Law note · Tajikistan
Law on the Protection of Personal Data, enforcement
What it requires
- An app processing Tajikistani personal data should confirm which body currently exercises the authorized state body's powers under Arts. 6-7, since the Act itself delegates that designation to a presidential act rather than naming the body. No penalty schedule or private right of action was confirmed in the Act itself.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
What we found
Art. 6, read in full, gives the President of Tajikistan the power to determine the authorized state body for personal data protection and approve its regulation; the Act does not itself name that body.
Art. 7 gives that still-undesignated body real powers if and when named: implementing state policy, drafting regulations for presidential approval, approving data categories and protection procedures, hearing complaints, and identifying responsible persons and taking measures to hold them liable, with no fine schedule stated. No private right of action was found in the Act itself.
A 2 July 2021 decree by the Communication Service under the Government of Tajikistan on personal-data protection procedures was reported, not read at primary source, as a possible sign of the Communication Service's operative role; that was not confirmed against a primary designation, and fine figures reported in secondary sources, which read unevenly (a higher maximum for individuals than for legal entities), were not verified here.
Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.