Unofficial translation of the current version published in the “Adliya” Centralised Legal Information Bank of the Ministry of Justice of the Republic of Tajikistan (as of 19.10.2026). In case of any discrepancy, the official Tajik and Russian texts prevail.
Adopted by Resolution of the Majlisi Namoyandagon of the Majlisi Oli of the Republic of Tajikistan No. 1115 of 8 June 2018
Approved by Resolution of the Majlisi Milli of the Majlisi Oli of the Republic of Tajikistan No. 561 of 2 August 2018
This Law defines the legal and organisational foundations of activities related to the collection, processing and protection of personal data.
CHAPTER 1. GENERAL PROVISIONS
Article 1. Basic concepts
The following basic concepts are used in this Law:
- biometric personal data – personal data describing the physiological and biological characteristics of a data subject;
- personal data – information about facts, events and circumstances of the life of a personal data subject that make it possible to identify him or her;
- collection of personal data – actions aimed at obtaining personal data;
- destruction of personal data – actions after which personal data cannot be restored;
- depersonalisation of personal data – actions after which it becomes impossible, without additional information, to determine which personal data subject the personal data belong to;
- personal data base (hereinafter – database) – a set of organised personal data;
- database owner (hereinafter – owner) – a state body or a natural or legal person that, in accordance with the legislation of the Republic of Tajikistan, has the right to possess, use and dispose of a database;
- database operator (hereinafter – operator) – a state body or a natural or legal person that processes and protects personal data on the basis of the legislation of the Republic of Tajikistan or an agreement with the owner;
- protection of personal data – a set of measures taken to prevent unauthorised access to personal data;
- processing of personal data – actions aimed at recording, organising, storing, altering, supplementing, retrieving, using, disseminating, depersonalising, blocking and destroying personal data;
- use of personal data – actions with personal data aimed at achieving the goals of the owner, the operator and a third party;
- storage of personal data – actions to ensure the integrity, confidentiality and availability of personal data;
- dissemination of personal data – actions aimed at transferring personal data to an indefinite number of persons;
- personal data subject (hereinafter – subject) – the natural person to whom the personal data relate;
- third party – a person who is not the subject, the owner or the operator but is connected with them by circumstances or legal relations concerning personal data;
- material media – material objects (including physical fields) on which personal data are recorded in the form of symbols, images and sound;
- actions (operations) of the owner with personal data – collection, storage, verification, transfer, withdrawal, depersonalisation and destruction of personal data;
- confidentiality regime for personal data – established rules determining the availability, transfer and storage conditions of personal data;
- cross-border transfer of personal data – the transfer of personal data to the territory of foreign states.
Article 2. Legislation of the Republic of Tajikistan on the protection of personal data
The legislation of the Republic of Tajikistan on the protection of personal data is based on the Constitution of the Republic of Tajikistan and consists of this Law, other regulatory legal acts of the Republic of Tajikistan and international legal acts recognised by Tajikistan.
Article 3. Scope of this Law
1. This Law regulates relations connected with the collection, processing and protection of personal data.
2. This Law does not apply to:
- the processing and protection of personal data by subjects exclusively for personal and family needs, provided that the rights of other natural and (or) legal persons are not violated;
- the formation, storage, recording and use of documents of the National Archive Fund of the Republic of Tajikistan and other archival documents containing personal data, in accordance with the legislation of the Republic of Tajikistan;
- the processing and protection of personal data classified as state secrets in accordance with the legislation of the Republic of Tajikistan.
Article 4. Principles of the collection, processing and protection of personal data
The collection, processing and protection of personal data are based on the following principles:
- respect for the rights and freedoms of the citizen and the person;
- legality;
- fairness;
- openness and transparency;
- confidentiality of restricted-access personal data;
- equal rights of subjects, owners and operators;
- ensuring the security of the individual, society and the state.
CHAPTER 2. STATE GUARANTEE AND REGULATION OF PERSONAL DATA PROTECTION
Article 5. State guarantee of personal data protection
1. The protection of personal data is guaranteed by the state.
2. Personal data are collected and processed when there is a certificate of conformity issued by the authorised state body for personal data protection and information security.
