
Consent	The main rule (Art. 7(1))	(a) — one of six
Performance of a contract	None	(b)
Legal obligation	Partly: “other cases established by laws” (item 10), the subject’s duty (item 8)	(c)
Vital interests	Narrow: protection of constitutional rights where consent is impossible (item 5)	(d)
Public task	A list of specific state functions	(e) — general formula
Legitimate interest	None	(f)

Open questions

Open question: contracts. Is separate consent needed where data are necessary to perform a contract with the subject? The letter of the Law says yes, and practice — judging by common consent clauses in contracts — assumes the same.

Open question: “laws” or “regulations”? Item 10 of Article 9 refers to cases established by laws. Is a secondary act, such as a ministerial order requiring an organisation to collect data, enough?

Open question: CCTV. On what ground is CCTV in offices and shops operated, given that a facial image is an identifier (Art. 6) and legitimate interest is not on the list?

Still to research

• Special laws that themselves provide for processing without consent: banking, tax, anti-money laundering.
• The content of item 9-6, in force from 1 January 2027.
• Regulator practice on CCTV and employee data.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.