Privacy Risks and Data Protection Readiness in AI Marketing in Kazakhstan

Abstract

Artificial intelligence (AI) is entering the marketing practice of Kazakhstani companies at the same time as the national legal framework for personal data and AI is being tightened: the Law on Personal Data and Their Protection was amended in 2025–2026, the Law on Artificial Intelligence entered into force on 18 January 2026, and the Digital Code on 12 July 2026. No empirical evidence exists on whether businesses that intend to use AI in marketing understand the privacy and security obligations this creates. This study provides a baseline measurement of that readiness taken immediately before the Law on Artificial Intelligence entered into force. An anonymous online survey of 41 representatives of Kazakhstani companies and startups (15 items: 8 closed, 6 five-point Likert items, 1 open-ended question answered by 24 respondents) was analysed by descriptive statistics and thematic analysis, and respondents' perceptions were mapped onto the obligations of the three legal instruments. The results show a readiness–compliance gap: 80.5% of respondents regard AI integration as a condition of competitiveness, 87.8% intend to use AI tools in marketing and 95.1% already use consumer AI applications; 70.7% agree that AI creates significant risks for customer data, yet the risks they name (AI-enabled phishing and data theft, system failures, attacks on AI infrastructure, privacy violation, manipulation) are framed as external threats, and no respondent referred to the company's own obligations as an operator of personal data. Data security appears in 10 of 24 open-ended responses, but only 2 refer to legal requirements. The mapping shows that none of eight obligation groups is reflected in respondents' perceptions and that routine use of foreign generative AI services with customer data most directly exposes the localisation and cross-border transfer requirements. The scientific novelty of the work lies in the first empirical, obligation-level reading of business perception against Kazakhstan's three-instrument framework; the resulting mapping can serve as a compliance checklist for AI marketing, and a supplementary survey module is proposed for subsequent waves.