Law on the Protection of Personal Data, localization and cross-border transfer

Art. 14, read in context, establishes a domestic-database default: storage of personal data in a database located exclusively in Tajikistan is carried out by the possessor, operator, and third party, except in cases agreed with the authorized state body for personal data protection, a regulator-approval escape valve rather than an absolute rule or an enumerated exception list.

Art. 18, "Cross-border transfer of personal data" (confirmed by a reviewer pass reading its own clean heading, resolving the research pass's approximate attribution), permits transfer to a state ensuring adequate protection under this Law, and permits transfer to a state that does not on any of four grounds: subject or legal-representative consent; an international treaty Tajikistan recognizes; statutory necessity for the constitutional order, public order, human and civil rights, health and morals, or national defense and security; or protection of constitutional rights where consent cannot be obtained, the same four-ground structure found in Kazakhstan and Uzbekistan.

Transfer generally may also be prohibited or restricted for the same constitutional-order, morals, health, rights, defense, or security reasons, the same reservation clause found across this batch. The two provisions answer different questions: a default in-country database with a regulator-approved exception, plus a separately conditioned general transfer regime.

Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.