Personal data of employees and job applicants.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
The Labour Code has almost no detailed rules — employers must process and protect employee data under personal data law. The main practical rule is that on hiring, only documents on the Code's list may be required (ID, education and employment records, medical examination results where mandatory, and a few others). Employers also enter employment contract details in the unified state recording system.
More in the note «Personal data of employees and job applicants»
For what the law requires (taxes, contributions, insurance, recording employment contracts), no consent is needed. For everything else — photos on the website, relatives' data, biometric office access, sharing within a group or abroad — consent is needed, with specific purposes rather than a blanket consent.
More in the note «Personal data of employees and job applicants»
Collect only what is needed to assess the applicant for the specific position; background checks (references, open sources) require the applicant's consent. Paper copies of identity documents may not be made, save in cases provided by law. Rejected applicants' documents are kept "until no longer needed" — in effect, until the selection is over, unless they consented to a talent pool.
More in the note «Personal data of employees and job applicants»
Note
When data may be processed without consent: the closed list of Article 9 and the special rules for published data. What the list lacks compared with the GDPR — contract, legitimate interest, vital interests — and what that means for employers and ordinary businesses.
Note
How Kazakhstan law limits the purposes and scope of processing, how the retention period is set and what happens once the purpose is achieved. Also: retention periods for HR documents under the 2025 schedule, and the tension between a one-year retention period for consent forms and the duty to prove consent.
Note
What the Labour Code says about personal data: a closed list of documents on hiring, a ban on asking for more, the unified system for recording employment contracts. When an employer needs consent and when the law suffices, how to handle applicants' data, how long to keep HR records and why identity documents should not be photocopied.
The Code says little about employee data: employees have a right to protection of their data (Art. 22), employers must process it under personal data law (Art. 23(2)(24)) and report contracts to the unified system (Art. 23(2)(27)). Only documents listed in Art. 32 may be required on hiring.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceProcessing without consentEmployment
Retention periods for standard documents of any organisation. For HR: internal personal data policies — permanently; employment contracts and personnel files — 75 years; documents of rejected applicants — until no longer needed; employees' consent forms — 1 year.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forcePurpose, scope and retentionEmployment