Tajikistan

Law on the Protection of Personal Data, biometric personal data

Art. 17, read in full, requires the subject's written consent to process biometric personal data for identification purposes, except in connection with criminal prosecution, administration of justice, enforcement of judicial acts, or defense, security, counter-terrorism, extremism, corruption, and money-laundering matters.

The Art. 1 definition is general, with no illustrative list naming face, voice, or fingerprint: personal data determining the physiological and biological features of the subject. Art. 11 defers biometric confidentiality specifically to unnamed other Tajik legislation, the same deferral pattern this batch also finds word for word in Kazakhstan's Art. 11(3) and Turkmenistan's Art. 7(7).

This corrects the corpus seed, which carried sensitive_biometric_restriction as false; a dedicated, consent-gated biometric article does exist. Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Law on the Protection of Personal Data, comprehensive regime

Law No. 1537 binds the possessor (обладатель), operator (оператор), and third party (третье лицо) generally, terms not confined to private actors.

Art. 8 requires the subject's consent, or their legal representative's, for collection and processing, subject to Art. 9's exceptions, not read article by article for this document; processing must be limited to specific, predetermined, lawful purposes, proportionate and accurate, with the subject notified of data collected about them and given a correction right. Art. 3 exempts purely personal or family-use processing that does not infringe others' rights.

Art. 27 provides that the Law is brought into force after its official publication, rather than on a fixed post-signature delay; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed. The Law's own gazette citation (Akhbori Majlisi Oli of the Republic of Tajikistan issue and item number) was not found in the primary text fetched this pass and is not asserted here.

Law on the Protection of Personal Data, localization and cross-border transfer

Art. 14, read in context, establishes a domestic-database default: storage of personal data in a database located exclusively in Tajikistan is carried out by the possessor, operator, and third party, except in cases agreed with the authorized state body for personal data protection, a regulator-approval escape valve rather than an absolute rule or an enumerated exception list.

Art. 18, "Cross-border transfer of personal data" (confirmed by a reviewer pass reading its own clean heading, resolving the research pass's approximate attribution), permits transfer to a state ensuring adequate protection under this Law, and permits transfer to a state that does not on any of four grounds: subject or legal-representative consent; an international treaty Tajikistan recognizes; statutory necessity for the constitutional order, public order, human and civil rights, health and morals, or national defense and security; or protection of constitutional rights where consent cannot be obtained, the same four-ground structure found in Kazakhstan and Uzbekistan.

Transfer generally may also be prohibited or restricted for the same constitutional-order, morals, health, rights, defense, or security reasons, the same reservation clause found across this batch. The two provisions answer different questions: a default in-country database with a regulator-approved exception, plus a separately conditioned general transfer regime.

Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Law on the Protection of Personal Data, data subject rights

Art. 8 gives the subject the right to notice of data collected about them, access, and correction of inaccurate or misleading data, unless legislation provides otherwise.

A separate provision, located near Arts. 9-10 in the text read but not independently numbered with confidence here, requires the possessor, operator, or third party to notify the subject within three working days when their data is transferred to a third party, naming the recipient, the processing purpose, and the data's source, subject to exceptions including the subject's prior consent to the transfer.

Art. 19 requires depersonalization for statistical, sociological, and scientific research use, and Art. 20 requires destruction of data on expiry of the retention period or another statutory trigger. No explicit deletion-on-request or objection-to-processing right distinct from the Art. 8 correction right was found in what was read.

Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Law on the Protection of Personal Data, enforcement

Art. 6, read in full, gives the President of Tajikistan the power to determine the authorized state body for personal data protection and approve its regulation; the Act does not itself name that body.

Art. 7 gives that still-undesignated body real powers if and when named: implementing state policy, drafting regulations for presidential approval, approving data categories and protection procedures, hearing complaints, and identifying responsible persons and taking measures to hold them liable, with no fine schedule stated. No private right of action was found in the Act itself.

A 2 July 2021 decree by the Communication Service under the Government of Tajikistan on personal-data protection procedures was reported, not read at primary source, as a possible sign of the Communication Service's operative role; that was not confirmed against a primary designation, and fine figures reported in secondary sources, which read unevenly (a higher maximum for individuals than for legal entities), were not verified here.

Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.