8.2. The data controller, in order to obtain a consent, shall introduce the following conditions to
the data subject, including:
8.2.1. Clear and specific grounds and purposes for data collection, processing, and use.
8.2.2. Data controller's name or a legal entity's given name and contact information.
8.2.3. List of data required for collection, processing, and use.
8.2.4. Duration of data processing and use.
8.2.5. Information on whether the data will be made available to the public.
8.2.6. Information on whether the data will be transferred to others, and if so, the list of
information to be transferred.
8.2.7. Form of withdrawal of consent.
8.3. The data subject shall give a written consent to the data controller, which shall be in paper or
electronic form.
8.4. The consent in electronic form specified in Paragraph 8.3 of this Law shall be granted by
identifying and certifying in an electronic environment by means specified in the law or accepted by the
data subject.
8.5. The consent shall be sought from a legal representative for collection of data of a citizen
provided in Articles 17, 18 and 19 of the Civil code, or of a citizen stated in Article 16 of such code, unless
otherwise provided by law.
8.6. The data subject's failure to respond to the data collection consent and the expiration of
response timeframe or the expiration of a reasonable time frame, shall not become grounds for deeming
the data collection is permitted.
8.7. The data subject may withdraw the consent at any time and the data processed prior to the
receipt of the request for withdrawal shall remain lawful if it does not violate this law.
8.8. The consent of the data subject shall not be required for data collection for the purpose of
identifying affiliated parties specified in Sub-paragraph 4.1.6 of the Law on Competition of the
participants/bidders in the procurement of goods, works and services with state and local funds.
8.9. The data controller shall prove that the consent of the data subject has been acquired for
data collection.
8.10. The data controller shall request a consent from the data subject again if the data will be
processed or used for a purpose other than those for which a consent was originally provided.
8.11. Unless a consent was provided as specified in Sub-paragraph 8.2.6 of this Law, the data
controller shall seek a consent in the form specified in Paragraph 8.3 of this Law from the data subject for
data transfer.
8.12. The regulations specified in Paragraphs 8.4, 8.5, 8.6, 8.7 and 8.9 of this Law shall equally
apply to seeking a consent to data transfer.
Article 9. Collection, Processing and Use of Sensitive Personal Data
9.1. Sensitive data on health, correspondence, genetic and biometric data, digital signature
private key, sexual and gender orientation, expression, and sexual relations specified in Sub-paragraph
4.1.12 of this Law shall be considered as personal secrets.
9.2. Collection, processing or use of sensitive personal data shall be prohibited except in the