PROSPECTS FOR THE IMPLEMENTATION OF THE GENERAL DATA PROTECTION REGULATION (GDPR) REQUIREMENTS INTO THE LEGISLATION OF KAZAKHSTAN

Abstract

The right to privacy is one of the fundamental human and civil rights. It is enshrined in international legal instruments and the Constitution of the Republic of Kazakhstan. In the modern era of digital technology development, issues related to the regulation and implementation of this right have gained particular relevance. This article examines the legal acts that establish personal data protection regulations in the European Union and explores the prospects for their implementation in Kazakhstani legislation, as well as the law enforcement practice in this area. The authors analyze the peculiarities of personal data collection, processing, and retention periods in Kazakhstan through the lens of GDPR requirements. A comparative analysis of the current situation regarding personal data protection in the legislation of the EU and Kazakhstan is conducted, based on which recommendations for improving legislative norms are proposed. The study identifies gaps in the legal regulation of personal data protection in both the EU and Kazakhstan. The authors determine that both GDPR requirements and the norms of Kazakhstan’s legislation on personal data protection lack explicit provisions regarding data retention periods. However, in the case of GDPR, there is established case law that compensates for legislative uncertainty, whereas for Kazakhstan's legal system, such a gap may lead to negative consequences. The analysis of personal data protection issues is based on real court cases. The authors emphasize that aligning Kazakhstan’s legislative framework with European regulatory practices could enhance the protection of Kazakhstani citizens in matters related to their right to privacy.