CIS regulations for tech companies: Kazakhstan, Uzbekistan, Kyrgyzstan, Belarus, Armenia and Azerbaijan

This is the third article in a series on what a technology company faces in different regions. The first two covered the UAE and the Gulf and Egypt; this one covers CIS regulations: Kazakhstan, Uzbekistan, Kyrgyzstan, Belarus, Armenia and Azerbaijan. Russia will get its own article. The five questions are the same: personal data, cybersecurity, financial regulators, e-invoicing and electronic signatures.

I have offices in Dubai and Almaty, so Kazakhstan gets more detail here. The frame is the same as in the earlier parts: primary sources only, meaning laws, codes, government resolutions and regulators’ acts on official portals (adilet, lex.uz, cbd.minjust.gov.kg, etalonline.by, arlis.am, e-qanun.az). Every fact was checked against the primary source, and the key ones again in an independent pass, as of late September 2026. I do not give legal opinions: the map shows which document to read, and how it applies to your company is for a lawyer in that country.

CIS regulations: what is shared and what differs

• 2026 rebuilt the base. Digital codes came into force in Kazakhstan and Kyrgyzstan, replacing their separate laws on electronic signatures and, largely, on informatization. Armenia introduced a cybersecurity law, Azerbaijan a new chapter on cyber incidents, and Uzbekistan narrowed data localisation.
• Localisation. A full duty to keep personal data in the country remains only in Kazakhstan. In Uzbekistan it is narrowed to biometric, genetic and telecom subscriber data; in Belarus it arises for online sales; Kyrgyzstan, Armenia and Azerbaijan have no general requirement.
• Transfers within the region. There is almost no mutual recognition: Uzbekistan’s list of adequate countries does not include Kazakhstan, Armenia’s includes none of the six countries covered here (Russia is the only EAEU member on it), and as of late September 2026 Kyrgyzstan’s regulator has not recognised any foreign country. Only Belarus recognises all EAEU members automatically.
• Cybersecurity is almost everywhere in the hands of security services or bodies under the president, and almost everywhere contractors face residency requirements. The exception is Armenia, whose model is closer to the European one.
• E-invoices in all six countries pass through a state system (in Uzbekistan via EDI operators and a state roaming operator), and a document counts as issued only once the system has accepted it. No legal act mentions Peppol.

Personal data

Country	Store in the country	Breach notification	Registration
Kazakhstan	All personal data	Regulator within 1 business day	Notice before processing starts (except small and medium operators; restricted-access data raises the category)
Uzbekistan	Biometric, genetic and telecom subscriber data	Only breaches during transfer abroad: 24 hours, details within 72	Only databases that must be stored in the country
Kyrgyzstan	No general requirement	Sector regulator within 72 hours	Register of record holders not launched as of late September 2026
Belarus	De facto for online sales	Regulator within 3 business days	Register of operators for large and sensitive systems
Armenia	No general requirement	Immediately: public statement, police and regulator	On the regulator’s request and before processing biometric or special-category data
Azerbaijan	No general requirement	Not in the data law	State registration of information systems, except HR and small ones

Kazakhstan. Since 25 August 2026, Law No. 94-V on personal data (amended by Law No. 326-VIII) expressly requires data to be kept “in a database and (or) digital object located in the territory of the Republic of Kazakhstan”. Electronic data sets are now called digital objects, and localisation covers them explicitly. From the same date a new Article 10-1 applies: the authorised body must be notified before processing starts and before it stops, and the notice states cross-border transfers and where the database is located. Small operators (up to 10,000 data subjects) and medium ones (up to 500,000) are exempt. But processing restricted-access data moves an operator up one category, so a medium operator counts as large and must notify. The law has no transition period, and as of late September I found no secondary act on the notice form. A breach is reported to the authorised body within one business day of discovery. The authorised body is the Ministry of Artificial Intelligence and Digital Development, while state control over private businesses sits with the akimats (local executive bodies). Under Article 79 of the Code of Administrative Offences, a large business that fails to apply protection measures is fined 600 MCI (KZT 2,595,000 at the 2026 MCI). If the failure led to loss or unlawful processing of data, the fine is 2,000 MCI (KZT 8,650,000).

