Articles 7-8 of the Kazakhstan PDPL establish the lawful basis framework for processing personal data + closely modelled on Russian Federation Personal Data Law 152-FZ with GDPR convergence. (1) Article 7 Lawful Basis: (a) Consent of subject of personal data; (b) Necessary for performance of contract to which subject is party + or for steps requested by subject prior to contract; (c) Necessary for compliance with legal obligation of owner/operator; (d) Necessary to protect vital interests of subject or another person; (e) Necessary for performance of state/municipal function in public interest; (f) Necessary for legitimate interests of owner/operator (subject to balancing); (g) Public sources of personal data (Article 10); (h) Statistical + scientific research with appropriate safeguards. (2) Article 8 Consent Requirements: (a) Freely given - not bundled with non-essential conditions; (b) Specific - to defined purposes; (c) Informed - subject understands implications; (d) Documented - written + electronic + audio-recorded acceptable; (e) Withdrawable at any time without detriment; (f) Form requirements - written consent for sensitive personal data + special categories per Article 9; (g) Affirmative action - clear opt-in (pre-ticked boxes + silence do NOT constitute consent); (h) Refresh for material new purposes. (3) Documented Consent Standards: (a) Written form for sensitive data + biometric + cross-border transfer; (b) Electronic equivalent acceptable (per Electronic Document and Electronic Digital Signature Law 2013); (c) Audio-video recording for telephone/online consent; (d) Audit trail per Article 21; (e) Period of validity specified; (f) Withdrawal mechanism + accessibility. (4) Sensitive Personal Data Heightened Consent per Article 9: (a) Explicit affirmative consent required; (b) Specific to sensitive data category; (c) Informed of risks; (d) Written form preferred; (e) Reaffirmation for new purposes; (f) Cannot be implied from general consent. (5) Children's Data Considerations: (a) Limited explicit Kazakhstan PDPL provisions on age threshold; (b) Civil Code Article 23 capacity standards apply (age 18 default + 14-18 limited capacity + parental consent under 14); (c) Education sector specific guidance + Ministry of Education; (d) Online services emerging guidance; (e) Convergence with GDPR-style children's protections in recent amendments. (6) Biometric Consent Specific per Article 12: (a) Written consent for biometric data processing; (b) Specific to biometric purpose; (c) Cannot be condition of essential service unless directly related; (d) Biometric data localization (mandatory storage in Kazakhstan) per 2022 amendment; (e) High security standards + encryption + access control. (7) Contract Performance Basis: (a) Necessary for performance of contract to which subject is party; (b) Necessary for pre-contractual steps requested by subject; (c) Limited to data actually needed; (d) Used for banking + insurance + utilities + employment + commercial. (8) Legal Obligation Basis: (a) Compliance with Kazakhstan law; (b) Anti-Money Laundering + KNB Committee for National Security cooperation; (c) Tax compliance + State Revenue Committee; (d) Employment law + Labour Code; (e) Health regulations; (f) Court orders + judicial proceedings; (g) Mass Media Law obligations. (9) Public Interest + Statutory Authority: (a) State function performance; (b) Statistical processing per Statistics Law; (c) Public health emergency; (d) National security + KNB Committee; (e) Census; (f) Voter registration + Central Election Commission. (10) Privacy Notice + Transparency per Article 13: (a) Privacy Notice required at point of collection; (b) Identity of owner + operator + purposes + lawful basis + categories + recipients + retention + rights + transfer information; (c) Plain Russian + Kazakh language + accessible; (d) Update + change notification + version control; (e) Multiple stakeholder versions. (11) Penalties for Consent Failures: (a) Article 79 Code of Administrative Offences administrative penalties; (b) Criminal Code Articles 147-148 criminal liability; (c) Civil compensation per Civil Code; (d) Operational suspension for material failures. Coordinates with Russian Federation Personal Data Law 152-FZ Articles 6 + 9 + EU GDPR Articles 5 + 6 + 7 + 9 + Convention 108+ + Kazakhstan Constitution Article 18 + Civil Code + Labour Code + Electronic Document and Electronic Digital Signature Law 2013 + Code of Administrative Offences Article 79 + Criminal Code Articles 147-148 + Mass Media Law + AML Law + Central Election Commission + State Revenue Committee + Statistics Law + Ministry of Health + Ministry of Education. Kazakhstan PDPL Lawful Basis + Articles 7-8 apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.