KazakhstanLaw on Cybersecurity, duties of owners and holders of critically important digital objects
Law of the Republic of Kazakhstan No. 418-V () "On Cybersecurity" (retitled from "On Informatization" by Law 256-VIII of 9… January 2026), Arts. 18, 49, 50 and 54
In force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to the owner or holder of a digital object listed as critically important, meaning a digital object whose failure would cause an emergency or significant harm to defense, security, the economy or the life of the population, including infrastructure for heat, electricity, gas and water supply, health, communications, banking and transport (Law Articles 1, 18 and 54; Digital Code Article 33); the duties start when the object is listed.
- Create your own cybersecurity centre and keep it running, or buy cybersecurity centre services from a third party in the scope the mandatory list of services sets (Article 18(1)(1)).
- Where the critically important object is a digital government object, connect its digital-event logging systems to the monitoring system of the National Cybersecurity Coordination Centre and to the unified logging platform (Article 18(1)(2)).
- Transfer backup copies of digital resources to the unified national backup platform in the order and time the authorized body sets (Article 18(1)(4)), and train your employees in cybersecurity and cyber culture each year (Article 18(1)(5)).
- If you process data that carries a legally protected secret, run a cybersecurity audit at least once a year (Article 18(2)); a second-tier bank's audit follows banking law. Send the audit results for a critically important object to the authorized body and the National Cybersecurity Coordination Centre (Article 50(3)).
- Submit the critically important object to the mandatory testing for compliance with cybersecurity requirements (Article 49(2)).
- Unless you are a state body, local self-government body, state legal entity or quasi-state entity, meet the cybersecurity parts of the unified digitalization and cybersecurity requirements and create your own cybersecurity centre or buy its services within six months of the object's listing (Article 54(5)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The authorized body in the sphere of ensuring cybersecurity, with the National Cybersecurity Coordination Centre monitoring critically important digital objects (Articles 18 and 54).
Settledness
- As of
What this law does
Law 256-VIII of retitled the Law on Informatization as the Law on Cybersecurity. Law 256-VIII was first officially published on . Law 256-VIII takes effect six months after its first official publication. The owner or holder of a critically important digital object must create its own cybersecurity centre or buy the services of a cybersecurity centre from third parties.
An owner or holder of critically important digital objects that processes data containing a legally protected secret must run a cybersecurity audit at least once a year. Critically important digital objects are among the objects subject to mandatory testing for compliance with cybersecurity requirements. An owner or holder of a critically important object, other than a state body, must within six months of listing take measures to meet the cybersecurity parts of the unified requirements.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.