Uzbekistan went the other way in 2026. Since 27 March 2026 (Law ZRU-1125), only biometric and genetic data and telecom operators’ subscriber data must be stored in the country; before that, localisation covered all citizens’ data. The rest can be stored abroad: in countries on the list of adequate jurisdictions (since 3 August 2026, 49 entries, including the EU, the UK and Russia, but not Kazakhstan, the UAE or mainland China), or under standard contractual clauses or binding corporate rules, or by complying with international standards on the regulator’s list. The regulator must approve requirements for these clauses within three months, that is, around early November 2026. The de facto regulator is the Department of Migration and Personalisation of the Interior Ministry. The law has no general duty to report a breach; it was introduced only for breaches during cross-border transfer.

Kyrgyzstan has regulated data through the Digital Code since 6 February 2026, and the 2008 law was repealed. The regulator is the State Agency for Personal Data Protection, which hears cases and fines on its own. Transfers abroad are formally free to countries on the regulator’s list, but as of late September 2026, only Kyrgyzstan itself has “adequate” status on the agency’s website, so any transfer currently relies on consent, a contract or contractual safeguards. An incident affecting data subjects’ rights is reported to the sector regulator within 72 hours. A person responsible for processing is required if the company has more than 10 employees.

Belarus. The law tasks the National Personal Data Protection Center with approving a list of countries with adequate protection, and the center’s order puts EAEU members and parties to Convention 108 on it. Transfers to other countries are allowed only under exceptions or with the center’s permission. The center is notified of a breach immediately, and no later than three business days. Belarusian companies selling online in Belarus must use resources hosted in the country (Decree No. 60), so for e-commerce localisation applies de facto. The fine for a legal entity that fails to apply protection measures is up to 50 base units, or BYN 2,250.

Armenia requires that a breach from electronic systems be followed at once by a public statement, together with a report to the police and the regulator. Without permission, data can go to 53 countries on the regulator’s list; none of the six countries covered here is on it, and Russia is the only EAEU member on it. Contract-based transfers to countries outside the list need permission (decided within 30 days), and the law allows the data subject’s consent as a separate basis. Encryption is expressly mandatory, and the fine for not using it is 100 statutory units of AMD 1,000, that is AMD 100,000.

Azerbaijan requires state registration of information systems holding personal data; without it, collection and processing are not allowed. Exempt are systems with employee data, state secrets and cases below thresholds set by the government. Registration takes a month, separately for each system, and with electronic filing, the decision takes effect once originals or notarised copies are submitted. There is no general localisation requirement. Transfers abroad are prohibited if they threaten national security, and also if protection in the recipient country is lower. The second ban is lifted by the individual’s consent or where the transfer is needed to protect their life and health; the first is not. The data law has no duty to report a breach.

Cybersecurity

Country	Supervisor	Incident reporting	What matters to a contractor
Kazakhstan	Ministry of AI and Digital Development; critical objects controlled by the KNB	15 minutes for owners of critical objects	SOC must be a resident with no foreign participation, licensed
Uzbekistan	SGB	Immediately, no hours set	Contractors operating CII become subjects themselves
Kyrgyzstan	GKNB	GKNB: no hours under the law; sector regulator: 72 hours under the Digital Code	CII contractors approved by the authority, data in the country
Belarus	OAC	Cybersecurity centres: 1 hour	Contractors for OAC basic requirements must be Belarusian residents
Armenia	Information Systems Regulatory Commission	Within 24 hours	ISO/IEC 27001 for CII and providers, document due by January 2028
Azerbaijan	DTX for CII; National Agency for the rest	As soon as discovered	CII provider: founders must be citizens of Azerbaijan

Kazakhstan. Since 12 July 2026 the Law on Informatization has been renamed the Law on Cybersecurity, and the Digital Code has come into force. The authorised body is the Ministry of AI and Digital Development, and state control over critical digital objects has passed to the National Security Committee (KNB). The owner of such an object must have its own security operations centre (SOC) or buy SOC services, and report an incident to the National Coordination Center and the SOC within 15 minutes of confirmation. The SOC must be a Kazakhstan resident with no foreign participation and work under a licence. Private systems that integrate with state ones follow unified requirements: software and hardware are hosted in the country. For state systems themselves, cloud is allowed only if its control centres and servers are in Kazakhstan. Since late August 2026, hosting providers also have specific duties to work with the coordination center.

