LexLint

Know the law where your app runs.

Law / Kazakhstan

Digital Code, general cybersecurity duty on digital-object owners and holders

Digital Code No. 255-VIII (9 January 2026), Arts. 20, 97-98

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force 70 days, effective 10 July 2026.

A security baseline statutes rule binding public and private bodies.

As of 18 September 2026.

What it requires

  • Protect the confidentiality, integrity and availability of every digital object you own or hold in Kazakhstan, a category that expressly includes software you make available to others.
  • Implement technical measures, including cryptographic protection where applicable, together with organizational and legal measures, aimed at preventing, detecting and eliminating cyber threats to that digital object.
  • Also follow the specific requirements set by the Law of the Republic of Kazakhstan "On Cybersecurity" and the unified digitalization and cybersecurity requirements adopted under it; their own specific duties are not further detailed here.

Who enforces it

Enforcement body

The authorized body in the sphere of ensuring cybersecurity, an office the Digital Code names by function rather than by institutional name.

Settledness

As of
18 September 2026
Open questions
What specific incident-reporting clock, threshold and audit cycle does the Law of the Republic of Kazakhstan "On Cybersecurity" set for a private digital-object holder that is not designated critically important?

What it reaches

Obligation class

Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 97 defines cybersecurity as the state of protection of a digital object, a category Article 20 defines to include software, digital systems, digital platforms and objects of digital infrastructure, against a breach of its confidentiality, integrity or availability, and assigns the duty to protect a digital object to its owner or holder.

Article 98 requires that protection through a combination of technical, organizational and legal measures aimed at preventing, detecting and eliminating cyber threats, naming cryptographic protection as one of the technical means. Article 97(3) directs the specific content of these measures to the Law of the Republic of Kazakhstan "On Cybersecurity" and to unified digitalization and cybersecurity requirements adopted under it, neither of which is further described here.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
  • serves_minors
  • operates_social_platform
  • ships_mobile_app
  • distributes_software_product

Read the law

Digital Code, official statute text, Adilet Legal Information System

Back to the example  ·  Lint your app