Amendments to the Labor Code of the Republic of Kazakhstan will come into effect on August 25, 2026, introducing new cybersecurity obligations for both employees and employers.
What's changing?
Employers are now required to comply with cybersecurity requirements along with occupational health and safety, fire safety, and industrial safety requirements.
Employers, including non-profit organizations (NGOs, public associations, foundations, and other organizations), are required to:
- familiarize employees with local regulations on cybersecurity;
- organize internal monitoring of compliance with these requirements. Why is this important for NGOs?
Even small nonprofits handle the personal data of employees, volunteers, beneficiaries, and donors, and use email, cloud services, and messaging apps. Therefore, having basic cybersecurity rules is not only good practice but also a work obligation. What is recommended to do before the changes come into effect?
Non-profit organizations should:
- Check whether they have internal information or cybersecurity regulations;
- Approve a local regulation (policy, regulation, or instruction), if necessary;
- Familiarize employees with the document by signature or electronically;
- Determine a course of action upon detection of suspicious emails, data leaks, or other cyber incidents.