What the Digital Code changed.
Code No. 255-VIII of 9 January 2026 came into force on 11 July 2026. The accompanying Law No. 256-VIII of the same date amended existing legislation. Below are the provisions that most often affect organisations.
This material is for reference only. Where it differs from the text of the legal act, follow the primary source at adilet.zan.kz.
What was replaced with what
The replacements are mandatory in organisational documents: policies, procedures, contracts and internal instructions.
Unchanged: the digital signature and everything around it, email, electronic media, an electronic document signed with a digital signature (Art. 64), a digital document (Art. 65). Official titles of standards and laws in force are also kept verbatim.
Nine articles worth reading
Expand an item to see what the provision says and whom it affects.
Article 41 — the right to erasure and restriction of processing
A person may demand erasure, anonymisation or restriction of the processing of their personal data — the so-called right to digital oblivion. It does not apply where processing is required by a court decision, to perform a contract, for archival storage, in the public interest or when providing government services.
Who it affects: all personal data operators.
Article 43 — no more silent algorithmic refusals
If a decision was made automatically, the person may learn its logic, receive an explanation and demand human review. A refusal without explanation is no longer permitted.
Who it affects: fintech, lending, insurance, HR-tech and any service that uses scoring.
Articles 96–99 — the cybersecurity framework and breach notification
They set the general cybersecurity requirements. Breach notification deadlines are measured in hours, not days; the details are fixed in secondary legislation.
What to do: write the response procedure in advance — during an incident there will be no time to compose it.
Articles 47 and 49 — a digital signature and a “digital confirmation” are not the same
A qualified digital signature and a “digital confirmation” (SMS, push notification, one-time code) are now separate. The latter is not a signature and does not carry the same legal effect.
Article 49 allows automatic digital signing of a digital object but prohibits it for documents that establish or alter civil rights and obligations.
Who it affects: onboarding, electronic document management.
Article 61 — the signature of an authorised employee
The digital signature of an authorised employee is equivalent to a paper document bearing the organisation’s seal.
Who it affects: contract work.
Article 74 — who notifies the individual of a breach
In addition to the operator, the data subject is also notified by the “digital government” operator — through the personal account, the mobile app or SMS.
Articles 76–77 — the data access log
A citizen can see the log of access to their data in the “digital space”: who requested information and when.
Who it affects: organisations integrated with government digital systems.
Article 80 — the “digital government” payment gateway
Banks and payment organisations must integrate with the “digital government” payment gateway.
Who it affects: the financial sector.
Articles 30–31 and 21 — data exchange and identification records
Articles 30–31 introduce a platform for exchanging digital data products: anonymised analytics may be sold, raw and personal data may not. Storage outside Kazakhstan is restricted.
Article 21 expressly states that identification records are not objects of civil circulation.
The Comprehensive Cybersecurity Plan
Approved on 6 May 2026. It sets the priorities for protecting the country’s digital systems and digital infrastructure for three years.
Protection of critical digital assets
Development of national cybersecurity standards
Training of specialist personnel
Migration to post-quantum cryptography
The fifth area is improving the incident response system. The full text of the document is being prepared for publication.