Data Protection Regulations s.9: the lawful-basis rule is addressed to the Data Processor, while other sections treat it as the Data Controller's basis - who is bound?

Section 9 of the Data Protection Regulations opens "A Data Processor must not Process Personal Data unless" one of grounds (a)-(e) applies. The grounds themselves refer to the Data Controller, and sections 9-1(1), 13(1)(c)(v) and 14(2)(c)(v) treat section 9 as the Controller's lawful basis. The Controller's duty to process lawfully also follows from section 8(1)(a). A Processor may well be meant to be bound too, so the text allows more than one reading of who is bound by section 9. For comparison, the corresponding ADGM provision (Data Protection Regulations 2015, section 2) opened without naming an addressee: "Personal Data may only be Processed if".

Proposed correction

Please clarify whether section 9 binds Data Controllers, Data Processors or both, and adjust its opening words if needed.

Jurisdiction

Kazakhstan — AIFC

Act

AIFC Data Protection Regulations

Place

s.9

Record

Question of reading or data

Class

Question of reading or data

Where it arose

The text of the act

Arxo's conclusion

Confirmed

Official text

Unchanged at last check

Last checked

2026-10-24

Evidence

Contradiction within the text. Quotations are verbatim from the official material; translations are ours and marked.

A Data Processor must not Process Personal Data unless:

Data Processor means any Person who Processes Personal Data on behalf of a Data Controller.

if it is to be relied on as a basis for Processing under section 9(a) or under section 10(a).

whether the Personal Data will be Processed relying on section 9(e)

A Data Processor must take every reasonable step to ensure that Personal Data that is inaccurate or incomplete

A Data Processor must not Process Personal Data unless:

How to check it without Arxo's tools

1. Open AIFC DATA PROTECTION REGULATIONS (with amendments as of 1 April 2025) and find s.9; Schedule 1, definition; s.9-1(1); s.13(1)(c)(v); s.8(2). Compare the text with the quotation above. A copy is kept in this register: d1a6312a3161802b-aifc-data-protection-regulations-2025-1.pdf (SHA-256 d1a6312a3161802bcd4f252058143c087a07fd8cd3c57f8d3cc9c968f1e5a022, copy of the official file).
2. Open AIFC DATA PROTECTION REGULATIONS and find 2017 s.9 - same addressee. Compare the text with the quotation above. A copy is kept in this register: 058b64665566a460-aifc-data-protection-regulations-no.-10-of-2017-2-1.pdf (SHA-256 058b64665566a460177bf348931072150793f938269c0c47f74c2f789c5e4f72, copy of the official file).
3. The finding holds if the quoted passages read as shown and the comparison gives the result stated at the top of this page. If it does not, write to us with the record ID.

How this finding was made

AI agents read the official texts, turned the provisions concerned into executable rules and ran the comparison; they also drafted this record. A person at Arxo checked the finding and approved the report before it was sent (2026-10-27).

Responsible institutions

• AIFC Authority — body that prepares AIFC acts and publishes them on the AIFC website

Reported to

Responses

No response recorded.

Documents and reproduction

• AIFC DATA PROTECTION REGULATIONS (with amendments as of 1 April 2025)
• AIFC DATA PROTECTION REGULATIONS

History

1. 2026-10-24Confirmed by Arxo
2. 2026-10-27Entered in the register
3. 2026-10-27Reported to AIFC Authority (e-mail)

Cite this record

Arxo Law, Arxo Findings Register, ARXO-2026-0202, https://arxo.io/findings/ARXO-2026-0202/ (status as of 2026-10-24). Data: ARXO-2026-0202.json.