3. To ensure the protection of personal data, measures must be taken to protect them from unintentional or unauthorised leakage, copying, theft, loss, alteration (forgery), disclosure or destruction.
Article 6. Powers of the President of the Republic of Tajikistan in the protection of personal data
The powers of the President of the Republic of Tajikistan in the protection of personal data include:
- approving regulatory legal acts on the protection of personal data;
- designating the authorised state body for the protection of personal data and approving its regulations;
- exercising other powers provided for by the legislation of the Republic of Tajikistan.
Article 7. Powers of the authorised state body for the protection of personal data
The authorised state body for the protection of personal data has the following powers:
- implementing state policy on the protection of personal data;
- drafting regulatory legal acts on the protection of personal data and submitting them to the President of the Republic of Tajikistan for approval;
- approving the list of personal data necessary and sufficient for the activities of the owner, the operator and a third party;
- approving the procedure by which the owner, the operator and a third party take measures to protect personal data;
- considering appeals of natural and legal persons on the protection of personal data;
- determining the list of persons responsible for compliance with the legislation of the Republic of Tajikistan on the protection of personal data and taking measures to hold them liable.
CHAPTER 3. COLLECTION, PROCESSING AND STORAGE OF PERSONAL DATA
Article 8. Conditions for collecting and processing personal data
1. Personal data are collected and processed by the owner and (or) the operator with the consent of the subject or his or her legal representative, except in the cases provided for by Article 9 of this Law.
2. The collection and processing of personal data must be limited to achieving specific, predetermined and lawful purposes. Processing of personal data incompatible with the purposes of their collection is not allowed.
3. The content and volume of the personal data collected and processed must correspond to the stated purposes of collection and processing.
4. When personal data are collected and processed, their accuracy, sufficiency and, where necessary, relevance to the purposes of collection and processing must be ensured. The operator must take the necessary measures to correct incomplete or inaccurate data.
5. The data subject must be notified of the data collected about him or her, is given access to the data concerning him or her and has the right to demand the correction of inaccurate or misleading data, unless the legislation of the Republic of Tajikistan provides otherwise.
6. The personal data of a deceased subject or a subject recognised by a court as missing or declared dead are collected and processed in accordance with the legislation of the Republic of Tajikistan.
Article 9. Availability of personal data
1. Personal data are divided into publicly available data and restricted-access data.
2. Publicly available personal data are freely available with the consent of the subject, or where, in accordance with the legislation of the Republic of Tajikistan, the requirements of the secrecy regime do not apply to them.
3. For the purpose of providing information to the population, publicly available sources of personal data are used (including biographical reference books, telephone and address directories, publicly available electronic information resources and the mass media).
4. The availability of restricted-access personal data is limited by the legislation of the Republic of Tajikistan.
Article 10. Access to personal data
1. Access to personal data is determined by the terms of the consent of the subject or his or her legal representative given to the owner, the operator and a third party for their collection and processing, except in the cases provided for by Article 9 of this Law.
2. An application (request) of the subject or his or her legal representative for access to his or her personal data is submitted to the owner, the operator and a third party in the form established by the legislation of the Republic of Tajikistan.
3. Relations between the owner, the operator and a third party regarding access to personal data are regulated by the Law of the Republic of Tajikistan “On the Right of Access to Information”.
Article 11. Procedure for giving (withdrawing) the subject’s consent to the collection and processing of personal data
1. The subject or his or her legal representative gives (withdraws) consent to the collection and processing of personal data in the forms established by the legislation of the Republic of Tajikistan.
2. The subject or his or her legal representative may not withdraw consent to the collection and processing of personal data in the cases provided for by Article 9 of this Law.
Article 12. Collection and processing of personal data without the subject’s consent
Personal data are collected and processed without the consent of the subject or his or her legal representative in the following cases:
- performance by state bodies of functions provided for by the legislation of the Republic of Tajikistan;
- protection of the constitutional rights and freedoms of the person and the citizen.
