Kazakhstan adopts Digital Code, cybersecurity law to bolster data protection
This digest was compiled by AI from multiple sources — links to the originals are below.
Kazakhstan has adopted a Digital Code and a specialized cybersecurity law, establishing a unified legal framework for protecting state infrastructure and digital systems. The legislation introduces mandatory biometric authentication for accessing restricted databases and requires annual security audits for critical digital asset owners.
New Legal Framework
Kazakhstan has enacted the Digital Code and the Law on Cybersecurity, creating a unified legal basis for protecting state infrastructure and digital systems, according to Profit.kz. The legislation introduces obligations for employers and employees to comply with cyberculture requirements, while civil servants and critical infrastructure workers must undergo annual training. Owners of key digital assets are now required to conduct annual security audits.
Data Protection Measures
The law enshrines the principle of personal data protection at the constitutional level. It mandates biometric authentication for accessing restricted databases, including medical, banking, or commercial secrets. Organizations must now officially notify both authorities and citizens about data breaches and the start of data processing. The legislation also introduces the concept of a personal data identifier, comprising full name, individual identification number, image, and biometric vector.
Enforcement and Compliance
Since 2024, the Ministry has conducted nearly 650 inspections, revealing a lack of basic information security tools and policies in major companies, small businesses, beauty salons, fitness centers, and internet platforms. Vice Minister for Artificial Intelligence and Digital Development Doszhan Musaliyev noted that most incidents stem from human factors and failure to follow digital hygiene principles, not complex system breaches.
What's Next
The new laws are now in effect, with enforcement expected to intensify. It remains unclear how quickly businesses and government agencies will adapt to the mandatory annual audits and biometric authentication requirements.
5 sources
Kazakhstan adopts Digital Code, cybersecurity law to bolster data protection
