Abstract
This study aims to identify key issues affecting the effectiveness of legal responses to the unlawful circulation of personal data, in order to improve the corresponding enforcement tools. The analytical framework includes a comparative analysis of approaches in the United States, the European Union, and Kazakhstan, while also accounting for the global reason of the problem. The research findings indicate that, under the current conditions of rapid digitalization, traditional criminal law mechanisms for combating the unlawful circulation of personal data demonstrate limited effectiveness due to both regulatory and technological barriers. Among the primary challenges are: the lack of a unified definition of criminal acts involving the processing and dissemination of personal data; difficulties in proving criminal intent; and the blurred boundaries between administrative and criminal offenses. These issues are compounded by technological difficulties in detecting violations, as well as the cross-border nature of digital crimes, which constrain the jurisdiction of national criminal justice systems. Moreover, existing criminal law provisions are often not adapted to the new forms of data processing and circulation. The study proposes several recommendations for improving criminal law regulation in the Republic of Kazakhstan within the relevant legal domain.