Under Art. 9 of Law No. 18-VIII on Online Platforms and Online Advertising, owners of online platforms with average daily access exceeding 100,000 users located in Kazakhstan during a month must appoint a legal representative to interact with the authorised body. Owners and legal representatives must respond to government requests within 24 hours, comply with final court decisions and relevant instructions from public authorities, and take measures against illegal content. Under Art. 24, failure to comply with Art. 9 may result in the platform’s activities being restricted in Kazakhstan.

In July 2019, the government introduced the Qaznet Trust Certificate under the Law on Communications, a machine-in-the-middle (MITM) technology that enables it to monitor users’ online activities. The certificate requires every internet user in the country to install a backdoor, allowing the government to conduct surveillance. This allows the government to conduct a so-called “man-in-the-middle” attack, which allows the government to intercept every secure connection in the country and see web browsing history, usernames and passwords, and even secure and HTTPS-encrypted traffic.
KazakhTelecom, the country’s largest telecommunications company, has said that citizens are “obliged” to install a “national security certificate” on every device, including desktops and mobile devices.
It is reported that the commentators and experts inside the country and abroad almost unanimously consider the certificate a government-initiated technology for the interception of encrypted user traffic via MITM attacks. Some of the 37 websites that University of Michigan researchers identified as targets of the certificate included Facebook, Gmail, Instagram, Mail.ru, OK, Twitter, VK, and YouTube, suggesting that its purpose was to “surveil users on social networking and communication sites.”
On 21 August 2019, Mozilla and Google simultaneously announced that their Firefox and Chrome web browsers would not accept the government-issued certificate, even if installed manually by users. Later, Apple announced that it would make similar changes to its Safari browser and that the certificate would not be installed. After this, the requirement for the installation of the certificate was postponed.
While required, the certificate appeared to affect a fraction of connections passing through the country’s largest ISP, Kazakhtelecom. This means that some, but not all, of the Kazakh Internet population was affected.
In December 2020, Kazakhstan once again tried to enforce the installation of the certificate. However, the enforcement once again halted after the protest of the major internet browsers. Although not enforced, the provisions for mandatory installation of the certificate remain in Kazakhstan's regulations.

The Law on Protection of Consumer Rights provides a general consumer-protection framework applicable to online transactions. Under Art. 2-1(4-1), consumers engaging in electronic commerce must receive a level of protection no lower than that provided in other forms of trade. Arts. 24, 25 and 30 establish specific information requirements concerning online payments, product characteristics, prices and delivery conditions. In addition, Art. 33-1 requires electronic trading platforms to maintain internal procedures against seller misconduct and false information and to operate through secure communication channels. These provisions were introduced by Law No. 241-VI in April 2019.

A basic legal framework on intermediary liability for copyright infringement is absent in Kazakhstan's law and jurisprudence. However, the Agreement on Enhanced Partnership between the EU and the Republic of Kazakhstan, signed in March 2016, provides a safe harbour to European companies under several conditions. According to the agreement, an information intermediary is not liable, for example, if it does not initiate the transfer, if the end-user always takes the initiative, if it does not choose the recipient of the transfer if it does not choose or change the information contained in the transfer if it complies with the conditions of access to information, observes rules for updating information, does not interfere with the lawful use of generally recognised technologies, immediately deletes information or stops access to it, after receiving a notice.

Kazakhstan has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Kazakhstan's law and jurisprudence. However, the Agreement on Enhanced Partnership between the EU and the Republic of Kazakhstan, signed in March 2016, provides a safe harbour to European companies under several conditions. According to the agreement, an information intermediary is not liable, for example, if it does not initiate the transfer, if the end-user always takes the initiative, if it does not choose the recipient of the transfer, if it does not choose or change the information contained in the transfer if it complies with the conditions of access to information, observes rules for updating information, does not interfere with the lawful use of generally recognised technologies, immediately deletes information or stops access to it, after receiving a notice.

Kazakhstan has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

As per the requirements of the Law on Amendments and Additions to Certain Legislative Acts of the Republic of Kazakhstan on Information and Communications (2017), users have been required to identify themselves using government-issued digital signature technology or SMS verification in order to comment on domestic websites. Failure to enforce the rule after April 2018 can lead to fines. The law requires website operators to make it mandatory for users to enter into a formal agreement before they are permitted to post comments on local websites. The information provided in the agreement needs to be retained by the website and handed over to the authorities whenever asked.

Kazakhstan has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

Under Art. 54(3-1) of Law No. 418-V of 24 November 2015 “On Informatization”, software and electronic industry products procured as goods or information and communication services under public procurement and procurement by certain quasi-state entities must be acquired from the Register of Trusted Software and Electronic Industry Products. Procurement outside the Register is permitted where the required product is unavailable.
The "Rules for the Formation and Maintenance of a Register of Trusted Software and Electronics Industry Products, as well as Criteria for Including Software and Electronics Industry Products in the Register of Trusted Software and Electronics Industry Products" previously required software to meet a minimum in-country value share of 70%, including under para. 10(3) of the version restated by Order No. 354/НҚ, published in October 2022. Order No. 829/НҚ, published in December 2024, subsequently reintroduced the localisation requirement, increasing the minimum share to 80% and requiring compliance to be evidenced through an industrial certificate in 2025. Order No. 567/НҚ, published in November 2025, maintained the 80% threshold but abolished the industrial-certificate requirement with effect from January 2026.

Kazakhstan does not require functional separation of telecommunications operators with significant market power. Accounting separation is nevertheless applied to telecommunications entities providing regulated natural-monopoly services. Under Sections 3, 4 and 7 of the "Rules for Conducting Separate Accounting of Income, Costs and Involved Assets by Subjects of Natural Monopolies in the Field of Telecommunications and Universal Postal Services approved by Order No. 121, these entities must maintain separate accounts for income, costs and assets for each regulated service and submit the corresponding reports to the competent authority. The obligation is linked to regulated natural-monopoly services rather than to a general SMP framework.

It is reported that, although Kazakhstan’s legal framework formally provides equal treatment for foreign and domestic investors, foreign businesses continue to face practical barriers in the market. Government contracts and procurement processes are reported to favour domestic firms in practice, while foreign companies may encounter difficulties related to licensing, taxation, and legal disputes due to bureaucratic hurdles and inconsistent regulatory enforcement.
It is further reported that practical challenges arise in accessing public tenders, particularly because of the structure and operation of Kazakhstan’s electronic procurement system.

Under Art. 17 of Law No. 567-II on Communications, licensing of activities in the communications sector is governed by the legislation on permits and notifications. Art. 20(2) of Law No. 202-V on Permits and Notifications provides that foreign applicants obtain permits on the same terms as Kazakhstani citizens and legal entities, unless otherwise provided by law or an international treaty. Item 12 of Appendix 1 requires a non-transferable Class 1 licence for long-distance and international telephone services, mobile satellite communications and cellular communications. Following Law No. 86-VIII, published in May 2024, this requirement also covers satellite communications using non-geostationary satellites. Therefore, the general licensing regime does not establish differentiated treatment based on nationality.
However, it is reported that telecommunications companies are required to purchase and install equipment related to the state’s System for Operational Investigative Measures (SORM) and to cover costs related to the database of International Mobile Equipment Identity (IMEI) codes and to pay regular fees to the State Radio Frequency Service, which is the IMEI database operator. These obligations may deter new players from entering the market.

Kazakhstan is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA). However, the country has been an observer of the WTO GPA since 2016.

Kazakhstan has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.