Tajikistan. Comprehensive data protection. Law
PDPLLaw of the Republic of Tajikistan No. 1537 'On Personal Data Protection'
In force
Partly verified
Low confidence.Single secondary source (last updated Jan 2025); official text and regulator not verified.
§1Summary
- Synopsis
Sets basic rules for collecting and processing personal data with consent, data subject rights and security of personal data. Cross-border transfers are allowed to countries with adequate protection or on consent, treaty or public-interest grounds.
- Key themes
- Unique features
Oversight sits with state-security-oriented bodies rather than an independent DPA; no breach notification duty.
- SaaS relevance
Applies to SaaS processing personal data of people in Tajikistan; transfers need adequacy or consent.
§2Obligations
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- Adequate countries freely; otherwise consent, treaty or protection of rights/public order
- Maximum penalty
- Administrative fines (~USD 1,700); criminal up to 10 years' imprisonment
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text adlia.tj
- Authority
- Main Department for the Protection of State Secrets / Communication Service under the Government (sources inconsistent)
§5Where it applies
- Domestic law of
- Tajikistan
§6Sources and verification
- Verification
Low confidence.
Partly verified
Low confidence.Single secondary source (last updated Jan 2025); official text and regulator not verified.