﻿LAW OF THE REPUBLIC OF KAZAKHSTAN ABOUT PERSONAL DATA PROTECTION 
By decision of the Meeting of Representatives 
Address by the President of the Republic of Tajikistan Majlisi Namoyandagon Majlisi Oli of the  Republic of Tajikistan. 
dated June 8, 2018, No. 1115 
it was accepted. 
Resolution of the Majlisi Namoyandagon of the Majlisi Oli of Tajikistan 
Address by the President of the Republic of Tajikistan Majlisi Namoyandagon Majlisi Oli of the  Republic of Tajikistan. 
dated August 2, 2018, No. 561 
about the year. 
In this regard, the legal and organizational basis for the operation of this law, collection, processing, storage and protection of personal data is determined. 
CHAPTER 1. GENERAL PROVISIONS 
Article 1. Basic concepts: 
The following basic concepts are used in this Law:: 
- personal data biometrӣ - a person to whom information about the subject's physical and  physiological characteristics 
is assigned to the Ministry of Environmental Protection; 
- personal data - data on facts, events and situations in the life of the subject of personal data, which he gives, represented by ainiyatkunonia; 
- when collecting personal data-actions, personal data, for obtaining 
ravonagardid; 
- destruction of personal data - actions that result in the restoration of their performance , the provision of personal data is impossible; 
- behususiyatkunonia of personal data - actions as a result of which, how to determine the ownership of personal data of a personal data subject without using it to obtain additional information, it becomes impossible; 
- databases for personal purposes (hereinafter referred to as the database) - a set of procedures for entering generally recognized personal data; 
- database owner (hereinafter referred to as the owner) - a state body, individual and legal entity that, in accordance with the legislation of the Republic of Kazakhstan, has the right to  own, 
use, manage and protect the database is not them; 
- database operator (hereinafter referred to as the operator) - a state body, individual or legal entity that, in accordance with the legislation of the Republic of Kazakhstan or the contract,  the owner 
does not process and protect personal data; 
- protection of personal data - a set of measures to prevent 
unauthorized access to information, including personal data; 
- processing of personal data - actions in which, recording, systematization, storage, tagyirdi , raising, receiving, using, distributing, behususiyatkunon , conclusion and ҳӣ ӣ sending nobudsozii of personal data;
- use of personal data - actions, in personal information, necessary for the implementation of its activities, with the holder, operator to third parties, as well as; 
- storage of personal data - actions to ensure the safety, confidentiality and availability of personal data; 
- dissemination of personal data - actions, within the limits, taking into account that the personal  data 
of a person is sent to you; 
- personal data subject (hereinafter referred to as the subject) - a natural person to whom these items belong to the relevant ones; 
- third party - a person who is not the subject, operator and owner, was or was not, or the  relationship 
of related legal entities with them on personal data issues; 
- material carrier - material objects (including physical fields) in which these things reflect themselves in the mirror, appearance, sounds and in general in all its forms; - actions (operations) with the holder of personal data - collection, storage, transfer, suspension, behususiyatkunon and destruction of personal data; 
- personal data confidentiality regime - the rules stipulate that 
access restrictions, transfers, and storage conditions for personal data are determined; - transfer of personal data to trans - transfer of personal data on the territory of foreign countries. 
Article 2. With the legislation of the Republic of Kazakhstan on personal data protection 
In accordance with the legislation of the Republic of Kazakhstan on personal data protection, in accordance with the Constitution of the Republic of Kazakhstan, in accordance with this Law and  other regulatory 
legal acts of the Republic of Tajikistan, as well as international legal acts, and what was Tajikistan, recognize them, is, is. 
Article 3. Scope of this Law 
1. 
This law regulates relations related to the collection, processing and protection of information about personal data. 
2. 
And the following actions of this law will not be taken into account: 
- on the part of the protection and processing of personal data of subjects, and for personal needs  other than just 
sex, if the rights of individuals, individuals have been violated, and this leads to another (or) legal  entities 
that do not; 
- formation, storage, accounting and use of documents containing personal data in the document fund, the archive of the National Archive of the Republic of Kazakhstan, and others,  in accordance with 
the legislation of the Republic of Kazakhstan; 
- processing and protection of personal data, in accordance with the legislation of the Republic of  Kazakhstan 
, is classified as a state secret. 
