The Senate of Kazakhstan has approved a draft law which may substantially change the current legal framework for work with personal data (PD). 

The draft law proposes to change the definition of critically significant objects of informational-communicational infrastructure (CSOICI, КВОИКИ in Russian) in a manner that would allow for the classification of any information systems and servers that store PD of limited access as CSOICI. 

What does it mean? 

Any private company retaining PD on its website or server (located in Kazakhstan) may fall within the CSOICI regulation, which stipulates some burdensome requirements. Among others, these requirements include:

• The creation and functioning of an “information security operation center”, or obligation to procure services of such centers from third-party providers¹.
• Transferring companies’ backup copies of databases to authorized bodies².
• Conducting an annual audit of information security³.
• Notifying the authorized body of “cybersecurity incidents,” i.e. of any data breaches and malfunctioning of websites/⁴.
• A prohibition on using intercorporate communications applications for work correspondence if the servers of such applications are not located in Kazakhstan⁵. This may prohibit use of most popular applications, such as Outlook, Zoom, Teams and Skype, for CSOICI owners⁶.

Thus, authorized bodies would have legitimate grounds to classify any company that retains PD of limited access on its websites/servers as CSOICI once the law becomes effective. This may entail significant disbursements for business, as full compliance with the above requirements will require large financial investments, equipment procurement, employee hirings and other adverse consequences. 

If you have any questions about this alert, please contact us. We will keep you informed of the progress of this new law.

1. Article 17.2-1 (1) of the Law of the Republic of Kazakhstan No. 418-V “On Informatization” dated 24 November 2015 (the Informatization Law) ↩
2. Article 17.2-1 (4) of the Informatization Law ↩
3. Article 17.4 of the Informatization Law ↩
4. Article 17.2-1 (3) of the Informatization Law ↩
5. Paragraph 128.5 of the RK’s Government’s Decree No. 832 dated 20 December 2016 ↩
6. Starting from 1 July 2022, CSOICI owners are able to use such applications only for communication with foreign legal entities and individuals (RK’s Government’s Decree No. 383 dated 10 June 2022) ↩