Uzbekistan. The 2022 Cybersecurity Law names the State Security Service (SGB) as the authorised body. As of late September 2026, amendments to the law have passed the lower house and are awaiting the Senate. A key detail for contractors: critical infrastructure subjects include not only the owners of objects but also legal entities that operate them. They follow SGB requirements and report incidents immediately. Security tools for government bodies and critical infrastructure must be certified. Under the strategy’s roadmap, a draft of the requirements for cloud services for government systems is due in December 2026.

Kyrgyzstan. Government Resolution No. 250 of April 2026 set strict rules for IT contractors of critical infrastructure: organisations for development and support may be engaged only with the cybersecurity authority’s approval, software and hardware are hosted in the country, and direct remote vendor access is banned; access goes only through intermediate systems that record sessions.

Belarus. There is no separate law; the system rests on Decree No. 40 and acts of the Operational and Analytical Center (OAC). Since 1 July 2026 the OAC’s basic cybersecurity requirements have applied, including installing updates within a month and keeping event logs for at least a year, and only Belarusian legal entities and sole traders may be contractors for this work. Cybersecurity centres report to the National Cybersecurity Center within an hour. Private IT and hosting companies on the Council of Ministers’ list must set up such a centre or buy its services by December 2027.

Armenia has had a cybersecurity law since 4 January 2026, and it is the closest to the European model. It covers companies in 14 vital sectors, including finance, telecom and IT infrastructure, cloud included; micro and small enterprises are excluded unless they operate critical infrastructure. A significant incident is reported within 24 hours, with an update after 72 hours and a final report after a month. Critical infrastructure must meet ISO/IEC 27001, card processing PCI DSS, and personal data ISO/IEC 27701; SOC providers must also confirm ISO/IEC 20000-1, and ISO/IEC 27035-1 and 27035-2 on incident management are recommended to them as guidance. Operators and providers must submit the conformity document by January 2028. Fines are already in the Code of Administrative Offences: up to AMD 10 million (10,000 statutory units of AMD 1,000) for failing to meet the minimum requirements, although the Commission has not yet approved those requirements. The government plans to adopt the criteria and list of critical infrastructure in November and December 2026.

Azerbaijan. Since 10 August 2026, information infrastructure subjects outside CII and the state sector, including private companies and website owners, must report cyber incidents to the National CERT as soon as they are discovered. Fines for this will apply from 1 July 2027. For critical infrastructure, supervision sits with the State Security Service (DTX), and its cybersecurity provider can only be a company whose founders and representative are citizens of Azerbaijan.

Financial regulators

Everywhere the requirements are written by the central bank or financial regulator. They are addressed to banks and payment companies and reach a contractor through the contract. The hardest points to know in advance:

• Kazakhstan. New ARDFM requirements have applied since April 2026. A bank’s primary and backup data centres are in the country, bank secrecy and personal data in the cloud are stored only encrypted, and the bank holds the key. The bank reports listed incidents and vulnerabilities reachable from outside the perimeter within 24 hours. Source code of remote banking software is kept inside the bank’s perimeter, and a contractor’s developers have no administrative access to production.
• Uzbekistan. Banks may not outsource management of ICT and security systems, servers sit in banks, the central bank’s cloud, state data centres, or third-party data centres with ISO/IEC 27001, SOC 2 and Tier III/IV, and bank employees may access its systems remotely only from inside Uzbekistan. A contractor with a team abroad should check in advance whether the bank applies this rule to it as well.
• Kyrgyzstan. Payment information is stored in the country; if an information security incident takes remote banking down for more than 30 minutes, the bank reports to the National Bank within an hour.
• Belarus. Critical functions are not outsourced, outsourcing to residents of offshore zones is banned, and the bank reports material threats within five business days. The bank must assess even support of licensed software as a risk.
• Armenia. Outsourcing operations, expressly including IT system support, needs the central bank’s consent, or the deal is void; the central bank answers within 30 days, and silence means consent. Bank penetration tests are done only by a CREST International member.
• Azerbaijan. Sensitive data stay only in the country, two processing centres sit in non-adjacent economic regions, the cloud provider may not subcontract, and the bank reports a high-category incident within 4 hours.

