Article 9 of the Kazakhstan PDPL establishes enhanced protections for Sensitive Personal Data (Sensitivnye personaľnye dannye). (1) Article 9 Sensitive Personal Data Categories: (a) Race or ethnic origin; (b) Political opinion or party membership; (c) Religious beliefs; (d) Philosophical beliefs; (e) Trade union membership; (f) Physical or mental health condition (medical records + treatments + diagnoses + medications); (g) Genetic data (DNA + heritability + family genetic conditions); (h) Biometric data (fingerprint + facial recognition + iris + voice + behavioural - SUBJECT TO ARTICLE 12 LOCALIZATION); (i) Sexual life; (j) Criminal convictions + offences + arrests; (k) Other categories specified by Authorized Body regulation. (2) Sensitive Data Processing Conditions per Article 9 (PROHIBITED unless one applies): (a) Written Explicit Consent of subject (heightened consent standard); (b) Employment law obligations (occupational health + welfare + workplace safety + Labour Code provisions); (c) Vital interests where subject incapable of consent (life/limb); (d) Non-profit body for own membership (political party + religious organisation + trade union + philosophical society); (e) Manifestly made public by subject (Article 10 public sources); (f) Legal claims + judicial proceedings + court orders; (g) Substantial public interest with safeguards; (h) Preventive Medicine + Occupational Medicine + Health/Social Care under professional secrecy (medical practitioners + Hippocratic Oath + Medical Confidentiality Law); (i) Public Interest in Public Health (epidemic + outbreak + national health); (j) Archive in public interest + scientific or historical research + statistics with safeguards; (k) Statutory authority for state agencies (KNB Committee + Ministry of Internal Affairs + judicial); (l) Specifically authorised by Law. (3) Heightened Consent Standard per Article 9: (a) Written form required (electronic equivalent per Electronic Document Law); (b) Specific to sensitive data category; (c) Informed of risks + consequences; (d) Clear affirmative action; (e) Easily withdrawable; (f) Documented + audit trail; (g) Reaffirmation for new purposes; (h) Notarisation may be required in certain cases. (4) Genetic Data Specific Considerations: (a) Heritability affecting family members; (b) Bioethics + Kazakhstan Bioethics Committee; (c) Genetic testing + ancestry services + research biobanks; (d) Medical genetics + cancer screening; (e) Forensic genetic data + KNB Committee + Ministry of Internal Affairs; (f) Insurance considerations + non-discrimination. (5) Biometric Data Specific Considerations + Article 12 Localization: (a) National ID Card + Citizen IIN (Individual Identification Number); (b) E-Government services + e-Government Portal egov.kz; (c) Facial recognition + Smart City Astana + Almaty; (d) Banking biometric authentication; (e) Border control + visa biometric; (f) Article 12 MANDATORY STORAGE ON SERVERS IN KAZAKHSTAN per 2022 amendment - data sovereignty enforcement; (g) Foreign cloud providers must use Kazakhstan-based infrastructure; (h) Non-revocable nature concerns. (6) Health Data Specific Considerations: (a) Physical or mental health; (b) Medical records + diagnoses + treatments + medications; (c) Kazakhstan Ministry of Health + Mandatory Health Insurance System; (d) Republican Medical Centre + private healthcare + GMS Mandatory Health Insurance; (e) Telemedicine emerging; (f) Insurance health data overlap; (g) Mental health stigma sensitivity; (h) JCI Joint Commission International accreditation for hospitals. (7) Children's Sensitive Data: (a) Civil Code Article 23 capacity standards; (b) Parental consent for under 14 + limited consent 14-18; (c) Education sector + Ministry of Education guidance; (d) Children's medical records + special procedures; (e) Online services + parental consent emerging. (8) Public Sector + Sensitive Data: (a) Anti-discrimination obligations under Kazakhstan Constitution + Universal Declaration of Human Rights; (b) Census + statistical processing safeguards; (c) Public health emergency processing; (d) Voter registration + Central Election Commission; (e) Health insurance + Social Health Insurance Fund. (9) AIFC Sensitive Data: AIFC Data Protection Regulations apply different standards within AIFC zone; cross-AIFC sensitive data flows require careful navigation. (10) Penalties for Sensitive Data Violations: (a) Article 79 CoAP heightened penalties; (b) Criminal Code Articles 147-148 + up to 3 years imprisonment; (c) Civil compensation; (d) Operational suspension; (e) License revocation for licensed activities. Coordinates with EU GDPR Articles 8 + 9 + 10 + Russian Personal Data Law 152-FZ Article 10 + Convention 108+ Article 6 + Kazakhstan Constitution + Civil Code + Labour Code + Ministry of Health + Mandatory Health Insurance Law + Bioethics Committee + Central Election Commission + Social Health Insurance Fund + Code of Administrative Offences Article 79 + Criminal Code Articles 147-148 + AIFC Data Protection Regulations. Kazakhstan PDPL Sensitive Data + Article 9 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.