Abstract
This article examines the current state and development prospects of Kazakhstan’s personal data protection system through a comprehensive comparative legal analysis with the European Union’s General Data Protection Regulation (GDPR). The study identifies key deficiencies in Kazakhstan’s legal and institutional framework, particularly the limited scope of enforcement mechanisms and the inadequacy of administrative penalties in deterring violations. Emphasis is placed on the extraterritorial reach, strict compliance requirements, and high sanctions under the GDPR, which collectively contribute to its global influence. Drawing from case studies, expert policy reports, and regulatory practices, the article underscores the importance of strengthening legal accountability, enhancing state oversight functions, and establishing proactive enforcement capabilities. Special attention is given to the role of digital sovereignty and the integration of internationally recognized standards into Kazakhstan’s legislative environment. The analysis also highlights domestic corporate practices that are beginning to align with GDPR principles, using Air Astana as a pioneering example. The article concludes by offering concrete policy recommendations, including the introduction of mandatory breach notification procedures and legislative reform to empower supervisory authorities. These measures are essential for creating a more transparent, secure, and rights-based approach to personal data governance in Kazakhstan.