TurkmenistanLaw on Information and Its Protection, information-security duty
Law of Turkmenistan No. 72-V "On Information and Its Protection" (Vedomosti Mejlisa Turkmenistana 2014, No. 2, art. 72; as amended by Laws No. 234-VI of , No. 390-VI of , and No. 445-VI of ), art. 15
In force since .
A security baseline statutes rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- Yes
What it requires
- This duty binds the possessor of information and the operator of an information system only in cases established by Turkmenistan legislation elsewhere; the Act does not itself name those cases.
- Where the duty is triggered, maintain administrative, technical and organizational measures that: prevent unauthorized access to information and its transfer to a person without a right of access; detect an unauthorized access event in a timely manner; prevent adverse consequences from a breach of the access procedure; prevent disruption of the technical means used to process the information; permit immediate restoration of information altered or destroyed by unauthorized access; and continuously monitor the level of the information's protection.
- A person injured by disclosure or unlawful use of restricted-access information may sue for damages, moral-harm compensation, and protection of honor and dignity, but not if the plaintiff itself failed to meet its own confidentiality or information-protection obligations.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
- DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The Act names no general enforcement body. For information held in state information systems, the Cabinet of Ministers of Turkmenistan sets the protection requirements and the national security bodies of Turkmenistan monitor compliance within their powers (Article 15, paragraph 5); liability for a breach of the Act's requirements is set by other Turkmen legislation (Article 16, paragraph 1).
Settledness
- As of
- Open questions
- Which other Turkmen law or regulation designates the cases established by legislation that trigger the Article 15(4) duty for a given possessor of information or information-system operator?
What it reaches
Obligation class
Security
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- The possessor of information, in the cases established by the legislation of Turkmenistan
- The operator of an information system, in the cases established by the legislation of Turkmenistan
What this law does
A possessor of information (defined to include the state and any natural or legal person of Turkmenistan) and an operator of an information system must, in cases established by Turkmenistan legislation, maintain safeguards that prevent unauthorized access to information and its transfer to a person without a right of access.
The same duty requires the possessor or operator to detect unauthorized access in a timely manner, prevent adverse consequences of a breach of access procedure, prevent disruption of the technical means that process the information, permit immediate restoration of information altered or destroyed through unauthorized access, and continuously monitor the level of the information's protection.
The Act does not itself identify which other legislation triggers this duty for a given information holder outside the state-information-system context it separately regulates. A person whose rights were violated by disclosure or other unlawful use of restricted-access information may sue for damages, moral-harm compensation, and vindication of honor and dignity, though that claim is barred against a plaintiff who did not itself meet its own confidentiality or protection obligations.
Violation of the Act's requirements carries liability under other Turkmenistan legislation, which this Act does not itself quantify.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .