TajikistanLaw on the Protection of Personal Data, localization and cross-border transfer
Law No. 1537 (), Art. 14; Art. 18
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app storing or processing the personal data of individuals in Tajikistan, including a voiceprint or other biometric identifier, must by default keep the database exclusively inside Tajikistan, unless it has an arrangement agreed with the authorized state body for personal data protection. Transferring that data abroad separately requires the subject's consent, a ratified treaty, statutory necessity, or protection of constitutional rights where consent cannot be obtained.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 14, which speaks of storage of personal data "база которых расположена только в Республике Таджикистан" ("the database of which is located only in the Republic of Tajikistan"), require a possessor or operator to keep the database only in Tajikistan, or does it govern storage only for databases that are already located there?
- Which body gives the agreement that Article 14 calls "случаев, согласованных с уполномоченным государственным органом по защите персональных данных" ("cases agreed with the authorized state body for personal data protection"), and by what procedure, when the Law itself does not name that body?
- Which body or list decides which foreign states are "обеспечивающих адекватную защиту прав субъектов персональных данных" ("ensuring adequate protection of the rights of personal data subjects") under the first paragraph of Article 18, and is a state that is "не обеспечивающих защиту персональных данных" ("not ensuring protection of personal data") in the third paragraph the same as one outside that group?
What it makes you log
Logging duty
Article 14 requires storage in a database located only in Tajikistan, except where agreed with the authorized body, and ends storage when the purposes of processing are reached; that limits how long the personal data is kept and is not a period for a log. Article 18 governs cross-border transfers by adequacy, consent, treaty or legislation and requires no record of a transfer. Neither article has a territorial scope clause.
- Kind
- None
- As of
What this law does
Art. 14, read in context, establishes a domestic-database default: storage of personal data in a database located exclusively in Tajikistan is carried out by the possessor, operator, and third party, except in cases agreed with the authorized state body for personal data protection, a regulator-approval escape valve rather than an absolute rule or an enumerated exception list.
Art. 18, "Cross-border transfer of personal data" (confirmed against its own heading in the primary text), permits transfer to a state ensuring adequate protection under this Law, and permits transfer to a state that does not on any of four grounds: subject or legal-representative consent; an international treaty Tajikistan recognizes; statutory necessity for the constitutional order, public order, human and civil rights, health and morals, or national defense and security; or protection of constitutional rights where consent cannot be obtained, the same four-ground structure found in Kazakhstan and Uzbekistan.
Transfer generally may also be prohibited or restricted for the same constitutional-order, morals, health, rights, defense, or security reasons, the same reservation clause found across this batch. The two provisions answer different questions: a default in-country database with a regulator-approved exception, plus a separately conditioned general transfer regime.
Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as , the same day it was signed.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .