Institutional and legal mechanisms for personal data protection within ai usage in Kazakhstan: a comparative legal analysis with the European model

This article provides a comprehensive analysis of institutional and legal mechanisms for protecting personal data in the context of artificial intelligence (AI) usage in Kazakhstan, compared with the European regulatory framework. Special attention is given to the EU General Data Protection Regulation (GDPR) and the AI Act. The relevance of the study is justified by Kazakhstan’s large-scale digital transformation and national AI strategies. The study aims to identify legal gaps and conflicts between innovation incentives in AI and privacy guarantees. Methodologically, it employs formal-legal, comparative-legal, and institutional approaches. The key regulatory acts of the Republic of Kazakhstan governing relations in the field of personal data protection, digitalization, and artificial intelligence were analyzed, along with the current strategic documents. Particular attention was paid to the interrelationship between the legal regulation of personal data, digital technologies, and artificial intelligence. It is found that Kazakhstan is actively aligning with European standards, introducing a risk-based approach to AI regulation with bans on discriminatory algorithms. However, gaps are identified: insufficient attention to prior risk assessments, limited institutional oversight, and underdeveloped rights to explanations for automated decisions. The findings are relevant for improving Kazakhstan’s regulatory framework on digital sovereignty, AI, and data protection.

1. Konstitucija Respubliki Kazahstan: prinjata na respublikanskom referendume 15 marta 2026 goda // IPS «Adilet». 2026. URL: https://adilet.zan.kz/rus/docs/K2600000000 (data obrashhenija: 04.09.2026) (In Russian)

2. Zakon Respubliki Kazahstan «O personal’nyh dannyh i ih zashhite» ot 21 maja 2013 goda No. 94-V // IPS «Әdіlet». 2026. URL: https://adilet.zan.kz/rus/docs/Z1300000094 (data obrashhenija: 13.07.2026) (In Russian)

3. Cifrovoj kodeks Respubliki Kazahstan: Kodeks Respubliki Kazahstan ot 9 janvarja 2026 goda No. 255-VIII ZRK // IPS «Adilet». 2026. URL: https://adilet.zan.kz/rus/docs/K2600000255 (data obrashhenija: 04.09.2026) (In Russian)

4. Ob utverzhdenii Koncepcii kiberbezopasnosti («Kibershhit Kazahstana»): postanovlenie Pravitel’stva Respubliki Kazahstan ot 30 ijunja 2017 goda No. 407 // IPS «Әdіlet». 2026. URL: https://adilet.zan.kz/rus/docs/P1700000407 (data obrashhenija: 13.07.2026) (In Russian)

5. Ob utverzhdenii Koncepcii razvitija iskusstvennogo intellekta na 2024–2029 gody: postanovlenie Pravitel’stva Respubliki Kazahstan ot 24 ijulja 2024 goda No. 592 // IPS «Әdіlet». 2026. URL: https://adilet.zan.kz/rus/docs/P2400000592 (data obrashhenija: 13.07.2026) (In Russian)

6. Ministerstvo iskusstvennogo intellekta i cifrovogo razvitija Respubliki Kazahstan: oficial’nyj sajt. URL: https://www.gov.kz/memleket/entities/maidd?lang=ru (data obrashhenija: 13.07.2026) (In Russian)

7. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) // Official Journal of the European Union. 2016. L 119. P. 1–88. URL: https://eur-lex.europa.eu/eli/reg/2016/679/oj (accessed: 13.07.2026) (In English)

8. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) // Official Journal of the European Union. 2024. OJ L, 2024/1689. URL: https://eur-lex.europa.eu/eli/reg/2024/1689/oj (accessed: 13.07.2026) (In English)

9. European Data Protection Board (2020) Guidelines 4/2019 on Article 25 Data Protection by Design and by Default. Version 2.0. Brussels. URL: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-42019-article-25-data-protection-design-and_en (accessed: 13.07.2026) (In English)

10. Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. CETS No. 223. Strasbourg, 2018. URL: https://www.coe.int/en/web/conventions/fulllist?module=treaty-detail&treatynum=223 (accessed: 13.07.2026) (In English)

11. Andraško J., Mesarčík M., Hamuľák O. (2021) The regulatory intersections between artificial intelligence, data protection and cyber security: challenges and opportunities for the EU legal framework // AI & Society. Vol. 36. No. 2. P. 623–636. (In English)

