Article 10-1. Notification of the beginning of processing and termination of processing of personal data of the Law on Personal Data and Their Protection

Home / Laws / Article 10-1. Notification of the beginning of processing and termination of processing of personal data of the Law on Personal Data and Their Protection

1. Prior to the start of processing and termination of processing of personal data, the owner and (or) the operator, as well as a third party, are obliged to notify the authorized body of their intention to process personal data and terminate data processing, except for the cases provided for in paragraph 2 of this Article.

2. The owner and (or) the operator, as well as a third party, have the right to process them without notification if they are classified as small and medium-sized owners and (or) operators, as well as third parties who collect and process personal data.

3. The notification provided for in paragraph 1 of this article is sent in the form of a document on paper, digital and (or) other tangible media, which is signed by an authorized person. The notification contains the following information:

1) name (surname, first name, patronymic (if it is indicated in the identity document), business identification number (individual identification number) the owner and (or) the operator, as well as a third party;

2) applicable measures to protect personal data;

3) the start date of personal data processing;

4) regarding the possibility (or lack thereof) for the owner and/or operator, as well as a third party, to transfer personal data to third parties;

5) regarding the presence or absence of cross‑border transfer of personal data in the process of its processing;

6) regarding the dissemination of personal data in publicly available sources;

7) a list of collected personal data related to the subject.

8) about the location of the database and (or) the digital object containing personal data;

9) other information determined by the owner and (or) the operator, as well as by a third party.

4. The authorized body, within thirty working days from the date of receipt of the notification about the processing of personal data from the owner and (or) the operator, as well as from a third party, enters the information specified in paragraph 3 of this article, as well as information about the date when the said notification was sent, into the register of persons engaged in the collection and (or) processing of personal data.

5. The authorized body, within thirty working days from the date of receipt from the owner and/or operator, as well as a third party, of a notice of termination of personal data processing, shall exclude the information specified in paragraph 3 of this article from the register of persons collecting and/or processing personal data.

The Law of the Republic of Kazakhstan dated May 21, 2013 N 94-V.

The article was amended and supplemented by the Law of the Republic of Kazakhstan dated June 24, 2026, No. 326-VIII SAM

This Law regulates public relations in the field of personal data, as well as defines the purpose, principles and legal basis of activities related to the collection, processing and protection of personal data.

President

Republic of Kazakhstan

Constitution Law Code Standard Decree Order Decision Resolution Lawyer Almaty Lawyer Legal service Legal advice Civil Criminal Administrative cases Disputes Defense Arbitration Law Company Kazakhstan Law Firm Court Cases