Law note · Kazakhstan
Law on Personal Data and Their Protection, biometric data provisions
What it requires
- An app is not exempt from Kazakhstan's Law on Personal Data merely because biometric data has no dedicated definition in the Act. Collecting biometric data in a public place for identification purposes is restricted to constitutional-order, public-order, rights, health, or morality grounds unless the subject consents, and biometric data stored on Kazakhstani subjects must sit in a database located inside Kazakhstan like any other personal data. Confidentiality of biometric data specifically is deferred to other Kazakh legislation this research did not identify.
When LexLint raises it
processes_biometricsprocesses_voice
What we found
The Act has no dedicated special-category article and never defines biometric data as a term; it regulates biometric processing through three scattered clauses instead.
Art. 7(12) restricts collecting biometric data in public places to constitutional-order, public-order, rights, health, or morality purposes unless the subject consents; this clause was reworded by Law No. 96-VII (30 December 2021, in force 1 March 2022), so the currently quoted text has been in effect since that date, not since the Act's 2013 commencement.
Art. 11(3) defers biometric confidentiality entirely to unnamed other Kazakh legislation this research did not identify, and carries no amendment footnote of its own, so it has stood unchanged since the base Act's 25 November 2013 commencement. Art. 12(2)'s domestic-storage duty applies to biometric data as ordinary personal data; that duty was itself introduced by Law No. 419-V, in force 1 January 2016, with no biometric-specific carve-out or heightening found. No modality (face, voice, fingerprint) is named anywhere in the Act.