Is a lender, in Kazakhstan

Law of the Republic of Kazakhstan No. 418-V (24 November 2015) "On Cybersecurity" (retitled from "On Informatization" by Law 256-VIII of 9 January 2026), Arts. 18(1)(3) and 54(2) · Read the law's page

• Applies to the owner or holder of a digital object listed as critically important, meaning a digital object whose failure would cause an emergency or significant harm to defense, security, the economy or the life of the population, including infrastructure for heat, electricity, gas and water supply, health, communications, banking and transport (Law Articles 1, 18 and 54; Digital Code Article 33); the duties start when the object is listed.
• Notify the National Cybersecurity Coordination Centre, and the cybersecurity centre your critically important objects are connected to, of the cybersecurity incidents you detect yourself, in the order and within the time set by the rules for monitoring the cybersecurity of digital government and critically important digital objects; the Law itself states no hour count (Article 18(1)(3)).
• If you own or hold digital government infrastructure objects or critically important digital objects, take measures that provide for immediately informing the National Cybersecurity Coordination Centre of a cybersecurity incident that has occurred, followed by digital data on the measures taken to resolve it; an owner of resources that hold state secrets is excepted (Article 54(2)(7)).

Law of the Republic of Kazakhstan No. 418-V (24 November 2015) "On Cybersecurity" (retitled from "On Informatization" by Law 256-VIII of 9 January 2026), Arts. 18, 49, 50 and 54 · Read the law's page

• Create your own cybersecurity centre and keep it running, or buy cybersecurity centre services from a third party in the scope the mandatory list of services sets (Article 18(1)(1)).
• Where the critically important object is a digital government object, connect its digital-event logging systems to the monitoring system of the National Cybersecurity Coordination Centre and to the unified logging platform (Article 18(1)(2)).
• Transfer backup copies of digital resources to the unified national backup platform in the order and time the authorized body sets (Article 18(1)(4)), and train your employees in cybersecurity and cyber culture each year (Article 18(1)(5)).
• If you process data that carries a legally protected secret, run a cybersecurity audit at least once a year (Article 18(2)); a second-tier bank's audit follows banking law. Send the audit results for a critically important object to the authorized body and the National Cybersecurity Coordination Centre (Article 50(3)).
• Submit the critically important object to the mandatory testing for compliance with cybersecurity requirements (Article 49(2)).
• Unless you are a state body, local self-government body, state legal entity or quasi-state entity, meet the cybersecurity parts of the unified digitalization and cybersecurity requirements and create your own cybersecurity centre or buy its services within six months of the object's listing (Article 54(5)).
• Applies to the owner or holder of a digital object listed as critically important, meaning a digital object whose failure would cause an emergency or significant harm to defense, security, the economy or the life of the population, including infrastructure for heat, electricity, gas and water supply, health, communications, banking and transport (Law Articles 1, 18 and 54; Digital Code Article 33); the duties start when the object is listed.

Law of the Republic of Kazakhstan on Credit Bureaus and Formation of Credit Histories No. 573 (6 July 2004), Arts. 17, 21 and 22 · Read the law's page

• A credit bureau must give the subject of a credit history a credit report about the subject once in a calendar year free of charge, and free information about the subject's own credit scoring, and must give a credit report to a recipient only on confirmation of the subject's consent, except in the case Article 25(4) provides.
• A credit bureau must submit a corrected credit report to the recipient and to the subject within five calendar days of detecting that a report it gave out differed from what the information providers sent it, and on the subject's application must name the information provider that supplied contested information.
• An information provider must consider a subject's application to correct unreliable information, which Article 22(7) allows the subject to make.

Law of the Republic of Kazakhstan on Credit Bureaus and Formation of Credit Histories No. 573 (6 July 2004), Arts. 6(3), 8, 8-1, 11 and 17(1)(3) · Read the law's page

• A credit bureau may operate only with the permission of the authorized body, and a credit bureau with state participation is the exception (Article 8-1(4) and (5); Article 6(3)).
• Provide technical premises and certified hardware and software for the credit history database, and a secondary server located outside the city where the credit bureau is located, for backup copies of the information (Article 8).
• Prevent disclosure of information contained in credit histories, including information constituting bank secrecy, except in the cases the Law states (Article 17(1)(3)).
• Notify the authorized body of the measures taken under its written instruction within the time the instruction sets, a credit bureau being open to the sanctions of an administrative fine and suspension of permission validity (Article 11(1-3) and (2)).