The list of necessary data, use only for stated purposes, retention periods.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
The list is drawn up before collection starts — for each company task (hiring, sales, delivery) it states the purpose, only the data the task cannot do without, and the document or rule the task stems from. Unnecessary data are left out and not collected. The list is approved by an internal document and revised when processes change.
More in the note «Purpose, scope and retention of personal data»
The general rule is to keep data until the purpose is achieved and then destroy or delete them. Where the law sets a mandatory period (for example, employment contracts and personnel files — 75 years, customer due diligence records in finance — at least five years), data are kept for that period and then destroyed or deleted.
More in the note «Purpose, scope and retention of personal data»
Data may be used only for the purposes stated at collection; a new purpose generally requires new consent. The law has no "compatible purpose" mechanism like the GDPR's.
More in the note «Purpose, scope and retention of personal data»
Note
Three layers of rules on automated decisions: Article 19-1 of the Personal Data Law (prohibited without consent or a statutory basis, right to object with a response within three working days), Article 43 of the Digital Code (explanation and human review) and the 2025 AI Law (prohibited functions, transparency, training data). Plus the 2026 standard on AI in schools: teachers, not systems, decide on grades.
Note
Four similar concepts in Kazakhstan law and how they differ; when data must be destroyed or deleted and how fast; when de-identification is required; and how this fits with the right to erasure in the Digital Code and with the GDPR.
Note
Article 5 of the Law lists only five principles, phrased as general values. The familiar GDPR principles — purpose limitation, minimisation, storage limitation, accuracy, accountability — also exist in Kazakhstan law but are scattered across other articles and secondary acts. This note maps them in one place.
Note
How Kazakhstan law limits the purposes and scope of processing, how the retention period is set and what happens once the purpose is achieved. Also: retention periods for HR documents under the 2025 schedule, and the tension between a one-year retention period for consent forms and the duty to prove consent.
Note
What the Labour Code says about personal data: a closed list of documents on hiring, a ban on asking for more, the unified system for recording employment contracts. When an employer needs consent and when the law suffices, how to handle applicants' data, how long to keep HR records and why identity documents should not be photocopied.
The core statute: definitions, scope, the in-country storage rule (Art. 12) and cross-border transfers (Art. 16). Notification of processing (Art. 10-1) and operator size categories (Art. 25-1) apply from 25 August 2026.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceAutomated processing and AIBreaches and notificationsConsentCross-border transfersTypes of personal dataData subject rightsDeletion and anonymisationDisclosure to third partiesLiabilityData localisationNotification and register of operatorsProcessing principlesProcessing without consentPurpose, scope and retentionRegulator and state supervisionResponsible person and internal policiesScope and key termsTelecommunicationsSecurity measures
Detailed rules on collection and processing: consent for public dissemination, disclosure and cross-border transfer (para 4-5), a three-working-day deadline to answer data subjects (para 16), irreversible de-identification (paras 20–21), blocking and deletion (para 25).
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceConsentCross-border transfersData subject rightsDeletion and anonymisationDisclosure to third partiesPurpose, scope and retention
Retention periods for standard documents of any organisation. For HR: internal personal data policies — permanently; employment contracts and personnel files — 75 years; documents of rejected applicants — until no longer needed; employees' consent forms — 1 year.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forcePurpose, scope and retentionEmployment
How to build the inventory of processed data: analyse tasks before processing, state clear and lawful purposes, exclude excessive data (paras 3–4), make the inventory accessible (para 5); a template is annexed. Purpose limitation and minimisation in practice.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceProcessing principlesPurpose, scope and retention