Despite the existence of specialized legislation on the protection of personal data in Kazakhstan, including the Law "On Personal Data and Their Protection", law enforcement practice remains underdeveloped and inconsistent. The absence of clear criteria for the legality of data processing, weak regulation of consent requirements, and insufficient public and business awareness lead to widespread violations of privacy rights. Significant issues arise particularly in the processing of data by small and medium-sized businesses, as well as in the interaction of citizens with public and private entities. To analyze the current state of legal regulation and judicial practice in Kazakhstan regarding personal data issues, to identify key gaps and inconsistencies between national legal norms and international standards, particularly the GDPR, and to propose directions for improving law enforcement practices and legislation. The study uses comparative legal, normative legal, empirical (case law analysis), and systematic approaches. A comparative analysis of Kazakhstan's national legislation and European legislation (including the GDPR) is conducted, with a focus on practical cases. It was found that there are no clear requirements in Kazakhstan regarding the form and content of data subject consent, and there is no effective mechanism to inform citizens about the purposes and methods of data processing. Significant discrepancies with international standards were identified, including in the principles of data minimization, purpose limitation, and transparency. The analyzed court cases demonstrate a low level of legal awareness among data controllers and weak implementation of supervisory functions by the authorized bodies. Recommendations are proposed for bringing national legislation in line with international norms, strengthening the institutional role of regulatory authorities, and fostering legal awareness among data subjects.