Confidentiality, disclosure to third parties, publication in public sources.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
As a rule, yes — passing data to third parties requires consent, and the consent itself must say whether data may be passed to third parties. Without consent — only in cases expressly provided for by law.
More in the note «Disclosure of personal data to third parties and publication»
The law has no separate "processor acting on instructions", so it is safer to treat passing data to a contractor as a transfer to a third party — mention it in the consent and set out the contractor's duties in the contract: confidentiality, protection measures, storage in Kazakhstan, deletion of data when the work ends.
More in the note «Disclosure of personal data to third parties and publication»
Data may be published openly only with the person's consent, unless the law requires publication; where publication is mandatory, data not subject to disclosure are masked. Anyone reusing published data must cite the source. Mass extraction of data from open sources to build databases ("non-purposive extraction") is prohibited.
More in the note «Disclosure of personal data to third parties and publication»
Note
How the Law distinguishes disclosure to specific persons from publication in public sources, when consent is needed, what the rules on self-published data and the ban on "non-purposive extraction" change, and why Kazakhstan law has no familiar "processor" figure.
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
Detailed rules on collection and processing: consent for public dissemination, disclosure and cross-border transfer (para 4-5), a three-working-day deadline to answer data subjects (para 16), irreversible de-identification (paras 20–21), blocking and deletion (para 25).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceConsentCross-border transfersData subject rightsDeletion and anonymisationDisclosure to third partiesPurpose, scope and retention