Overview of Judicial Practice on Personal Data in Kazakhstan

Despite the existence of specialized legislation on the protection of personal data in
Kazakhstan, including the Law "On Personal Data and Their Protection", law enforcement practice
remains underdeveloped and inconsistent. The absence of clear criteria for the legality of data
processing, weak regulation of consent requirements, and insufficient public and business awareness
lead to widespread violations of privacy rights. Significant issues arise particularly in the processing of
data by small and medium-sized businesses, as well as in the interaction of citizens with public and
private entities.
To analyze the current state of legal regulation and judicial practice in Kazakhstan regarding
personal data issues, to identify key gaps and inconsistencies between national legal norms and
international standards, particularly the GDPR, and to propose directions for improving law
enforcement practices and legislation.
The study uses comparative legal, normative legal, empirical (case law analysis), and
systematic approaches. A comparative analysis of Kazakhstan's national legislation and European
legislation (including the GDPR) is conducted, with a focus on practical cases.
It was found that there are no clear requirements in Kazakhstan regarding the form and content
of data subject consent, and there is no effective mechanism to inform citizens about the purposes and
methods of data processing. Significant discrepancies with international standards were identified,
including in the principles of data minimization, purpose limitation, and transparency. The analyzed court cases demonstrate a low level of legal awareness among data controllers and weak
implementation of supervisory functions by the authorized bodies. Recommendations are proposed for
bringing national legislation in line with international norms, strengthening the institutional role of
regulatory authorities, and fostering legal awareness among data subjects.