Article 4. Principles of personal data collection, processing and protection 
- The collection, processing and protection of personal data is based on the following principles::
- respect for human and civil rights and freedoms;
- legality. 
- adolatnok training. 
- and not just for publishing rights. 
- confidentiality of restricted access information from the site; 
- equality of rights of subjects, the operator and dorand children; 
- ensuring the security of individuals, society and the state. 
CHAPTER 2. STATE REGULATION AND GUARANTEES OF PERSONAL DATA  PROTECTION 
Article 5. State guarantee of personal data protection 
1. 
The protection of personal data is guaranteed by the State. 
2. 
Collection and processing of personal data in the presence of a certificate 
of compliance of the authorized state body for personal data protection and information security, including practical ones. 
3. 
To ensure the security of personal data, whether accidentally or necessary, to protect them from hacking or leaking, copying, theft, loss, alteration (forgery) 
or destruction in Iraq, and possibly to take measures. 
Article 6. Powers of the President of the Republic of Kazakhstan on personal data protection 
Personal data includes the powers of the President of the Republic of Kazakhstan for the protection  and protection of 
personal property , including:: 
- approval of regulatory legal acts on personal data protection; 
- determination of the authorized state body for personal data protection, and approval of its regulations; 
- exercise of powers provided for by the legislation of the Republic of Tajikistan and other legal  acts; 
The Republic. 
Article 7. Powers of the authorized state body for personal data protection 
The authorized state body exercises the following powers for the protection of personal data, which include:: 
- protects personal data based on state policy; 
- development and approval of legal acts on personal data protection, in order to propose to the President of the Republic of Kazakhstan; 
- the list of personal data related to the implementation of activities, for the holder, operator and third parties, is necessary and sufficient, approved; 
- the holder from the party in the order, third, in the implementation of human protection measures  and its operator 
performs confirmation of personal data. 
- appeals of individuals and legal entities regarding the protection of personal data and ensures consideration; 
- a list of persons responsible in accordance with the legislation of the Republic of Kazakhstan on the protection of personal data, on who should be responsible in order to determine their  responsibility, and 
take measures;
- exercise other powers stipulated by the legislation of the Republic of Tajikistan, his deputies. 
CHAPTER 3. - COLLECTION, PROCESSING AND STORAGE OF PERSONAL  INFORMATION 
Article 8. Conditions for the collection and processing of personal data 
1. 
Consent to the collection and processing of personal data of a subject with its legal representative,  or by 
its owner and / or operator, except for the cases provided 
for in Article 9 of this Law, is not granted. 
2. 
The collection and processing of personal data must achieve specific purposes, in, with, and above all, defined by law is not limited. It is not allowed to process information for the purpose of collection by mislabeling it as personal. 
3. 
The volume and content of personal data must be in the collection of korkardshavand for the purpose of collecting and processing arzgardidai-petersburg in accordance with the requirements. 4. 
The collection and processing of personal data must be assured of the accuracy of the data  contained, in the event 
that it is sufficiently strong, and for the purposes of collection if necessary, and does not matter in  comparison with 
the processing of personal data must be ensured. The operator should definitely not be on incomplete or inaccurate information to take the necessary steps to improve. 5. 
Information should be subject, in respect of the data about anyavailable 
was not, and that he did not belong to their access to information, which 
will be enough to fix it, and has no right, or information 
istibsar requirements, and if the legislation of the Republic of Tajikistan 
established a different procedure is not provided. 
6. 
- Collection and processing of personal data of subjects, in connection with the death, by the court, missing or deceased etilongardid etilongardid, established in accordance with the legislation Of the Republic of Kazakhstan are being implemented. 
Article 9. Access to personal information 
1. 
General access restrictions will be shared and get access to personal information. 2. 
