Personal data of employees and job applicants

In short

The Labour Code has almost no rules of its own on personal data and refers to the general Law. Employers must collect, process and protect employee data “in accordance with the legislation of the Republic of Kazakhstan on personal data and their protection” (Art. 23(2)(24)). Employees have a right to the protection of their data (Art. 22(1)(24)). The most practical rule in the Code is the closed list of documents required on hiring (Art. 32): employers may not ask for other documents unless a regulation provides for it.

Hiring

An employment contract requires (Art. 32(1)):

1. an identity card or passport (for foreigners, a residence permit or another document);
2. a document on education or special knowledge, if the job requires it;
3. a document recognising professional qualifications (if any);
4. a document confirming previous employment, for those with work experience;
5. a document on a preliminary medical examination, where one is mandatory.

Additional documents apply in some cases:

• for work with minors in education, health, sport, culture and social services, a certificate on the presence or absence of records of certain criminal offences (Art. 32(2));
• for certain positions, the employer itself checks records of corruption offences through digital systems (Art. 32(3));
• for a second job, a certificate from the main employer (Art. 32(4)).

Employers may not require documents not listed in Art. 32, except where regulations so provide (Art. 32(6)). If an employee leaves originals with the employer, the employer gives a written undertaking to return them (Art. 32(7)).

Interpretation. Art. 32(6) is in effect a data minimisation rule for hiring (compare Art. 12(1) of the Personal Data Law). Application forms asking about marital status, children, relatives or previous salaries are hard to justify: such information may at most be requested voluntarily, with consent and without consequences for refusing. Moreover, pregnancy and having children under three may not restrict the conclusion of an employment contract (Art. 25(2)), and discrimination at work is prohibited (Art. 6).

Copies of identity documents

The Personal Data Law prohibits collecting and processing paper copies of identity documents. The exceptions are: there is no integration with state digital objects, the person cannot be identified by technological means, or a law provides otherwise (Art. 7(10)). Documents from the digital documents service do not fall under these exceptions (ibid.).

Interpretation. The habit of HR departments to photocopy identity cards for the personnel file now needs to be justified by one of the exceptions. It is safer to check the document on hiring and record only the necessary details in the file.

Grounds for processing: law or consent

The Personal Data Law has no “performance of an employment contract” ground (see the note “Processing personal data without consent”). Therefore:

• without consent, employers process data the employee is obliged to provide by law (Art. 9(8); Art. 24(2)) and data needed for the employer’s direct statutory duties (Art. 9(10)): taxes, pension contributions, compulsory social insurance (Labour Code, Art. 23(2)(14)), entering employment contract details into the unified system for recording employment contracts (Labour Code, Art. 23(2)(27));
• with consent, everything else: photos on the website, relatives’ data, background checks of applicants, sharing data within a group of companies or abroad, biometric office access.

The authorised labour body ensures the confidentiality of data in the unified system (Labour Code, Art. 16(41-7)). Employees may obtain information on their employment contract and work history from the system (Labour Code, Art. 22(1)(25)).

Interpretation. A blanket consent obtained from employees on hiring fits poorly with the requirement that purposes be specific and predetermined (Personal Data Law, Art. 7(8)). It is better to separate what is processed under the law (without consent) from what is processed with consent, listing the purposes. On whether employees’ consent is freely given, see the note “Consent to the collection and processing of personal data”.

Job applicants

• What may be collected: only what is needed to assess the applicant for the specific position.
• Background checks (references, open-source checks) require consent: there is no legitimate interest ground.
• Retention: documents of rejected applicants are kept “until no longer needed” (Retention Schedule, item 464). As a rule this means deletion once the selection is over, unless the applicant consented to a talent pool (see the note “Purpose, scope and retention of personal data”).

Retention of HR records

Under the 2025 Retention Schedule (items 460–467): internal acts on employees’ personal data are kept permanently; employment contracts, personnel files and record cards for 75 years; employees’ consent statements for 1 year. The full table and the conflict with the duty to prove consent are in the note “Purpose, scope and retention of personal data”.

Special employee data

• Medical information (medical examination results, sick notes) is covered by medical confidentiality and is restricted-access data; see the note “Personal medical data and digital health”.
• Biometrics (face or fingerprint access) is restricted-access data; consent and enhanced protection measures are required.
• Criminal records are requested only in the cases of Art. 32(2)–(3) of the Labour Code.

Comparison with the GDPR

Question	Kazakhstan	GDPR
Specific employment rules	Almost none; reference to the general Law	Member States may adopt specific rules (Art. 88)
Ground for HR data	Law or consent	Performance of a contract, legal obligation (Art. 6(1)(b), (c)); employee consent is considered doubtful because of the imbalance of power
Documents on hiring	Closed list in Art. 32 of the Labour Code	Data minimisation (Art. 5(1)(c))
Employee monitoring	No specific rules	Legitimate interest with a proportionality assessment, often a DPIA (Art. 35)

Open questions

Open question: CCTV and monitoring. On what ground does an employer run CCTV, monitor corporate email and work computers? The Law has no legitimate interest ground, and employee consent is questionable given employees’ dependence on the employer.

Open question: group HR systems. If HR data are kept in a shared HR system of an international group abroad, how can localisation (Art. 12(2)) and the cross-border transfer rules (Art. 16) both be complied with?

Open question: an employee’s refusal. What if an employee refuses to consent to processing of data that the job needs but the law does not expressly require?

Still to research

• Rules on submitting information to the unified system for recording employment contracts.
• Practice of labour inspectors and the regulator regarding employee data.
• Rules on employee medical examinations and keeping their results.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.