Kazakhstan mandates new cybersecurity rules for employees and employers

Kazakhstan is introducing new cybersecurity regulations into its Labor Code, impacting both employees and employers. These amendments, set to take effect 60 days after the law's first official publication, specifically August 25, 2026, mandate adherence to cybersecurity requirements for all workers.

Under the new rules, employees will be required to follow their employer's internal policies concerning the secure use of digital systems, corporate services, and information protection. This adds to the existing obligations regarding occupational health and safety, fire safety, and industrial safety standards. The law clarifies that this involves following an employer's specific internal rules for cybersecurity.

Employers face a corresponding obligation to ensure their staff are informed about these cybersecurity requirements. This includes reviewing and updating internal documentation, such as cybersecurity policies, and establishing mechanisms for internal oversight and monitoring of compliance. While the law introduces these new mandates, it does not specify separate fines or new forms of liability for violations. Instead, any breaches will be addressed under existing legal norms.

“

To familiarize employees with the requirements of the employer's acts regarding compliance with cybersecurity requirements and to exercise internal control over their execution.