In general, it is free with the consent of the personal data subject or its availability in the availability of a confidentiality regime in respect of which, in accordance with the legislation of the Republic of Kazakhstan, requirements 
do not apply. 
3. 
Sources of information support for the population in the field of personal data for purposes that are available free of charge (including mail, telephone, book, to the 
address of an insured event, by e-mail, general access to information resources, mass media,
mass media) are not used. 
4. 
Access to information of limited access, in accordance with the legislation of the Republic of  Tajikistan, and in personal 
responsibility, is Tajikistan.
Article 10. To access your personal information 
1. 
The subject of personal data or his legal representative agrees to the terms of access to them, for which, the holder, for collecting and processing them by the operator and third parties, also  provides him 
with goods, except for the cases provided for in Article 9 of this Law, are determined by law. 
2. 
Response to the request (request) of the subject or its legal representative regarding access to personal data, their owner, operator and third party, in the form 
established by the legislation of the Republic of Kazakhstan. 
3. 
Relations between the owner, the operator and a third party, as well as with respect to access to personal information, are regulated by the Law of the Republic of Tajikistan "On the Right of  access to 
information". 
Article 11. The subject consents to the collection and processing of personal data in the order of submission (revocation) 1. 
- Collection and processing of personal data of the subject, or his legal representative in accordance with the legislation of the Republic of Kazakhstan, gives consent (he makes a conclusion). 
2. 
The subject gives consent to the collection and processing of data or his legal representative, at that  time, in 
a personal conclusion, and in the cases provided for in Article 9 of this Law, may not be. 
Article 12. - Collection and processing of personal data of the subject without his consent 
- Collection and processing of personal data of the subject without his consent or by his legal  representative, and in 
cases when it is carried out on the following day:: 
- performing tasks on behalf of state bodies is not provided for in the legislation of the Republic of Tajikistan or in the Russian Federation; 
- protection of constitutional rights and freedoms, human and civil rights and freedoms. Article 13. Confidentiality of personal information 
1. 
The owner, operator and third parties who have access to personal data, when access is restricted also they appear, the way, on the road in compliance with all the requirements,  its powers 
extend without the consent of the subject or its legal representative provides to it, can not be real. 
2. 
Individuals who, due to restricted access to their personal information with professional, service, employment relationship needs, and have become aware of the need to ensure confidentiality. 
3. 
Biometer for personal privacy purposes, in accordance with the legislation of the Republic ӣ of Tajikistan, are established.
Article 14. Copying and storing of personal data 
1. 
An example of storing personal data, by collecting personal data, for 
the implementation of activities that have an operator and third parties, is necessary and sufficient, occurs. 
2. 
Storage of personal data, with the holder, operator and third parties who are in the database, it simply was not located on the territory of the Republic of Tajikistan, except in cases where the personal data is authorized by the state body for protection, as agreed in the Russian Federation, is carried out in accordance with the procedure established. 3. 
Storage period from the date of achievement of the purpose of processing personal data , - they are determined, if in accordance with the procedure established by the legislation of the  Republic of Tajikistan, others 
are not provided. 
Article 15. Change of personal data and in full 
Change of personal data of the owner, and not on behalf of the company, the operator and a person, third, on the basis of an application (request) of the subject or his legal representative, or in cases  where 
it is carried out in other ways provided for by the legislation of the Republic of Tajikistan. Article 16. Dissemination of personal data, in the following cases: 
1. 
Dissemination of personal data is not allowed if the rights and freedoms 
of the subject are not violated, as well as on the legitimate interests of individuals and other legal acts, not to the detriment, except in cases provided 
for by the current legislation of the Republic of Kazakhstan. 
2. 
Dissemination of personal data in cases where, in accordance with the previously announced purpose of collection and processing, for which they are released, with the consent of the subject or  his representatives 
under the law, to him, except in cases provided for by the legislation 
of the Republic of Kazakhstan, for accounting purposes. 
Article 17. Personal Biometer informationӣ 
1. 
