Kazakhstan is preparing to introduce a new type of mandatory insurance in the field of cybersecurity, reports Todayinfo. This initiative aims to protect personal data operators and digital assets of companies that handle large volumes of information.
Dmitry Mun, Vice-Minister of Artificial Intelligence and Digital Development, announced this on the sidelines of the international GITEX AI Kazakhstan forum.
“The key change will be the recognition of data as a digital asset. This means that company data will be considered an economic resource, requiring a methodology for its evaluation. Based on this assessment, the level of mandatory insurance premiums will be determined,” — explained the Vice-Minister.
Work on the methodology is being carried out jointly with authorized bodies in the field of data economics.
Following the completion of regulatory preparations, a mechanism will be introduced whereby companies with large data arrays will be obligated to insure against cyber risks. The amount of insurance payouts will depend on the volume and value of the information processed. Expenses for information security will become a mandatory part of the business model. Thus, the state aims to increase the level of personal data protection and reduce the risks of data leaks.
According to preliminary estimates, mandatory cyber insurance in Kazakhstan may not appear earlier than next year. This is due to the need for adopting accompanying legislative norms, passing all parliamentary procedures, and coordinating subordinate acts.
Special attention in the new Digital Code is paid to the digital rights of citizens. Specifically, concepts such as digital assets, rights to digital objects, and responsibility for their unlawful use are being considered. According to Dmitry Mun, accounts and passwords can be viewed as an object of protection, akin to property in the digital environment.
One of the key innovations could be the establishment of citizens' right to delete their data from digital services. This includes the ability to demand the deletion of information about oneself, appealing to court in case of refusal, and the obligation of state bodies to consider such requests. This refers to the development of the principle of so-called “digital oblivion.”
According to the ministry's forecasts, the main legislative and technical changes in this area may be finally adopted by early 2027.