E-invoicing

Country	Who is obliged	How it works
Kazakhstan	VAT payers and some non-payers	Tax authority’s IS ESF, web or API, signed with an EDS
Uzbekistan	Legal entities, sole traders, self-employed from 2026	Through EDI operators of the taxpayer’s choice and a roaming operator
Kyrgyzstan	VAT payers, others by resolution	State IS ESF, user profile or API
Belarus	VAT payers	Tax ministry’s ESCHF portal, XML or web service
Armenia	Organisations, sole traders, notaries	Tax authority’s settlement document system in real time
Azerbaijan	Everyone bar listed exceptions, when selling to registered taxpayers (B2B and B2G)	Tax service portal, enhanced signature

The common trait: a document exists only once the state system has accepted it. In Kazakhstan a new Tax Code and invoicing rules have applied since 1 January 2026; an invoice is issued in the IS ESF no later than 15 calendar days after the transaction, and for some payers automatic control is on, where a number is assigned only if the invoice’s VAT is covered by the balance on the tax account. In Uzbekistan every invoice has been risk-scored in real time since 2026, and for high-risk ones VAT is credited only after it is paid to the budget. In Belarus a summary ESCHF for sales to individuals is issued for each reporting period (a month or a quarter). In Armenia since 1 September 2026 settlement documents are issued before goods are delivered, and electronic cash registers expand from 2027. In Azerbaijan the product code and GTIN are mandatory on an invoice, and a missing mandatory invoice is fined from 10% of the sale price.

For Kazakhstan, Kyrgyzstan, Belarus and Armenia as EAEU members, traceability of imported goods has worked on a permanent basis since 1 September 2026; in Kazakhstan it runs through the same IS ESF.

Electronic signatures

A foreign signature is almost nowhere recognised on its own. It needs the foreign certification authority to be registered with the national trusted third party service, local accreditation or an international treaty, and few links between such services actually work: only Belarus’s agreements with Kazakhstan and Russia are confirmed. None of the six countries has a separate document like Russia’s machine-readable power of attorney: a signer’s authority is handled through the certificate or a verification service, and in Belarus through an attribute certificate.

• Kazakhstan. Since 12 July 2026 signatures have been governed by the Digital Code, and the 2003 law has lapsed. There is one EDS, with no levels; codes, push and biometrics count as “digital confirmation” and are not a signature. A foreign certification authority is recognised if it is registered with Kazakhstan’s trusted third party service, and a non-state authority needs at least two years of continuous operation to register. Cloud EDS is allowed, and a non-resident with a residence permit can get keys remotely.
• Uzbekistan. One category of EDS; in e-commerce, SMS and Face ID are also recognised as a signature. A company with a foreign share of 30% or more may not set up a key registration centre. Since January 2026 representatives of foreign companies working in the country can get a certificate without a consulate, on a state body’s request and with the Tax Committee’s permission.
• Kyrgyzstan. Since February 2026 the Digital Code has two types of signature, non-qualified and qualified. A foreign signature is recognised as the type whose features it meets, but as of late September 2026 the trusted third party service’s procedure could not be found in the official database.
• Belarus. Certificates of the state system are mandatory in all state systems. A signer’s authority is confirmed by an attribute certificate. A new OAC regulation on the system has applied since 7 July 2026.
• Armenia. One category of EDS; the 2025 accreditation procedure follows eIDAS but requires the systems to be hosted in the country. Foreign certificates are equated with Armenian ones only under a ratified treaty.
• Azerbaijan. An enhanced signature with a qualified certificate has the force of a handwritten one. Non-residents get a signature through consulates, and the cloud biometric SİMA signature already has more than 4 million users, according to the government’s 2026–2028 action plan.

Calendar

• 01.11.2026: in Uzbekistan, advertising calls and SMS only after the systems are registered in the register of personal databases.
• Around 03.11.2026: in Uzbekistan, requirements for contractual clauses for transfers abroad are expected.
• November and December 2026: in Armenia, the government’s schedule calls for the criteria and list of critical infrastructure.
• 31.12.2026: in Belarus, non-state cybersecurity centres and their contracts are brought in line with the new OAC requirements.
• 01.07.2027: in Azerbaijan, fines for not reporting cyber incidents start to apply.
• Around 04.01.2028: in Armenia, critical infrastructure operators and providers submit a document on compliance with the standard.
• No date announced: secondary acts on notice and protection measures in Kazakhstan, launch of the register of record holders in Kyrgyzstan, the trusted third party service’s procedure in Kyrgyzstan.

