KazakhstanPenal Code, unauthorized access to information
Penal Code No. 226-V (), Art. 205
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not intentionally access legally protected information on an electronic medium without authorization where doing so causes significant harm; the offence is not confined to defeating a technical access control.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A fine of up to 160 monthly calculation indices, correctional labour of the same amount, public works up to 160 hours, or arrest up to 40 days for the base offence (Art. 205(1)); up to 2,000 monthly calculation indices or imprisonment up to 2 years where the act causes grave consequences through negligence (Art. 205(3)).
What it makes you log
Logging duty
Article 205(1) makes intentional unauthorized access to legally protected information on an electronic medium, causing significant harm, a criminal offence. It imposes no duty to create, keep, produce or review a log or record. The Code's general territorial articles are not invoked by this article, so no hook is read from it.
- Kind
- None
- As of
What this law does
Article 205(1) punishes intentional unauthorized access to legally protected information held on an electronic medium, at an informatization object, that causes significant harm, with a fine up to 160 monthly calculation indices, correctional labour of the same amount, public works up to 160 hours, or arrest up to 40 days, plus an optional bar of up to 2 years from holding certain positions or engaging in certain activities.
Article 205(2) raises the penalty where the target is critically important information and communication infrastructure, and Article 205(3) raises it further where the act, under either paragraph, causes grave consequences through negligence, reaching a fine up to 2,000 monthly calculation indices or imprisonment up to 2 years.
The offence's trigger is unauthorized access to protected information causing significant harm; the text read does not require defeating a technical security measure, so it reaches unauthorized access more broadly than a security-circumvention-only standard would. The article's heading was reworded by Law No. 210-VIII ().
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .