ORDER OF THE MINISTER OF DIGITAL DEVELOPMENT, INNOVATIONS AND AEROSPACE INDUSTRY OF THE REPUBLIC OF KAZAKHSTAN

of June 21, 2023 No. 199/Tax Code

About approval of Rules of determination by the owner and (or) operator of the list of the personal data necessary and sufficient for accomplishment of the tasks performed by them

According to subitem 2-2) of Item 1 of article 27-1 of the Law of the Republic of Kazakhstan "About personal data and their protection" PRIKAZYVAYU:

1. Approve the enclosed Rules of determination by the owner and (or) operator of the list of the personal data necessary and sufficient for accomplishment of the tasks performed by them.

2. To provide to committee on information security of the Ministry of digital development, innovations and aerospace industry of the Republic of Kazakhstan:

1) state registration of this order in the Ministry of Justice of the Republic of Kazakhstan;

2) placement of this order on Internet resource of the Ministry of digital development, innovations and the aerospace industry of the Republic of Kazakhstan;

3) within ten working days after state registration of this order in the Ministry of Justice of the Republic of Kazakhstan submission to Legal department of the Ministry of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of data on execution of the actions provided by subitems 1) and 2) of this Item.

3. To impose control of execution of this order on the supervising vice-minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan.

4. This order becomes effective after ten calendar days after day of its first official publication.

Approved by the Order of the Minister of digital development, innovations and the aerospace industry of the Republic of Kazakhstan of June 21, 2023 No. 199/Tax Code

Rules of determination by the owner and (or) operator of the list of the personal data necessary and sufficient for accomplishment of the tasks performed by them

Chapter 1. General provisions

1. These rules of determination by the owner and (or) operator of the list of the personal data necessary and sufficient for accomplishment of the tasks performed by them (further – Rules), are developed according to subitem 2-2) of Item 1 of article 27-1 of the Law of the Republic of Kazakhstan "About personal data and their protection" (further – the Law) and determine procedure for determination by the owner and (or) operator of the list of the personal data necessary and sufficient for accomplishment of the tasks performed by them.

2. In these rules the following basic concepts are used:

1) personal data – the data relating to the subject of personal data determined or determined on their basis, fixed on electronic, paper and (or) other material medium;

2) collection of personal data – the actions directed to receipt of personal data;

3) the owner of the base containing personal data (further – the owner), – the state body, the physical and (or) legal entity exercising right of possession, uses and orders of the base containing personal data according to the laws of the Republic of Kazakhstan;

4) the operator of the base containing personal data (further – the operator), – the state body, the physical and (or) legal entity performing collection, processing and personal data protection;

5) personal data processing – the actions directed to accumulating, storage, change, amendment, use, distribution, depersonalization, blocking and destruction of personal data.

Chapter 2. Procedure for determination by the owner and (or) operator of the list of the personal data necessary and sufficient for accomplishment of the tasks performed by them

3. Owner and (or) the operator prior to collection and personal data processing carry out the analysis of the tasks performed by them regarding use of personal data.

When implementing the current activities the owner and (or) the operator as required carry out the repeated analysis of the tasks performed by them regarding use of personal data based on which changes are made to the list of personal data necessary and sufficient for accomplishment of the tasks performed by them.

4. Based on the carried-out analysis the owner and (or) the operator, according to appendix to these rules, determine the list of personal data necessary by form and sufficient for accomplishment of the tasks performed by them with indication of the purposes of their collection and processing within tasks.

The purposes are unambiguous, legal and correspond the performed owner and (or) the operator to tasks.

Personal data, content and which amount are excessive in relation to the performed owner and (or) the operator of tasks are not included in the list of personal data necessary and sufficient for accomplishment of the tasks performed by them.

5. The owner and (or) the operator provide access to the list of personal data necessary and sufficient for accomplishment of the tasks performed by them, the methods which are not prohibited by the legislation of the Republic of Kazakhstan.

Appendix

to Rules of determination by the owner and (or) operator of the list of the personal data necessary and sufficient for accomplishment of the tasks performed by them

The list of personal data necessary and sufficient for accomplishment of the performed tasks

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info