Tajikistan

Art. 17, read in full, requires the subject's written consent to process biometric personal data for identification purposes, except in connection with criminal prosecution, administration of justice, enforcement of judicial acts, or defense, security, counter-terrorism, extremism, corruption, and money-laundering matters.

The Art. 1 definition is general, with no illustrative list naming face, voice, or fingerprint: personal data determining the physiological and biological features of the subject. Art. 11 defers biometric confidentiality specifically to unnamed other Tajik legislation, the same deferral pattern this batch also finds word for word in Kazakhstan's Art. 11(3) and Turkmenistan's Art. 7(7).

A dedicated, consent-gated biometric article does exist, so biometric data carries a heightened restriction here. Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Law No. 1537 binds the possessor (обладатель), operator (оператор), and third party (третье лицо) generally, terms not confined to private actors.

Art. 8 requires the subject's consent, or their legal representative's, for collection and processing, subject to Art. 9's exceptions, not set out article by article here; processing must be limited to specific, predetermined, lawful purposes, proportionate and accurate, with the subject notified of data collected about them and given a correction right. Art. 3 exempts purely personal or family-use processing that does not infringe others' rights.

Art. 27 provides that the Law is brought into force after its official publication, rather than on a fixed post-signature delay; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed. The Law's own gazette citation (Akhbori Majlisi Oli of the Republic of Tajikistan issue and item number) is not found in the primary text and is not asserted here.

Article 25 requires the possessor, operator and third party to approve the list of personal data needed for their tasks, to destroy personal data once the purpose of collecting and processing it is achieved, to present evidence that the subject consented to the collection and processing of the subject's personal data in the cases the legislation of the Republic of Tajikistan provides, and to give the subject or the subject's legal representative the information relating to the subject within three working days of the request.

They must also take the protection measures needed to prevent unauthorized access to personal data, to detect facts of unauthorized access in good time and to minimize the adverse consequences of unauthorized access. Their protection duties arise when the personal data is collected and last until it is destroyed or depersonalized.

Art. 14, read in context, establishes a domestic-database default: storage of personal data in a database located exclusively in Tajikistan is carried out by the possessor, operator, and third party, except in cases agreed with the authorized state body for personal data protection, a regulator-approval escape valve rather than an absolute rule or an enumerated exception list.

Art. 18, "Cross-border transfer of personal data" (confirmed against its own heading in the primary text), permits transfer to a state ensuring adequate protection under this Law, and permits transfer to a state that does not on any of four grounds: subject or legal-representative consent; an international treaty Tajikistan recognizes; statutory necessity for the constitutional order, public order, human and civil rights, health and morals, or national defense and security; or protection of constitutional rights where consent cannot be obtained, the same four-ground structure found in Kazakhstan and Uzbekistan.

Transfer generally may also be prohibited or restricted for the same constitutional-order, morals, health, rights, defense, or security reasons, the same reservation clause found across this batch. The two provisions answer different questions: a default in-country database with a regulator-approved exception, plus a separately conditioned general transfer regime.

Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Art. 8 gives the subject the right to notice of data collected about them, access, and correction of inaccurate or misleading data, unless legislation provides otherwise.

Article 21 requires a possessor or operator that has passed personal data to a third party, and a third party that received data from someone other than the subject, to send the subject within three working days a notice naming the recipient, the purpose of processing and the source of the data, subject to exceptions including the subject's consent to the transfer.

Article 22 lets the subject demand from the possessor, operator and third party the clarification, blocking or destruction of their personal data where the data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing.

Art. 19 requires depersonalization for statistical, sociological, and scientific research use, and Art. 20 requires destruction of data on expiry of the retention period, when the legal relationship between the subject and the possessor, operator or third party ends, or when a court decision takes legal effect.

Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Art. 6 gives the President of Tajikistan the power to determine the authorized state body for personal data protection and approve its regulation; the Act does not itself name that body.

Art. 7 gives that still-undesignated body real powers if and when named: implementing state policy, drafting regulations for presidential approval, approving data categories and protection procedures, hearing complaints, and identifying responsible persons and taking measures to hold them liable, with no fine schedule stated. Article 22 lets the subject take the measures that Tajik legislation provides to protect their rights.