The data that the Ministry of environment and physiological characteristics of a person and affects his personality, on its basis can be used (biometr information for personal reasons), and some hand from his face to identify the operator and can also be 
the subject of the personal data use and getting maybe only subject to 
the consent in writing of the personal data subject, for they were not, except in the cases provided for by part 2 of this article may be processing. 
2. 
The processing of personal data of the subject without his consent, can be biometr data, the administration of justice and the criminal prosecution in connection with the personal  implementation of legislation 
in the courts, and in cases stipulated by the legislation of the Republic of Kazakhstan on civil defense, security, operational investigative activities, countering 
terrorism, extremism, corruption and legalization (laundering) of money
to get a criminal way and financing of terrorism and financing 
the proliferation of weapons of mass destruction, the execution of criminal penalties, the acquisition or termination of 
citizenship of the Republic of Tajikistan public service and needs to be done. Article 18. Sending data in a trance 
1. 
Once on the territory of foreign states, cross-border data movement, which 
provides for the protection of the rights of personal data subjects, is also carried out in accordance  with 
this Law. Transfer of personal data in cross-border trade 
, fundamentals of the constitutional order of the Republic of Tajikistan, for the purpose of  protection,
public morals, health, rights and legitimate interests of citizens, ensuring national defense and state security, may be restricted or prohibited in the country. 2. 
Once on the territory of foreign countries, cross-border data movement , personal data protection does not provide, is carried out in the following cases:: - with the consent of the subject in trance, or his legal representative, to transfer information to him for personal purposes; 
- in cases stipulated by international treaties recognized by the Republic of Tajikistan;
- in cases stipulated by the legislation of the Republic of Kazakhstan, if it is not for the purpose of protecting the constitutional order, public order, human and civil rights and freedoms, their rights and freedoms, 
morals and public health, ensuring national defense and state security, if necessary , it may be; 
- protection of constitutional rights and freedoms of a person and citizen, their rights and freedoms,  if obtaining the consent 
of the subject or its legal representative is impossible. 
Article 19. Behususiatcountry of personal data 
The processing of personal data is carried out for statistical research, in the course of transmission,  social, 
scientific, having the operator and third parties, their u dadorand behususiyat-Petersburg. д
Article 20. Destruction of personal data, in the following cases: 
Personal data of the owner and third parties in the following cases, the operator and must be destroyed, must be: 
- upon expiration of the storage period, in accordance with part 3 of Article 14 of this Law; - legal relations between the entity and its owner in the event of termination of the operator or a third party; 
- if a court decision comes into force. 
Article 21. Transmitting data about Habardorkunӣ
1. 
The operator is the holder or that the transfer of personal data to third parties in the war, for third parties and also that the information on personal data of subjects this was not, within a period not exceeding three working days subject to unadorned message containing the information specified in part 2 of this article, the ways in Petersburg. 
2.
The following three reports are based on information being investigated. 
- last name, first name of the individual, name of the legal entity, e-mail address to third parties that  information 
received their belongings; 
- in accordance with article 5 of this law, for the purposes of processing personal data; - the source of receiving personal data. 
3. 
The holder, third, in the operator's obligations in the cases specified in part 1 of the person, and for  the following 
, provided for in this Article, are released, including:: 
- if the data subject has given their consent to the transfer, then; 
- if, in accordance with the legislation of the Russian Federation, the functions of a state body, the  performance of the following functions: 
The Republic of Tajikistan; 
- get acquainted with the results in general or at the request of the personal data subject for access to the co, from; 
- if the data subject, representing that 
there was no violation of the rights and legitimate interests of other persons not specified in  paragraph 2 of this article, then there may be. 
4. 
The processing of personal data for the purposes of transmission or in the case of statistical research , scientific research and others is carried out if the rights and legitimate interests of the personal data subject cannot and do not violate. 
CHAPTER 4. RIGHTS AND OBLIGATIONS OF THE SUBJECT 
Article 22. The right of access to information of a personal subject, in particular: 
1. 
The entities specified in part 4 of this Article may not use the information provided for in Part 5 of  this Article to obtain 
it. 