Article 13. Confidentiality of personal data
1. The owner, the operator and a third party that gain access to restricted-access personal data ensure their confidentiality by complying with the requirements not to disseminate them without the consent of the subject or his or her legal representative.
2. Persons who learn restricted-access personal data in connection with professional or official necessity or employment relations must ensure their confidentiality.
3. The confidentiality of biometric data is established by the legislation of the Republic of Tajikistan.
Article 14. Accumulation and storage of personal data
1. Personal data are accumulated by collecting the personal data necessary and sufficient for the activities of the owner, the operator and a third party.
2. Personal data whose database is located only in the Republic of Tajikistan are stored by the owner, the operator and a third party, except in cases agreed with the authorised state body for the protection of personal data.
3. The storage period of personal data is determined by the date on which the purposes of their processing are achieved, unless the legislation of the Republic of Tajikistan provides otherwise.
Article 15. Amending and supplementing personal data
Personal data are amended and supplemented by the owner, the operator and a third party on the basis of an application (request) of the subject or his or her legal representative or in other cases provided for by the legislation of the Republic of Tajikistan.
Article 16. Dissemination of personal data
1. Dissemination of personal data is allowed if it does not violate the rights and freedoms of the subject or affect the legitimate interests of other natural and legal persons, except in the cases provided for by the legislation of the Republic of Tajikistan.
2. Dissemination of personal data beyond the previously stated purposes of their collection and processing is carried out with the consent of the subject or his or her legal representative, except in the cases provided for by the legislation of the Republic of Tajikistan.
Article 17. Biometric personal data
1. Information describing the physiological and biological characteristics of a person on the basis of which his or her identity can be established (biometric personal data), and which is used by the operator to identify the personal data subject, may be processed only with the written consent of the personal data subject, except in the cases provided for by part 2 of this Article.
2. Biometric personal data may be processed without the consent of the personal data subject in connection with criminal prosecution and the administration of justice, the enforcement of court decisions, and in the cases provided for by the legislation of the Republic of Tajikistan on defence, security, operational and investigative activity, countering terrorism, extremism, corruption and the legalisation (laundering) of criminal proceeds, the financing of terrorism and the financing of the proliferation of weapons of mass destruction, the execution of criminal sentences, the acquisition and termination of citizenship of the Republic of Tajikistan and the civil service.
Article 18. Cross-border transfer of personal data
1. Cross-border transfer of personal data to the territory of foreign states that ensure adequate protection of the rights of personal data subjects is carried out in accordance with this Law. Cross-border transfer of personal data may be prohibited or restricted to protect the foundations of the constitutional order of the Republic of Tajikistan, morality, health and the rights and legitimate interests of citizens, and to ensure the defence of the country and the security of the state.
2. Cross-border transfer of personal data to the territory of foreign states that do not ensure the protection of personal data may be carried out:
- with the consent of the subject or his or her legal representative to the cross-border transfer of his or her personal data;
- in the cases provided for by international treaties recognised by Tajikistan;
- in the cases provided for by the legislation of the Republic of Tajikistan, where necessary to protect the constitutional order, public order, the rights and freedoms of the person and the citizen and the health and morals of the population, and to ensure the defence of the country and the security of the state;
- to protect the constitutional rights and freedoms of the person and the citizen where it is impossible to obtain the consent of the subject or his or her legal representative.
Article 19. Depersonalisation of personal data
When processing personal data for statistical, sociological or scientific research, the owner, the operator and a third party must depersonalise them.
Article 20. Destruction of personal data
Personal data are to be destroyed by the owner, the operator and a third party:
- on expiry of the storage period in accordance with part 3 of Article 14 of this Law;
- on termination of the legal relations between the subject and the owner, the operator or a third party;
- when a court decision enters into legal force.
Article 21. Notification of the transfer of personal data
1. An owner or operator that has transferred personal data to third parties, as well as a third party that has received personal data not from the subject of such personal data, must, within no more than three working days, send the subject a notification containing the information specified in part 2 of this Article.
