New Requirements of the Personal Data Law: Consent Form - JD Supra
In May 2021, we addressed the planned changes1 to the Personal Data Law2. At the end of 2021, the president of the Republic of Kazakhstan signed a law on amendments and additions to some legislative acts, including to legislation on personal data protection3.
We have prepared a series of brief overviews of the changes and amendments on personal data (PD) issues that will become effective as of March 2, 2022. This review looks at the new forms of providing consent for PD collection and processing.
Four forms of consent for PD collection and processing
| Article 8 of the Personal Data Law (effective until March 2, 2022) | |
|---|---|
| 1. Written | 1. written (as before) |
| 2. through an electronic document | 2. through the state service (new) |
| 3. through the PD security service | 3. through a non-state service (new) |
| 4. other ways with the implementation of protective elements which do not contradict effective legislation | 4. other ways that allow for a verification of consent (modified) |
As seen from the table above, starting from March 2, 2022, the list of consent forms will undergo significant changes. Forms of consent through the PD security service will no longer be used.
Currently, we do not have information about the launching of the state and non-state services. Thus, as we understand, for the time being, two consent forms can be used: written and other form (for example, by the current practice of companies where users agree to the company’s PD collection and processing policy by ticking a box on the website, and then the company sends the user an electronic confirmation that consent has been provided).
Additionally, starting from March 2, 2022, the exact information to include in the consent form for PD collection and processing is set in law. Among other things, there must be 1) the data operator’s name (full name, BIN/IIN), 2) the data subject’s full name, 3) the period of validity of the consent.
Before this date, no specifics were provided for this. That said, in practice, many companies already included items from the above list.
This review has been prepared based on our analysis and changes and additions to the Law and does not constitute legal advice. Should you have any questions, please contact us.
- "New rules for working with personal data in Kazakhstan," Dentons insights, May 6, 2021
- The Law of the Republic of Kazakhstan “On Personal Data and its Protection” dated May 21, 2013
- The Law of the Republic of Kazakhstan No. 96-VII “On introducing changes and additions to several legislative acts of the Republic of Kazakhstan on trade activities, stock trading and personal data protection issues” dated December 30, 2021
Latest Posts
DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
© Dentons 2022 | Attorney Advertising
source: https://www.jdsupra.com/legalnews/new-requirements-of-the-personal-data-3380056/
Your content is great. However, if any of the content contained herein violates any rights of yours, including those of copyright, please contact us immediately by e-mail at media[@]kissrpr.com.