Personal Data Protection in Kazakhstan's AI Enabled Public Services

Abstract

Public-sector artificial intelligence can influence access to services, inspections, eligibility, and other exercises of public authority, yet compliance cannot be demonstrated by citing legal safeguards or listing technical controls alone. This study develops the Kazakhstan AI Privacy and Accountability Governance Framework (KZ-AIPAG) to connect each legal requirement and public-service use case to a defined risk, control, evidence artefact, accountable actor, and lifecycle decision. The research combines normative legal analysis, a targeted structured literature review, comparative analysis of the Canadian Algorithmic Impact Assessment, the EU AI Act, General Data Protection Regulation Articles 22 and 35, and an end-to-end algorithmic-audit model, together with bounded applications to Smart Data Ukimet and eGov AI. The results show that Kazakhstan's principal gap is operational rather than a complete absence of regulation. KZ-AIPAG separates four use-case impact tiers from probability-by-impact hazard scoring, organises controls across six governance domains, and introduces an evidence chain, four decision gates, a unified role catalogue, and a RACI matrix that preserves audit independence. In the illustrative Smart Data Ukimet case, the framework yields a conditional no-go decision until the legal basis, data purpose, linkage and re-identification risk, access model, meaningful human review, and control-effectiveness evidence are documented. The framework is a proposed and analytically demonstrated instrument, not an empirically validated one. Its scientific contribution is a Kazakhstan-specific compliance-by-evidence model that makes accountability testable at service level; independent expert validation and operational pilots remain necessary.