Institutional and legal mechanisms for personal data protection within ai usage in Kazakhstan: a comparative legal analysis with the European model

Abstract

This article provides a comprehensive analysis of institutional and legal mechanisms for protecting personal data in the context of artificial intelligence (AI) usage in Kazakhstan, compared with the European regulatory framework. Special attention is given to the EU General Data Protection Regulation (GDPR) and the AI Act. The relevance of the study is justified by Kazakhstan’s large-scale digital transformation and national AI strategies. The study aims to identify legal gaps and conflicts between innovation incentives in AI and privacy guarantees. Methodologically, it employs formal-legal, comparative-legal, and institutional approaches. The key regulatory acts of the Republic of Kazakhstan governing relations in the field of personal data protection, digitalization, and artificial intelligence were analyzed, along with the current strategic documents. Particular attention was paid to the interrelationship between the legal regulation of personal data, digital technologies, and artificial intelligence. It is found that Kazakhstan is actively aligning with European standards, introducing a risk-based approach to AI regulation with bans on discriminatory algorithms. However, gaps are identified: insufficient attention to prior risk assessments, limited institutional oversight, and underdeveloped rights to explanations for automated decisions. The findings are relevant for improving Kazakhstan’s regulatory framework on digital sovereignty, AI, and data protection.