TajikistanLaw on the Protection of Personal Data, data subject rights
Law No. 1537 (), Art. 8; Arts. 19-22
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app must notify a Tajikistani data subject of the personal data collected about them and let them correct inaccurate or misleading data, and must let the subject demand the clarification, blocking or destruction of their data where it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose. An app that transfers a subject's data to a third party must notify the subject within three working days, naming the recipient, the purpose, and the data's source, unless the subject already consented to the transfer.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does the subject's right under Article 22 to demand "уточнения его персональных данных, их блокирования или уничтожения" ("clarification of his personal data, their blocking or destruction") for data that are "не являются необходимыми для заявленной цели обработки" ("not necessary for the stated purpose of processing") operate as a general erasure right against an operator, and how does it relate to the grounds for destruction in Article 20?
- From what event does the period "в срок, не превышающий трёх рабочих дней" ("within a period not exceeding three working days") in Article 21 run for a notice of transfer to a third party?
What it makes you log
Logging duty
Article 8 gives the subject notice, access and correction, Article 19 requires anonymization for statistical and research use, Article 20 requires destruction when the retention period ends or the relationship ends or a court orders it, and Articles 21 and 22 require a three working day notice of a transfer and let the subject demand correction, blocking or destruction. These are notices and erasure duties, and the articles name no log, register or proof to be kept. Article 25 (the duty to produce evidence of consent) is outside the cited articles. The cited articles have no territorial scope clause.
- Kind
- None
- As of
What this law does
Art. 8 gives the subject the right to notice of data collected about them, access, and correction of inaccurate or misleading data, unless legislation provides otherwise.
Article 21 requires a possessor or operator that has passed personal data to a third party, and a third party that received data from someone other than the subject, to send the subject within three working days a notice naming the recipient, the purpose of processing and the source of the data, subject to exceptions including the subject's consent to the transfer.
Article 22 lets the subject demand from the possessor, operator and third party the clarification, blocking or destruction of their personal data where the data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing.
Art. 19 requires depersonalization for statistical, sociological, and scientific research use, and Art. 20 requires destruction of data on expiry of the retention period, when the legal relationship between the subject and the possessor, operator or third party ends, or when a court decision takes legal effect.
Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as , the same day it was signed.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .