ORDER OF THE MINISTER OF DIGITAL DEVELOPMENT, INNOVATIONS AND AEROSPACE INDUSTRY OF THE REPUBLIC OF KAZAKHSTAN

of October 21, 2020 No. 395/Tax Code

About approval of Rules of collection, personal data processing

According to the subitem 7) Item 1 of article 27-1 of the Law of the Republic of Kazakhstan of May 21, 2013 "About personal data and their protection" PRIKAZYVAYU:

1. Approve the enclosed Rules of collection, personal data processing.

2. To provide to committee on information security of the Ministry of digital development, innovations and aerospace industry of the Republic of Kazakhstan:

1) state registration of this order in the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this order on the Internet - resource of the Ministry of digital development, innovations and the aerospace industry of the Republic of Kazakhstan;

3) within ten working days after state registration of this order submission to Legal department of the Ministry of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of data on execution of the actions provided by subitems 1) and 2) of this Item.

3. To impose control of execution of this order on supervising vice-the minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan.

4. This order becomes effective after ten calendar days after day of its first official publication.

Approved by the Order of the Minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of October 21, 2020 No. 395/Tax Code

Rules of collection, personal data processing

Chapter 1. General provisions

1. These rules of collection, personal data processing (further – Rules) are developed according to the subitem 7) of Item 1 of article 27-1 of the Law of the Republic of Kazakhstan "About personal data and their protection" (further – the Law) and determine procedure for collection, personal data processing.

2. In these rules the following basic concepts are used:

1) personal data – the data relating to the subject of personal data determined or determined on their basis, fixed on electronic, paper and (or) other material medium;

2) blocking of personal data – actions for the temporary termination of collection, accumulating, change, amendment, use, distribution, depersonalization and destruction of personal data;

3) accumulating of personal data – actions for systematization of personal data by their entering into the base containing personal data;

4) collection of personal data – the actions directed to receipt of personal data;

5) destruction of personal data – actions as a result of which making it is impossible to recover personal data;

6) depersonalization of personal data – actions as a result of which making determination of accessory of personal data is impossible for the subject of personal data;

7) the base containing personal data (further – base), – set of the arranged personal data;

8) the owner of the base containing personal data (further – the owner), – the state body, the physical and (or) legal entity exercising right of possession, uses and orders of the base containing personal data according to the laws of the Republic of Kazakhstan;

9) the operator of the base containing personal data (further – the operator), – the state body, the physical and (or) legal entity performing collection, processing and personal data protection;

10) non-state service of access control to personal data (further – non-state service) – the service providing information exchange of owners and (or) operators, the third parties with the subject of personal data in case of access to the personal data containing in non-state objects of informatization including obtaining from the subject of personal data of consent to collection, personal data processing or their transfer to the third parties;

11) the state service of access control to personal data (further – the state service) – the service providing information exchange of owners and (or) operators, the third parties with the subject of personal data and authorized body in case of access to the personal data containing in objects of informatization of state bodies and (or) the state legal entities including obtaining from the subject of personal data of consent to collection, personal data processing or their transfer to the third parties;

12) authorized body in the field of personal data protection (further – authorized body) – the central executive body performing management in the field of personal data protection.

3. These rules extend to the relations arising between owners, operators, subjects, and also the third parties in the course of collection and personal data processing.

4. Collection, personal data processing are performed by the owner and (or) the operator, and also the third party with the consent of the subject or his legal representative according to the procedure, determined by these rules, except as specified, stipulated in Item 4-3 these rules and article 9 of the Law.

Collection, personal data processing of the dead (recognized by court it is unknown absent or declared the dead) the subject are performed according to the legislation of the Republic of Kazakhstan.

4-1. Distribution of personal data in public sources is allowed in the presence of the consent of the subject or his legal representative.

4-2. Requirements of Item 4-1 of these rules do not extend to owners of information in cases of the publication of information which obligation of placement is established by the laws of the Republic of Kazakhstan.

4-3. Repeated collection, processing and distribution by the third parties of the personal data published based on Items 4-1 and 4-2 of these rules on condition of availability of the reference to the source of information is allowed.

4-4. Personal data processing in the form of cross-border transfer of personal data, except as specified, the stipulated in Article 16 Laws, distribution of personal data in public sources, and also their transfers to the third parties is performed on condition of the consent of the subject.

5. Collection and processing by the owner and (or) personal data operator is allowed in the amount determined by the List of the personal data necessary and sufficient for accomplishment of the performed tasks (further - the List of personal data).

The list of personal data is determined and affirms according to Rules, determinations by the owner and (or) operator of the list of the personal data necessary and sufficient for accomplishment performed by them tasks approved by the order of the Government of the Republic of Kazakhstan of November 12, 2013 No. 1214.

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info