The subject has the right to handle holder, the operator and the third party, or rather, conclusions, or to destroy 
and make your personal data is not required if such information is incomplete, Quad, inaccurate, illegally obtained or are not asgardia to 
processing is required, as well as measures to protect their rights, 
to take measures stipulated by the legislation of the Republic of Tajikistan. 
2. 
The information specified in Part 4 of this article is shown as being applied to the entity, or its legal representative, owner, operator and third parties in the event 
of an application by the entity or its representative either on request for proposals, and not by law,  making it 
not be. 
3. 
Information-that is, as shown, specified in part 4 of this article shall be on the part of the owner, of the operator of the third parties, and not the subject, but in the form of offers  available 
in stock belonging to other subjects of personal data, it needs to be and
may not, except in those cases where personal data is to identify such grounds, the law is not available. 
4. 
Collection and processing of information related to the data of the subject in order to obtain the right to their belongings, which, in particular, includes the following information:
- collecting and processing facts with the statement. 
- purposes and legal grounds for processing and collection; 
- methods of collection and processing and frequently used goals; 
- the name and location of the owner, operator and third parties, information about persons (except for employees of the copyright holder, and a legal entity, third-party operator), data  that 
cannot detect them, or will not have access to personal information for personal purposes; - terms of collection and processing of personal data, including the terms of their storage; - the procedure for the subject's exercise of the right, as well as in cases stipulated by this Law, in the Russian Federation; 
- the information provided for in this article on actually performed trans or transfers of information. 5. 
The right of the personal data subject to have access to it, in accordance with the legislation of the  Russian Federation. 
The Republic of Kazakhstan cannot become a restriction. 
Article 23. Responsibilities of subjects 
Subjects of personal data, in cases established 
by the legislation of the Republic of Kazakhstan, must submit them. 
CHAPTER 5. RIGHTS AND OBLIGATIONS OF THE HOLDER, AND, THIRD, OF THE  PERSON, OPERATOR 
Article 24. Rights holder, operator and Owner A third party, operator and third party have the right to:: 
- collection and processing of personal data in accordance with the procedure established by this  Law 
and other regulatory legal acts of the Republic of Tajikistan, regulatory legal acts of the Republic of Tajikistan is carried out; 
- for the protection of personal data , in accordance with the legislation of the Republic of  Kazakhstan, measures 
necessary, including legal, organizational and technical measures. 
Article 25. Obligations of the copyright holder, operator and third party, 
1. 
Owner, operator and third parties, dadorand: у 
the list of personal data, their approval and performance of duties, is necessary, sufficient to represent that, unless otherwise provided by the legislation of the Republic of Kazakhstan on the state; 
- collection and processing of personal data in the event that in order to become successful, established by this Law and other regulatory legal acts, as well as in other cases provided for by legal acts of the Republic of Kazakhstan, take measures to destroy them, and not his personal  data; 
- in cases stipulated by the legislation of the Republic of Kazakhstan, in the case of collecting and processing information for subjects confirming consent to receive their personal data; 
- the subject or its legal representative, within three days from the date of its information referred to  by this law 
as working days from the date of its receipt, submit to the appeal. 
2. 
The holder, operator and third party for the protection of personal data should ask
questions and take the necessary measures, then they should ensure the following:: - prevention of unauthorized access to information for personal purposes; - timely detection of unauthorized access to personal data; 
- so, according to information, unauthorized access represents negative effects exerted on things. 
3. 
Responsibilities of the owner, including the protection of personal data to third parties and to the  operator and at 
the moment there is no current collection of personal data, so that they disappear, never be, or they act behususiyatkunonia. 
G l a v a 6. FINAL PROVISIONS 
Article 26. Liability for violation of this Law 
For legal entities and individuals, in accordance with the procedure established by this Law, for  violation of the requirements 
, they are liable in accordance with the legislation of the Republic of Tajikistan. Article 27. Procedure for the entry into force of this Law 
This law shall enter into force after its official publication. 
The President 
Republic of Tajikistan Emomali Rahmon 
city of Dushanbe,  
August 3, 2018,  
№ 1537