The Digital Code of the Republic of Kazakhstan has entered into force: an overview of key provisions where your product may not meet the new requirements

Previously, Chingis Oralbaev explained why startups lose money due to basic legal errors. You can read the first column via this link.

Chingis Oralbaev, LL.M., Managing Partner of SOLIS Partners LLP, Member of the Chamber of Legal Consultants of the Republic of Kazakhstan

I am approached with the same question: “The Code is framework-based, and secondary legislation has not yet been adopted—there is no rush.” This logic is familiar. But it is mistaken.

The Digital Code of the Republic of Kazakhstan No. 255-VIII enters into force on 09.07.2026. It contains 106 articles, but most of them concern state bodies. Therefore, I will not recount its structure. Instead, I will tell you about six changes that affect your product right now.

1. Scoring without explaining the reasons for refusal is no longer valid — Article 43

Scoring refusal, anti-fraud blocking, automated resume screening. Previously, you could get away with simply responding “application rejected.” Now, you cannot.

The Code introduces the concept of a fully automated decision—one made without human involvement in assessing circumstances or approving the result. The subject of such a decision gains three rights:

— to know about the fact of using an algorithmic system;
— to receive an explanation of the key factors and criteria that influenced the decision, without disclosing the algorithms, source code, or legally protected secrets;
— to demand a review of the decision with the participation of an authorized specialist if it entails legal consequences or affects rights and legitimate interests.

What this might mean for your team. Wherever a model makes a decision about a person, two mechanisms are required: generating a human-readable justification and an escalation route to a specialist. The requirement is directed at the system, not the document: justification and escalation must function, not just be described.

I believe this primarily affects: fintech and credit scoring, anti-fraud, insurance underwriting, and HR-tech with automated selection.

2. The client will learn about the leak of their personal data not from you — Articles 74, 97-99

The strategy of “first we figure it out internally, then we decide whether to notify customers” no longer works. And it is not just about the deadlines for notifying users.

The Code introduces a second, independent notification channel. The “digital government” operator, based on information from the authorized body, notifies subjects about a security breach of their personal data—via a personal account on the web portal, mobile application, or SMS.

3. An SMS code is not a signature, even if you thought so — Articles 47 and 49

Digital confirmation is an action after authentication: a code, password, one-time identifier, push notification, or biometric confirmation. Paragraph 4 explicitly states: such confirmation is not a signature using an Electronic Digital Signature (EDS) and does not ensure the authenticity and integrity of the content of the digital record.

An EDS is equated to a handwritten signature only if four conditions are met simultaneously:

— the authenticity of the signature is confirmed by a public key having a certificate;
— the signatory lawfully possesses the private key;
— the signature is used in accordance with the information in the certificate;
— the certificate was issued by an accredited certification center in the Republic of Kazakhstan or a foreign certification center registered with a trusted third party in the Republic of Kazakhstan.

This is not a ban on SMS. However, now an opponent in a dispute has a clear basis to challenge the evidentiary value of SMS confirmation—primarily for contracts and financial instructions.

A practical approach is differentiation. Break down user actions by the level of legal risk: authorization and simple operations—digital confirmation; transactions and instructions—EDS. I think many projects should conduct a review of their onboarding and legally significant screens in their user flows.

5. Norms that may change document flow in your project.

Employee’s EDS = signature + seal. If, according to regulatory legal acts, a legal entity’s document must be certified with a seal, an electronic document with an employee’s EDS, who has the right to sign, is recognized as equivalent to a paper document with a handwritten signature and seal. The dispute “send the original with a wet seal” is closed.

Auto-signing is not for contracts. An EDS for a digital object is introduced: the system signs identical documents itself. But only those that do not contain an expression of will to establish, change, or terminate civil rights and obligations. Receipts, statements, notifications—yes. Contracts—no.

EDS is not issued to persons under 16. Not reaching the age of sixteen is an independent ground for refusing to issue a public key certificate. Onboarding persons under 16 may require a separate scenario if your system allows entry only via EDS.

6. Data can be sold—but not any data and not anywhere—Articles 30-31

The Code introduces the product of digital data—an aggregated, formalized result of data processing. Such a product can be the subject of transactions, alienation, and transfer on terms determined by the owner. Anonymized analytics can now be legally packaged and sold through platforms for the exchange and turnover of digital data products. Such platforms can also be created by private business.

But this is a supervised market, not a free-for-all. Paragraph 9 of Article 31 explicitly prohibits platform owners from:

— trading in original/unprocessed data, including personal data, unless otherwise provided by law;
— placing or storing data products outside the territory of the Republic of Kazakhstan, if this is restricted;
— transferring data products to third parties without the consent of their owner.

The “right to be forgotten” is not a “delete all” button. Article 41 gives the right to demand the deletion, anonymization, or restriction of the processing of personal data. But paragraphs 3 and 4 contain strict exceptions that are rarely read.

If the law obliges you to store data—you do not delete it, but restrict access and suspend processing. And you do not even do this when processing based on a court decision that has entered into legal force, for fulfilling obligations under the law or contract, or for archival storage.

The requirement is not subject to execution at all if the data is needed to protect the life, health, and rights of third parties, for considering cases of offenses, for justice, for public interest directly established by laws, for state statistics and scientific research under the condition of anonymization, for implementing state functions and providing state services.

The cost of non-compliance. Under the current Code of the Republic of Kazakhstan on Administrative Offenses, liability is provided for by Article 79. The maximum fine for failure to comply with protection measures, resulting in the loss or illegal collection or processing of data, is:
— for large business—2000 MRP;
— for medium business—1,000 MRP;
— for small business—750 MRP.
With the MRP of 2026 being 4,325 tenge, the ceiling for large business is 8,650,000 tenge.

Regulator’s signal: tested on banks, will reach everyone. The Resolution of the Board of the National Bank of the Republic of Kazakhstan dated 20.04.2026 No. 81 “On Approval of Minimum Requirements for Ensuring Information Security in the Financial Market” enters into force on 12.07.2026. It contains a norm that the Kazakhstani regulator had not previously formulated directly: the head of a financial organization bears personal responsibility for information security. Responsibility has shifted from the company to a specific individual.

The material is of a general informational nature as of 12.07.2026 and does not constitute legal advice. Applying the cited norms to specific circumstances requires separate analysis.