At the beginning of 2026, the country established a new fundamental document for the digital sphere: Kassym-Jomart Tokayev signed the Digital Code of the Republic of Kazakhstan. This was reported by the Akorda press service, which clarified that the text of the Code is being published in the press.
In effect, this is an attempt to bring together in a single “framework” what was previously scattered across different norms and departmental rules: digital data, platforms, digital identification, cybersecurity and human digital rights. Media explanations of the law emphasize that the document should set more transparent and uniform rules of the game for the digital market — from public services to private services.
What exactly the Digital Code establishes
According to descriptions in open sources, the document includes several large thematic blocks.
1) Digital rights and control over personal data.
International reports on the adoption of the Code specifically noted that citizens are granted the right to delete, anonymize and restrict the processing of their personal data. This is presented as part of a course toward strengthening digital rights and clearer control over how data is used in the digital environment.
In practice, this logic is already visible in related services. For example, explanations for the public emphasize that if an organization requests data unrelated to the provision of a service, a person has the right to refuse. And if the data has already been provided, consent can be withdrawn via the eGov portal and the eGov Mobile app using personal data access control services.
2) Digital identification and biometrics.
A separate layer is the rules for digital/biometric authentication and digital data identifiers. This matters not only for public services but also for banks, fintech and any services that require identity verification and fraud protection.
3) Uniform definitions for digital objects and relations.
English-language reviews of the Code say that it describes digital objects (data, digital assets, digital resources, software, platforms, etc.) and establishes the rights and obligations of participants in the digital environment. This sounds “legally dry”, but for the market it usually means fewer gray areas: it is easier to explain what exactly a product/object of regulation is, where responsibility begins and what the requirements for data security/storage are.
4) Rules for the digital state and the platform model.
The topic of “government digital” is one of the key ones here: the Code lays the legal foundations for digital governance and the digitalization of government bodies. Earlier, the president specifically stressed that the document should not be adopted in a hurry precisely because of its scale — it affects the economy, education, healthcare and public administration.
What this means for ordinary people
Translated from legal language into plain language, the most noticeable effect is a stronger focus on “who accessed my data and why”. A review of the changes noted that the new approaches include mechanisms allowing a citizen to see who accessed their personal data, how often and for what purpose — with notifications via eGov Mobile.
Accessibility is emphasized separately: digital public services should be convenient and usable, including for people with disabilities and on simple devices — reviews call this principle one of the pillars of the new regulation.
What changes for business and the IT market
For companies, two consequences matter most.
First — “data rules are becoming stricter and clearer”.
Whereas regulation used to be “fragmented” (personal data in one place, industry requirements in another, security in a third), the course now is toward a single framework of requirements and responsibility. This usually raises process requirements: storage, access, consents, activity logging, security and anti-fraud.
Second — “the market wants predictability for AI and automation”.
Discussions of the Code specifically voice the thesis that systematic regulation of data, algorithms and automated systems should make AI development more predictable and legally protected, which means reducing the risk that implementation will “break” not because of technology but because of legal uncertainty.
Context: 2026 has been declared the Year of Digitalization and AI
The Digital Code was signed against the backdrop of a broader state agenda: by a separate decree, 2026 was declared the Year of Digitalization and Artificial Intelligence. The document is published on the official website, dated January 6, 2026, and signed in Astana.