Where a tech company should start

1. For Kazakhstan, keep data in the country. This covers all personal data, and since late August 2026 large operators (and medium ones that process restricted-access data) must also notify the regulator.
2. Do not count on free transfers within the CIS. Neighbours’ lists of adequate countries barely overlap, so the transfer scheme from each country has to be built separately.
3. Check residency requirements. SOCs in Kazakhstan, contractors in Belarus, CII providers in Azerbaijan and bank staff’s remote access in Uzbekistan depend on local registration or territory.
4. For financial customers, plan for local infrastructure. Banks in Kazakhstan, Uzbekistan and Azerbaijan keep data centres in the country, and a contractor has to fit that.
5. Integrate with the tax platform directly. Everywhere except Uzbekistan, an invoice goes straight into the tax authority’s state system with no operators: via an API, a web service or a file upload.

What I do not do

• I do not give legal opinions. The map shows documents and articles; how they apply to a specific company is for a lawyer in that country to judge.
• I do not retell reviews. Every fact is checked against the text of the law or act on the official portal.
• I do not promise the map will not age. Many secondary acts in the region are still in progress; reread it before you decide anything.

Frequently asked questions

Do personal data have to be stored in Kazakhstan?

Yes. Since 25 August 2026 the personal data law expressly requires them to be kept in a database or digital object in the territory of Kazakhstan. Transfers abroad are possible under the rules of Article 16, but storage must be in the country.

What changed with localisation in Uzbekistan?

Since 27 March 2026 only biometric and genetic data and telecom operators’ subscriber data must be stored in the country. The rest can be stored abroad in countries on the list of adequate jurisdictions, under contractual clauses, or by complying with international standards on the regulator’s list. The regulator is due to approve the requirements for contractual clauses by around 3 November 2026.

Can data move freely between CIS countries?

Hardly. Uzbekistan’s list of adequate countries does not include Kazakhstan, Armenia’s includes none of the six countries covered here (Russia is the only EAEU member on it), and as of late September 2026 Kyrgyzstan’s regulator has not recognised any foreign country. Only Belarus recognises EAEU members automatically.

Are foreign electronic signatures recognised?

On their own, almost nowhere. The foreign certification authority must be registered with the national trusted third party service, locally accredited, or covered by an international treaty. Working links are confirmed only between Belarus and Kazakhstan and Russia.

Is Peppol needed for e-invoicing in the CIS?

No. In all six countries e-invoices pass through a state system, and the acts do not mention Peppol. Uzbekistan uses EDI operators of the taxpayer’s choice and a roaming operator; in the other countries integration is direct with the tax system.

Sources

• Law of the Republic of Kazakhstan No. 94-V on Personal Data, adilet.zan.kz.
• Law of the Republic of Kazakhstan No. 326-VIII (personal data amendments), adilet.zan.kz.
• Law of the Republic of Kazakhstan on Cybersecurity (formerly on Informatization), adilet.zan.kz.
• Digital Code of the Republic of Kazakhstan No. 255-VIII, adilet.zan.kz.
• Uzbekistan Law ZRU-547 on Personal Data, lex.uz.
• Uzbekistan Law ZRU-1125 amending the Personal Data Law, lex.uz.
• Uzbekistan Law ZRU-764 on Cybersecurity, lex.uz.
• Kyrgyzstan Law No. 121 on Cybersecurity, Centralized Legal Information Database.
• Digital Code of the Kyrgyz Republic No. 178, Centralized Legal Information Database.
• Kyrgyzstan cybersecurity requirements for CII objects (Cabinet Resolution No. 250), Centralized Legal Information Database.
• Belarus Law No. 99-Z on Personal Data Protection, etalonline.by.
• Decree of the President of Belarus No. 40 on Cybersecurity, etalonline.by.
• Armenia Law on Personal Data Protection, ARLIS.
• Armenia Law on Cybersecurity, ARLIS.
• Azerbaijan Law No. 998-IIIQ on Personal Data, e-qanun.az.

Need a consultation?

If you are entering Kazakhstan, Uzbekistan or other countries of the region, book a call. We will work out where your data should live, which requirements will reach you through your customers and how they fit your architecture.