The rapid development of Big Data and artificial intelligence technologies is transforming traditional approaches to the legal regulation of data processing. In the context of digital ecosystems, the classical model of personal data protection no longer covers the entire information lifecycle, including the preparation of training datasets, algorithmic processing, the use of synthetic data, and the functioning of artificial intelligence systems. The article examines the specific features of the formation of the national data governance regulatory model in the Republic of Kazakhstan and compares it with the risk-based approach of the European Union enshrined in the EU AI Act. The study substantiates that the modern legal regime for data should be constructed as a comprehensive regulatory system encompassing objective, subjective, procedural, and institutional levels. An original integrated model of the legal regime for data is proposed, based on the differentiation between personal data, training datasets, synthetic data, and the results of algorithmic processing. It is concluded that there is a need to establish special procedures for auditing high-risk AI systems, assessing their impact on human rights, and implementing mechanisms of algorithmic transparency. The practical significance of the study lies in the development of proposals for improving the legislation of the Republic of Kazakhstan in the field of artificial intelligence and data circulation.