Handles health records, in Kazakhstan

Code of the Republic of Kazakhstan on Public Health and Healthcare System No. 360-VI (7 July 2020), Art. 273 · Read the law's page

• An app or service that holds personal medical data, information on a person's seeking of medical advice, state of health or diagnosis obtained during examination or treatment must treat it as secrecy of a medical worker and must not disclose it, where the data became known to the app's staff in training, in professional duties or in other official obligations.
• Disclose that data for research or use in teaching only with the informed consent of the patient or the patient's legal representative, and otherwise only in a case Article 273(4) lists, such as a request from the bodies of inquiry and preliminary investigation, the prosecutor or a court in an investigation or judicial proceeding.
• Do not connect an electronic information resource that holds personal medical data to a telecommunication network linking it to other databases without the consent of the natural persons concerned, except in the cases Article 273(6) lists.

Law of the Republic of Kazakhstan No. 418-V (24 November 2015) "On Cybersecurity" (retitled from "On Informatization" by Law 256-VIII of 9 January 2026), Arts. 18(1)(3) and 54(2) · Read the law's page

• Applies to the owner or holder of a digital object listed as critically important, meaning a digital object whose failure would cause an emergency or significant harm to defense, security, the economy or the life of the population, including infrastructure for heat, electricity, gas and water supply, health, communications, banking and transport (Law Articles 1, 18 and 54; Digital Code Article 33); the duties start when the object is listed.
• Notify the National Cybersecurity Coordination Centre, and the cybersecurity centre your critically important objects are connected to, of the cybersecurity incidents you detect yourself, in the order and within the time set by the rules for monitoring the cybersecurity of digital government and critically important digital objects; the Law itself states no hour count (Article 18(1)(3)).
• If you own or hold digital government infrastructure objects or critically important digital objects, take measures that provide for immediately informing the National Cybersecurity Coordination Centre of a cybersecurity incident that has occurred, followed by digital data on the measures taken to resolve it; an owner of resources that hold state secrets is excepted (Article 54(2)(7)).

Law of the Republic of Kazakhstan No. 418-V (24 November 2015) "On Cybersecurity" (retitled from "On Informatization" by Law 256-VIII of 9 January 2026), Arts. 18, 49, 50 and 54 · Read the law's page

• Create your own cybersecurity centre and keep it running, or buy cybersecurity centre services from a third party in the scope the mandatory list of services sets (Article 18(1)(1)).
• Where the critically important object is a digital government object, connect its digital-event logging systems to the monitoring system of the National Cybersecurity Coordination Centre and to the unified logging platform (Article 18(1)(2)).
• Transfer backup copies of digital resources to the unified national backup platform in the order and time the authorized body sets (Article 18(1)(4)), and train your employees in cybersecurity and cyber culture each year (Article 18(1)(5)).
• If you process data that carries a legally protected secret, run a cybersecurity audit at least once a year (Article 18(2)); a second-tier bank's audit follows banking law. Send the audit results for a critically important object to the authorized body and the National Cybersecurity Coordination Centre (Article 50(3)).
• Submit the critically important object to the mandatory testing for compliance with cybersecurity requirements (Article 49(2)).
• Unless you are a state body, local self-government body, state legal entity or quasi-state entity, meet the cybersecurity parts of the unified digitalization and cybersecurity requirements and create your own cybersecurity centre or buy its services within six months of the object's listing (Article 54(5)).
• Applies to the owner or holder of a digital object listed as critically important, meaning a digital object whose failure would cause an emergency or significant harm to defense, security, the economy or the life of the population, including infrastructure for heat, electricity, gas and water supply, health, communications, banking and transport (Law Articles 1, 18 and 54; Digital Code Article 33); the duties start when the object is listed.