Article 26 makes natural and legal persons liable for non-compliance with the Act in accordance with Tajik legislation, and the Act itself sets out no damages claim or fine schedule. Art. 27 provides that the Law is brought into force after its official publication; the Ministry of Justice's own legal acts portal records the document's start of effect as 3 August 2018, the same day it was signed.

Art. 298 punishes unlawful access to information stored in a computer system, network or on machine media where the access is accompanied by a violation of the security system, with escalating tiers for negligent damage and for grave consequences. Art. 299 punishes modification of computer information or the introduction of deliberately false information that causes significant damage or a threat of it.

Art. 300 punishes destruction, blocking or rendering unusable of computer information or programs, or disabling computer equipment. Art. 301 punishes illegal copying or other illegal seizure of information stored in a computer system, network or machine media, and interception of information transmitted using computer communications, with aggravated tiers for coercion, violence, prior conspiracy or organized-group commission.

Each offense's trigger is unauthorized action against the system or its data, so reading a public, unauthenticated page without defeating a security system falls outside a plain reading of these provisions. No commencement day for the provisions this entry describes has been located.

Art. 156 criminalizes appropriation of authorship (plagiarism) and coercion to co-authorship where the act causes the author or another copyright holder major damage, and separately criminalizes illegal use of copyright or related-rights objects, or the acquisition, storage, transportation or transfer of illegal copies of works or phonograms for sale, where either act causes major damage.

The article states no fair-use, quotation, scientific-research or text-and-data-mining exception for reproducing a protected work, and no separate provision addressing such an exception has been identified among the sources reached. No commencement day for Article 156 as worded by Law No. 844 of 3 July 2012 has been located.

The Minimum Requirements for the Software and Hardware Support of Credit Financial Organizations were approved by Resolution number 121 of the Board of the National Bank of Tajikistan on 18 October 2022 and registered by the Ministry of Justice on 23 November 2022 under number 1203.

The Requirements state that they were developed under part 5 of Article 42 of the Law on the National Bank of Tajikistan to secure the necessary level of information security in the banking system and protection against the risk of cyber attacks.

Item 4 requires management of the credit financial organization to approve an information security strategy covering the cyber-threat environment, the approach to managing and monitoring information security risks and cyber threats, and the principles for implementing cyber-security measures. Item 6 requires the strategy to be reviewed at least once every two years.

Item 89 requires a remote banking application to be checked for cyber and information security before it is handed to clients, with the result recorded in a special act. Item 100 provides that for non-compliance the National Bank will apply prompt corrective measures or enforcement measures under Article 48 of the Law on the National Bank of Tajikistan. The National Bank of Tajikistan lists the Minimum Requirements among its normative legal acts on its website.

Art. 7(3), read in the Law's list of works that are not objects of copyright, excludes 'reports of events and facts having an informational character' (news of the day) from protection altogether, so a bare factual news item carries no copyright to begin with.

Art. 20(1) permits, without the author's consent or payment but with the author's name and source stated, quotation in the original or in translation for scientific, research, polemical, critical, or informational purposes from lawfully published works to an extent justified by the purpose of the quotation, expressly including reproduction of excerpts from newspaper and magazine articles in the form of press reviews; Art. 20(3) separately permits reproducing in the press, broadcasting, or cable-communicating to the public lawfully published newspaper or magazine articles on current economic, political, or religious topics, or broadcast works of the same character, unless the author has specifically prohibited such reproduction; Art. 20(5) permits reproducing or communicating, in reviews of current events by photography, broadcast, or cable, works that become seen or heard in the course of those events, to the extent justified by the informational purpose.

Neither the neighbouring-rights provisions (Section III, Arts. 30 and following, covering performers, phonogram producers, and broadcasting or cable organizations only) nor any other part of the Law creates a press-publisher neighbouring right, a compelled bargaining regime, or a machine-readable text-and-data-mining reservation, and no reported Tajik decision was found applying Art. 20 to a systematic news aggregator rather than an individual quoting a published work.

The Resolution of the Majlisi Oli (Supreme Assembly) No. 727 of 13 November 1998 puts the Law into force after its official publication, and no source located states the day.