I.O.'S ORDER OF THE MINISTER OF DIGITAL DEVELOPMENT, INNOVATIONS AND AEROSPACE INDUSTRY OF THE REPUBLIC OF KAZAKHSTAN

of July 8, 2022 No. 236/Tax Code

About approval of Rules of integration with the state service of access control to personal data

According to subitem 7-4) of Item 1 of article 27-1 of the Law of the Republic of Kazakhstan "About personal data and their protection" PRIKAZYVAYU:

1. Approve the enclosed Rules of integration with the state service of access control to personal data.

2. To provide to committee on information security of the Ministry of digital development, innovations and aerospace industry of the Republic of Kazakhstan:

1) state registration of this order in the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this order on Internet resource of the Ministry of digital development, innovations and the aerospace industry of the Republic of Kazakhstan;

3) within ten working days after state registration of this order in the Ministry of Justice of the Republic of Kazakhstan submission to Legal department of the Ministry of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of data on execution of the actions provided by subitems 1) and 2) of this Item.

3. To impose control of execution of this order on the supervising vice-minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan.

4. This order becomes effective after ten calendar days after day of its first official publication.

Approved by the Order of the acting minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of July 8, 2022 No. 236/Tax Code

Rules of integration with the state service of access control to personal data

Chapter 1. General provisions

1. These rules of integration with the state service of access control to personal data (further – Rules) are developed according to subitem 7-4) of Item 1 of article 27-1 of the Law of the Republic of Kazakhstan "About personal data and their protection" (further – the Law) and determine procedure for integration with the state service of access control to personal data.

2. In these rules the following basic concepts are used:

1) the initiator – the information system initiating request for access to personal data;

2) the state service of access control to personal data (further – the state service) – the service providing information exchange of owners and (or) operators, the third parties with the subject of personal data and authorized body in case of access to the personal data containing in objects of informatization of state bodies and (or) the state legal entities including obtaining from the subject of personal data of consent to collection, personal data processing or their transfer to the third parties;

3) the operator of the base containing personal data (further – the operator) – the state body, the physical and (or) legal entity performing collection, processing and personal data protection;

4) the subject of personal data (further – the subject) – physical person to which personal data belong.

5) authorized body in the field of personal data protection (further – authorized body) – the central executive body performing management in the field of personal data protection;

6) safety token – the electronic key in the form of set of certain number of digits and letters in the JWT format intended for information security support of the user is also used for identification of its owner;

7) the gateway of "the electronic government" (further – ShEP) – the information system intended for integration of objects of informatization of "the electronic government" with other objects of informatization.

3. Owners and (or) operators, the third parties in case of interaction with the objects of informatization of state bodies and (or) the state legal entities containing personal data provide integration of own objects of informatization involved in processes of collection and personal data processing, with the state service, except as specified, provided by subitems 1), 2), 9) and 9-2) articles 9 of the Law.

Chapter 2. Procedure for integration with the state service of access control to personal data

4. For integration with the state service the application on the Smart Bridge platform is submitted (further – platform).

5. The application is submitted for service of access control to personal data.

6. Filling of the request on platform is performed according to instructions of platform for connection.

7. In case of application one of the following methods of sending request for access to personal data, including obtaining from the subject of consent (failure) is specified collection, personal data processing or their transfer to the third parties:

1) the request/answer through Single contact center "1414" – this method is available to initiators and (or) operators;

2) the request/answer means of the initiator and (or) operator – this method is available to initiators and operators, not being state body and (or) the state legal entity which information systems conform to the single requirements in the field of information and communication technologies and information security support approved by the order of the Government of the Republic of Kazakhstan of December 20, 2016 No. 832, have the act of conformity testings to requirements of information security issued by authorized state body (further – the act of testing), according to subitem 11-1) of article 7-1 of the Law of the Republic of Kazakhstan "About informatization".

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info