KazakhstanLaw on Cybersecurity, notice of cybersecurity incidents
Law of the Republic of Kazakhstan No. 418-V () "On Cybersecurity" (retitled from "On Informatization" by Law 256-VIII of 9… January 2026), Arts. 18(1)(3) and 54(2)
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to the owner or holder of a digital object listed as critically important, meaning a digital object whose failure would cause an emergency or significant harm to defense, security, the economy or the life of the population, including infrastructure for heat, electricity, gas and water supply, health, communications, banking and transport (Law Articles 1, 18 and 54; Digital Code Article 33); the duties start when the object is listed.
- Notify the National Cybersecurity Coordination Centre, and the cybersecurity centre your critically important objects are connected to, of the cybersecurity incidents you detect yourself, in the order and within the time set by the rules for monitoring the cybersecurity of digital government and critically important digital objects; the Law itself states no hour count (Article 18(1)(3)).
- If you own or hold digital government infrastructure objects or critically important digital objects, take measures that provide for immediately informing the National Cybersecurity Coordination Centre of a cybersecurity incident that has occurred, followed by digital data on the measures taken to resolve it; an owner of resources that hold state secrets is excepted (Article 54(2)(7)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Cybersecurity Coordination Centre receives the notices, under the authorized body in the sphere of ensuring cybersecurity (Articles 18 and 54).
Settledness
- As of
What this law does
The owner or holder of a critically important digital object must notify the National Cybersecurity Coordination Centre and its cybersecurity centre of cybersecurity incidents it detects itself, in the order and time the monitoring rules set. An owner or holder of digital government infrastructure or critically important digital objects must provide for immediately informing the National Cybersecurity Coordination Centre of an incident that has occurred, followed by data on the measures taken.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.