TajikistanLaw on the Protection of Personal Data, duties of the possessor, operator and third party
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ncz.tj/content/о-защите-персональных-данныхIn force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
As of .
What it requires
- Be able to present evidence that the data subject consented to the collection and processing of the subject's personal data in the cases Tajik law provides, and take the protection measures needed to detect unauthorized access to personal data in good time.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 25 requires the possessor, operator and third party to present evidence of the subject's consent, which cannot be shown without a consent record. The clause names no fields of the record beyond the consent, no retention period and no person to whom the evidence goes. The duty to detect facts of unauthorized access in good time is a protection measure and states no record, no check on a record and no reporting, so it adds no trigger. The article states no territorial test, so the hook is empty. The text is read from a web.archive.org capture of the official page because the live host does not answer.
- Kind
- Implicit
- As of
- Provision
- Law No. 1537, Art. 25
- Trigger
- consent_or_optout
What this law does
Article 25 requires the possessor, operator and third party to approve the list of personal data needed for their tasks, to destroy personal data once the purpose of collecting and processing it is achieved, to present evidence that the subject consented to the collection and processing of the subject's personal data in the cases the legislation of the Republic of Tajikistan provides, and to give the subject or the subject's legal representative the information relating to the subject within three working days of the request.
They must also take the protection measures needed to prevent unauthorized access to personal data, to detect facts of unauthorized access in good time and to minimize the adverse consequences of unauthorized access. Their protection duties arise when the personal data is collected and last until it is destroyed or depersonalized.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings or processes biometric data.