Kazakhstan mandates breach notification, cybersecurity audits under new law
This digest was compiled by AI from multiple sources — links to the originals are below.
Kazakhstan has adopted a Cybersecurity Law and Digital Code that for the first time create a unified legal framework for protecting state and corporate digital systems. The legislation mandates employers to train staff in cybersecurity basics and requires annual security audits of critical digital assets.
Employer Training Mandate
Employers in Kazakhstan are now legally required to train employees in cybersecurity and cyberculture, according to Vice Minister of AI and Digital Development Doszhan Musaliyev. The obligation is enshrined in the Labor Code and applies to all organizations. State bodies, akimats, and critical infrastructure operators must conduct annual cybersecurity training.
Annual Audits and Biometric Access
Owners of critical digital objects must perform annual cybersecurity audits and submit reports to the Information Security Committee, a requirement not previously in law. Access to restricted databases containing medical, banking, or commercial data now requires mandatory biometric authentication of employees. The National Security Committee has taken over state control functions for critical facilities.
Breach Notification and Data Registry
Organizations must now notify both state authorities and affected individuals of personal data breaches. A registry of major personal data operators will be created, with additional security requirements. The law also defines a 'personal data identifier' as a combination of surname, first name, patronymic, individual identification number, facial image, and biometric vector.
What's Next
The new requirements take effect immediately, with implementation deadlines to be set by the government. It remains unclear how quickly employers and critical infrastructure operators will comply with the training and audit mandates.
2 sources
Kazakhstan mandates breach notification, cybersecurity audits under new law