12. Hacker P. (2023)Alegal framework forAI training data: from first principlesto theArtificial Intelligence Act // Law, Innovation and Technology. Vol. 15. No. 2. P. 257–301. (In English)

13. Wachter S., Mittelstadt B., Russell C. (2021) Why fairness cannot be automated: bridging the gap between EU non-discrimination law and AI // Computer Law & Security Review. Vol. 41. Article 105567. (In English)

14. Kaminski M.E., Malgieri G. (2021) Algorithmic impact assessments under the GDPR: producing multilayered explanations // International Data Privacy Law. Vol. 11. No. 2. P. 125–144. (In English)

15. Smuha N.A. (2021) From a “race to AI” to a “race to AI regulation”: regulatory competition for artificial intelligence // Law, Innovation and Technology. Vol. 13. No. 1. P. 57–84. (In English)

16. Veale M., Zuiderveen Borgesius F. (2021) Demystifying the Draft EU Artificial Intelligence Act: analysing the good, the bad, and the unclear elements of the proposed approach // Computer Law Review International. Vol. 22. No. 4. P. 97–112. (In English)

17. Binns R. (2022) Human judgment in algorithmic loops: individual justice and automated decisionmaking // Regulation & Governance. Vol. 16. No. 1. P. 197–211. (In English)

18. Adams-Prassl J., Binns R., Kelly-Lyth A. (2023) Directly discriminatory algorithms // The Modern Law Review. Vol. 86. No. 1. P. 144–175. (In English)

19. Almada M., Petit N. (2024) The EU AI Act: between product safety and fundamental rights // Common Market Law Review. Vol. 61. No. 3. P. 655–696. (In English)

20. Mantelero A. (2024) The Fundamental Rights Impact Assessment in the AI Act: roots, legal obligations and key elements for a model template // Computer Law & Security Review. Vol. 54. Article 105980. (In English)

21. Novelli C., Taddeo M., Floridi L. (2024) Accountability in artificial intelligence: what it is and how it works // AI & Society. Vol. 39. P. 1871–1882. (In English)

22. Casarosa F. (2022) Cybersecurity certification of Artificial Intelligence: a missed opportunity to coordinate between the Artificial Intelligence Act and the Cybersecurity Act // International Cybersecurity Law Review. Vol. 3. P. 5–32. (In English)

23. Peukert C., Bechtold S., Batikas M., Kretschmer T. (2022) Regulatory export and spillovers: how GDPR affects global markets for data // Management Science. Vol. 68. No. 4. P. 3186–3204. (In English)

24. Laux J., Wachter S., Mittelstadt B. (2024) Trustworthy artificial intelligence and the European Union AI Act: on the conflation of trustworthiness and acceptability of risk // Regulation & Governance. Vol. 18. No. 1. P. 3–32. (In English)

25. Judgment of the Court of Justice of the European Union of 7 December 2023, OQ v Land Hessen, Case C-634/21, ECLI:EU:C:2023:957. URL: https://curia.europa.eu/juris/liste.jsf?num=C-634/21 (accessed: 13.07.2026) (In English)

26. Judgment of the Court of Justice of the European Union of 16 July 2020, Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems, Case C-311/18, ECLI:EU:C:2020:559. URL: https://curia.europa.eu/juris/liste.jsf?num=C-311/18 (accessed: 13.07.2026) (In English)

27. Umitchinova B.A., Gavrilova Ju.A., Menzjuk G.A. (2025) Pravovoe regulirovanie personal’nyh dannyh v uslovijah razvitija iskusstvennogo intellekta: zarubezhnyj opyt i vyzovy dlja Kazahstana // Vestnik Instituta zakonodatel’stva i pravovoj informacii Respubliki Kazahstan. No. 3 (80). P. 37–53. DOI: 10.52026/2788-5291_2025_80_3_37 (In Russian)

28. Kusainova A.K. (2026) Problemy pravovogo regulirovanija i perspektivy sovershenstvovanija zakonodatel’stva Respubliki Kazahstan v sfere zashhity personal’nyh dannyh // Veritas Legis Journal. V. 2. No. 2. DOI: 10.62687/VLJ.2.2.2026.50 (In Russian)