2. The notification states:
- the surname and first name of the natural person or the name of the legal entity and the address of the third party that received the personal data;
- the purpose of processing the personal data in accordance with Article 5 of this Law;
- the source of the personal data.
3. The owner, the operator and a third party are released from the obligation provided for by part 1 of this Article in the following cases:
- if the subject has consented to the transfer of the personal data;
- when state bodies perform functions provided for by the legislation of the Republic of Tajikistan;
- the personal data have been made publicly available by the personal data subject or at his or her request;
- if providing the subject with the information specified in part 2 of this Article violates the rights and legitimate interests of other persons.
4. The transferred personal data are processed for statistical or other research purposes, provided that the rights and legitimate interests of the personal data subject are not violated.
CHAPTER 4. RIGHTS AND DUTIES OF THE SUBJECT
Article 22. Right of the subject to access his or her personal data
1. The subject has the right to receive the information specified in part 4 of this Article, except in the cases provided for by part 5 of this Article. The subject has the right to demand that the owner, the operator and a third party correct, block or destroy his or her personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and to take the measures provided for by the legislation of the Republic of Tajikistan to protect his or her rights.
2. The information specified in part 4 of this Article is provided to the subject or his or her legal representative by the owner, the operator and a third party upon application or upon receipt of a request from the subject or his or her legal representative.
3. The information specified in part 4 of this Article must be provided to the subject by the owner, the operator and a third party in an accessible form and must not contain personal data relating to other subjects, unless there are legal grounds for disclosing such personal data.
4. The subject has the right to receive information concerning the collection and processing of his or her personal data, including:
- confirmation that the data are being collected and processed;
- the legal grounds and purposes of collection and processing;
- the purpose and methods of collection and processing used;
- the name and location of the owner, the operator and the third party, and information about the persons (other than employees of the owner, the operator and the third party) who have access to the personal data or to whom the personal data may be disclosed;
- the periods of collection and processing of the personal data, including their storage periods;
- the procedure for the subject to exercise the rights provided for by this Law;
- information about any completed or intended cross-border transfer of data.
5. The subject’s right to access his or her personal data may be restricted in accordance with the legislation of the Republic of Tajikistan.
Article 23. Duty of the subject
The subject must provide his or her personal data in the cases established by the legislation of the Republic of Tajikistan.
CHAPTER 5. RIGHTS AND DUTIES OF THE OWNER, THE OPERATOR AND A THIRD PARTY
Article 24. Rights of the owner, the operator and a third party
The owner, the operator and a third party have the right to:
- collect and process personal data in the manner established by this Law and other regulatory legal acts of the Republic of Tajikistan;
- take the necessary measures, including legal, organisational and technical ones, to protect personal data in accordance with the legislation of the Republic of Tajikistan.
Article 25. Duties of the owner, the operator and a third party
1. The owner, the operator and a third party must:
- approve the list of personal data necessary and sufficient for the tasks they perform, unless the legislation of the Republic of Tajikistan provides otherwise;
- take measures to destroy personal data once the purpose of their collection and processing has been achieved, and in other cases established by this Law and other regulatory legal acts of the Republic of Tajikistan;
- provide evidence of having obtained the subject’s consent to the collection and processing of his or her personal data in the cases provided for by the legislation of the Republic of Tajikistan;
- provide the subject or his or her legal representative with information relating to the subject within three working days of receiving the application.
2. The owner, the operator and a third party must take the necessary measures to protect personal data that ensure:
- prevention of unauthorised access to personal data;
- timely detection of unauthorised access to personal data;
- minimisation of the adverse consequences of unauthorised access to personal data.
3. The duties of the owner, the operator and a third party to protect personal data arise from the moment the personal data are collected and remain in force until they are destroyed or depersonalised.
CHAPTER 6. FINAL PROVISIONS
Article 26. Liability for failure to comply with this Law
Natural and legal persons are liable for failure to comply with the requirements of this Law in accordance with the legislation of the Republic of Tajikistan.
Article 27. Entry into force of this Law
This Law shall enter into force after its official publication.
President of the Republic of Tajikistan Emomali Rahmon
Dushanbe, 3 August 2018, No. 1537