Tajikistan

Art. 17, read in full, requires the subject's written consent to process biometric personal data for identification purposes, except in connection with criminal prosecution, administration of justice, enforcement of judicial acts, or defense, security, counter-terrorism, extremism, corruption, and money-laundering matters.

The Art. 1 definition is general, with no illustrative list naming face, voice, or fingerprint: personal data determining the physiological and biological features of the subject. Art. 11 defers biometric confidentiality specifically to unnamed other Tajik legislation, the same deferral pattern this batch also finds word for word in Kazakhstan's Art. 11(3) and Turkmenistan's Art. 7(7).

A dedicated, consent-gated biometric article does exist, so biometric data carries a heightened restriction here. Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Law No. 1537 binds the possessor (обладатель), operator (оператор), and third party (третье лицо) generally, terms not confined to private actors.

Art. 8 requires the subject's consent, or their legal representative's, for collection and processing, subject to Art. 9's exceptions, not set out article by article here; processing must be limited to specific, predetermined, lawful purposes, proportionate and accurate, with the subject notified of data collected about them and given a correction right. Art. 3 exempts purely personal or family-use processing that does not infringe others' rights.

Art. 27 provides that the Law is brought into force after its official publication, rather than on a fixed post-signature delay; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed. The Law's own gazette citation (Akhbori Majlisi Oli of the Republic of Tajikistan issue and item number) is not found in the primary text and is not asserted here.

Art. 14, read in context, establishes a domestic-database default: storage of personal data in a database located exclusively in Tajikistan is carried out by the possessor, operator, and third party, except in cases agreed with the authorized state body for personal data protection, a regulator-approval escape valve rather than an absolute rule or an enumerated exception list.

Art. 18, "Cross-border transfer of personal data" (confirmed against its own heading in the primary text), permits transfer to a state ensuring adequate protection under this Law, and permits transfer to a state that does not on any of four grounds: subject or legal-representative consent; an international treaty Tajikistan recognizes; statutory necessity for the constitutional order, public order, human and civil rights, health and morals, or national defense and security; or protection of constitutional rights where consent cannot be obtained, the same four-ground structure found in Kazakhstan and Uzbekistan.

Transfer generally may also be prohibited or restricted for the same constitutional-order, morals, health, rights, defense, or security reasons, the same reservation clause found across this batch. The two provisions answer different questions: a default in-country database with a regulator-approved exception, plus a separately conditioned general transfer regime.

Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Art. 8 gives the subject the right to notice of data collected about them, access, and correction of inaccurate or misleading data, unless legislation provides otherwise.

A separate provision, located near Arts. 9-10 in the text read but not independently numbered with confidence here, requires the possessor, operator, or third party to notify the subject within three working days when their data is transferred to a third party, naming the recipient, the processing purpose, and the data's source, subject to exceptions including the subject's prior consent to the transfer.

Art. 19 requires depersonalization for statistical, sociological, and scientific research use, and Art. 20 requires destruction of data on expiry of the retention period or another statutory trigger. No explicit deletion-on-request or objection-to-processing right distinct from the Art. 8 correction right was found in what was read.

Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Art. 6, read in full, gives the President of Tajikistan the power to determine the authorized state body for personal data protection and approve its regulation; the Act does not itself name that body.

Art. 7 gives that still-undesignated body real powers if and when named: implementing state policy, drafting regulations for presidential approval, approving data categories and protection procedures, hearing complaints, and identifying responsible persons and taking measures to hold them liable, with no fine schedule stated. No private right of action was found in the Act itself.

A 2 July 2021 decree by the Communication Service under the Government of Tajikistan on personal-data protection procedures was reported, not read at primary source, as a possible sign of the Communication Service's operative role; that was not confirmed against a primary designation, and fine figures reported in secondary sources, which read unevenly (a higher maximum for individuals than for legal entities), were not verified here.

Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Art. 298 punishes unlawful access to information stored in a computer system, network or on machine media where the access is accompanied by a violation of the security system, with escalating tiers for negligent damage and for grave consequences. Art. 299 punishes modification of computer information or the introduction of deliberately false information that causes significant damage or a threat of it.

Art. 300 punishes destruction, blocking or rendering unusable of computer information or programs, or disabling computer equipment. Art. 301 punishes illegal copying or other illegal seizure of information stored in a computer system, network or machine media, and interception of information transmitted using computer communications, with aggravated tiers for coercion, violence, prior conspiracy or organized-group commission.

Each offense's trigger is unauthorized action against the system or its data, so reading a public, unauthenticated page without defeating a security system falls outside a plain reading of these provisions.

Art. 156 criminalizes appropriation of authorship (plagiarism) and coercion to co-authorship where the act causes the author or another copyright holder major damage, and separately criminalizes illegal use of copyright or related-rights objects, or the acquisition, storage, transportation or transfer of illegal copies of works or phonograms for sale, where either act causes major damage.

The article states no fair-use, quotation, scientific-research or text-and-data-mining exception for reproducing a protected work, and no separate provision addressing such an exception has been identified among the sources reached.

Art. 7(3), read in the Law's list of works that are not objects of copyright, excludes 'reports of events and facts having an informational character' (news of the day) from protection altogether, so a bare factual news item carries no copyright to begin with.

Art. 20(1) permits, without the author's consent or payment but with the author's name and source stated, quotation in the original or in translation for scientific, research, polemical, critical, or informational purposes from lawfully published works to an extent justified by the purpose of the quotation, expressly including reproduction of excerpts from newspaper and magazine articles in the form of press reviews; Art. 20(3) separately permits reproducing in the press, broadcasting, or cable-communicating to the public lawfully published newspaper or magazine articles on current economic, political, or religious topics, or broadcast works of the same character, unless the author has specifically prohibited such reproduction; Art. 20(5) permits reproducing or communicating, in reviews of current events by photography, broadcast, or cable, works that become seen or heard in the course of those events, to the extent justified by the informational purpose.

Neither the neighbouring-rights provisions (Section III, Arts. 30 and following, covering performers, phonogram producers, and broadcasting or cable organizations only) nor any other part of the Law creates a press-publisher neighbouring right, a compelled bargaining regime, or a machine-readable text-and-data-mining reservation, and no reported Tajik decision was found applying Art. 20 to a systematic news aggregator rather than an individual quoting a published work.