Cybersecurity law & regulation in Kazakhstan (2026)

The Digital Code consolidates the Law on Informatization, the Law on Electronic Documents, and the Law on Electronic Digital Signature into a single unified instrument, mandating cybersecurity audits for critical infrastructure and high-risk AI systems, reinforcing data-localization rules, and establishing a 'Digital Sovereignty' principle ensuring state control over critical digital infrastructure. It is the most comprehensive digital regulatory overhaul in Kazakhstan's history.

The Senate approved the Digital Code, after the President instructed Parliament in September 2025 to fast-track the legislation; the Code introduces mandatory public disclosure of cybersecurity-audit results, criminal and administrative penalties for large-scale data breaches, and biometric SIM-card registration starting 2026 to combat telecom fraud.

Personal data of approximately 16.3 million residents, names, Individual Identification Numbers (IINs), addresses, phone numbers, and nationality details, were exposed from private (non-government) databases, affecting over three-quarters of the population. The government launched an investigation, detained over 140 suspects, seized 400-plus devices, and proposed raising the maximum fine for information-security violations to approximately US$42,500, while accelerating criminal-liability proposals for mass data leaks.

The law signed on 11 December 2023 took effect, requiring all data controllers to notify the Ministry of Digital Development of any personal data breach within one business day of discovery and explicitly mandating that personal data of Kazakhstani citizens be stored and processed on servers physically located inside Kazakhstan, the strictest enforcement of data localization to date.

Kazakhstan updated the criteria under which information and communication infrastructure objects are designated as Critical Information and Communication Infrastructure Facilities (CICIF), refining the scope of entities, spanning energy, finance, healthcare, transport, and government, subject to mandatory security assessments, vulnerability management, and incident notification.

Kazakhtelecom again instructed users to install the government-issued Qaznet Trust Certificate to enable state-level HTTPS decryption; the attempt failed because Mozilla, Google, and Apple had already hard-coded a block of the certificate in their browsers in August 2019, making the mandate technically ineffective for the majority of internet users.

All three major browser vendors simultaneously announced that Firefox, Chrome, and Safari would refuse the Kazakh government's national security certificate regardless of any manual user installation, neutralising the state's mass HTTPS-interception mandate and setting a landmark precedent for browser-enforced resistance to government surveillance certificates.

The government issued a two-stage implementation roadmap (Stage 1: 2017-2018; Stage 2: 2019-2022) for the national cybersecurity strategy, covering KZ-CERT capacity expansion, standards development for critical-infrastructure operators, public-sector penetration-testing requirements, and cybersecurity workforce training, helping Kazakhstan rise from 103rd to 31st in the ITU Global Cybersecurity Index by 2020.

Kazakhstan adopted its first standalone national cybersecurity strategy, defining state policy for protecting electronic information resources, information systems, and telecommunications networks, and formally institutionalising the KZ-CERT national computer emergency response team as the central coordination body for cyber-incident response.

Kazakhstan's core ICT and cybersecurity statute replaced the 2007 Law on Informatization and established binding obligations for all information-system operators: risk assessments, vulnerability management, mandatory cybersecurity audits, and incident reporting; it also required .KZ and .ҚАЗ domain websites to use SSL certificates and host infrastructure within Kazakhstan, creating the first statutory data-localisation obligation.

Kazakhstan enacted its primary personal data law establishing rules for collection, processing, and storage of personal data by public and private entities, classifying electronic databases containing personal data as confidential and limiting processing to declared purposes; it forms the cornerstone of the country's data-security framework and has been amended multiple times, most significantly in 2021 and 2023.