Page 1

LAW OF THE REPUBLIC OF TAJIKISTAN
ON THE PROTECTION OF PERSONAL DATA

By the decision of the Majlisi Namoyandagon
Majlisi Oli of the Republic of Tajikistan
as of June 8, 2018, № 1115
was adopted.

By resolution of the National Assembly
Majlisi Oli of the Republic of Tajikistan
as of August 2, 2018, № 561
was advocated.

This law provides the legal and organizational basis for activities related to the collection, processing,
determines the storage and protection of personal data.

CHAPTER 1. GENERAL PROVISIONS
Article 1. Basic concepts

The following main terms are used in this Law:
- personal biometric data - personal data that have physiological characteristics and
identifies the biological subject;
- personal information - information about the facts, events and circumstances of the life of the subject
personal information, which allows to identify him;

Page 2

- collection of personal data - actions to obtain personal data
directed;
- Deletion of personal data - actions that are restored as a result of their performance
disclosure of personal information is not possible;
- Privacy of personal data - actions that result in their identification
belonging of the personal data to the exact subject of the personal data without use
additional information becomes impossible;
- personal database (hereinafter - the database) - a set of procedures
entered personal data;
- Database holder (hereinafter - the holder) - government body, individual and
legal rights in accordance with the legislation of the Republic of Tajikistan;
use, manage and protect the database;
- database operator (hereinafter - the operator) - a government agency, individual and
legal in accordance with the legislation of the Republic of Tajikistan or an agreement with the holder
carry out processing and protection of personal data;
- protection of personal data - a set of measures aimed at prevention
unauthorized access to personal information;
- processing of personal data - actions related to recording, compiling, storage,
modify, improve, acquire, use, distribute, customize, close and
destruction of personal data;
- use of personal data - actions with personal data for implementation
the activities of the owner, operator and third party;
- protection of personal data - actions to ensure the safety, confidentiality and
access to personal information;
- Dissemination of personal data - actions to the transfer of personal data to the scope
indefinite individuals;
- the subject of personal data (hereinafter - the subject) - the individual to whom the information
belongs to the relevant individual;
- third party - a person who is not a subject, owner or operator, with whom or relations
legal relation to personal data;
- tangible carrier - tangible objects (including physical fields) in which information is stored
personality finds its reflection in the form of symbols, shapes and sounds;

Page 3

- actions (operations) of the holder with personal data - collection, storage, verification,
transfer, seizure, declassification and destruction of personal data;
- privacy system - established rules that limit
determine access, transfer and storage of personal data;
- cross-border transfer of personal data - transfer of personal data to the territory
foreign countries.
Article 2. Legislation of the Republic of Tajikistan on protection of personal data

Legislation of the Republic of Tajikistan on the protection of personal data
The Constitution of the Republic of Tajikistan is based on this Law and other acts
normative legal acts of the Republic of Tajikistan, as well as international legal acts that
Tajikistan has recognized them.
Article 3. Scope of this Law

1. This law regulates the relations related to the collection, processing and protection of data
regulates the individual.
2. This law does not cover the following actions:
- processing and protection of personal data by the subjects only for personal needs and
family, if it causes violation of the rights of other individuals and (or) legal entities
do not return;
- creation, storage, accounting and use of documents containing personal data
National Archives of the Republic of Tajikistan and other archival documents in accordance
the legislation of the Republic of Tajikistan;
- processing and protection of personal data in accordance with the legislation of the Republic of Tajikistan
belongs to a state secret.
Article 4. Principles of collection, processing and protection of personal data

The collection, processing and protection of personal data is based on the following principles:
- observance of human and civil rights and freedoms;
- legality;
- justice;
- openness and transparency;
- confidentiality of personal data with limited access;

Page 4

- equality of rights of subjects, owners and operators;
- ensuring the security of the individual, society and the state.
CHAPTER 2. GUARANTEES AND STATE REGULATION OF PROTECTION OF PERSONAL DATA
Article 5. State guarantee of protection of personal data

1. The protection of personal data is guaranteed by the state.
2. Collection and processing of personal data in the presence of a certificate
compliance of the authorized state body for protection of personal data and
information security are implemented.
3. To ensure the security of personal data should be protected from accidental or
Unauthorized eviction, copying, theft, loss, alteration
and take action to expose or destroy it.
Article 6. Powers of the President of the Republic of Tajikistan on protection of personal data

Powers of the President of the Republic of Tajikistan on protection of personal data
are:
- approval of regulatory legal acts on protection of personal data;
- determination of the authorized state body for the protection of personal data;
approval of its regulations;
- exercise other powers provided by the legislation of the Republic
Tajikistan.
Article 7. Powers of the authorized state body on protection of personal data

The authorized state body for the protection of personal data has the following powers
is:
- implements the state policy on protection of personal data;
- development and approval of regulatory legal acts on protection of personal data
Proposed by the President of the Republic of Tajikistan;
- a list of personal data required for the activities of the owner, operator and
the third party confirms that they are necessary and sufficient;
- the order of protection measures taken by the owner, operator and third parties
confirms personal information.
- appeals of individuals and legal entities on the protection of personal data
considers;

Page 5

- The list of persons responsible for compliance with the legislation of the Republic of Tajikistan
identify obligations to protect personal information and hold them accountable
takes action;
- exercise other powers provided by the legislation of the Republic of Tajikistan
appears.
CHAPTER 3. COLLECTION, PROCESSING AND STORAGE OF PERSONAL DATA
Article 8. Terms of collection and processing of personal data

1. Collection and processing of personal data with the consent of the subject or legal representative
it is provided by the owner and (or) operator, except as otherwise provided
Article 9 of this Law.
2. The collection and processing of personal data must be accompanied by specific objectives.
be pre-determined and legally restricted. To process data
personal incompatibility with the purposes of its collection is not permitted.
3. The content and amount of personal data collected and processed must be
match the stated purposes of collection and processing.
4. When collecting and processing personal data, the accuracy of personal data,
its adequacy and, where appropriate, the importance of the purpose of the collection and
provide personal data processing. The operator needs to be precise
take necessary measures to provide incomplete or inaccurate information.
5. The data subject must be informed about the information collected in relation to him
be informed and provide him with access to information belonging to him
as well as he has the right to correct inaccurate information or to
erroneous, if the legislation of the Republic of Tajikistan
unless otherwise provided.
6. Collection and processing of personal data of the deceased subject by the court
recognized as missing or declared dead in accordance with the legislation
Republic of Tajikistan.
Article 9. Access to personal data

1. Personal information is divided into public and limited access.
2. Access to personal data is free with the consent of the subject or
in accordance with the legislation of the Republic of Tajikistan the requirements of the confidentiality system
does not apply.
3. Sources of personal data for the purpose of providing information to the population
free access (including translation directories, telephone books,
address, publicly available electronic information resources, media
mass) are used.
4. Access to personal data with limited access in accordance with the legislation of the Republic
Tajikistan is limited.
Article 10. Access to personal data

Page 6

1. Access to personal data with the consent of the subject or his legal representative;
given to the owner, operator and third party for their collection and processing
except as provided in Article 9 of this Law
will be done.
2. An application (request) of a subject or his legal representative regarding access to
your personal information to the owner, operator and third party in the form
established by the legislation of the Republic of Tajikistan.
3. The relationship between the owner, the operator and the third party regarding access
personal data in accordance with the Law of the Republic of Tajikistan "On the right of access to
information ”is regulated.
Article 11. Procedure for giving consent of the subject to the collection and processing of personal data (revocation)

1. An entity or its legal representative is responsible for the collection and processing of personal data
approved by the legislation of the Republic of Tajikistan
recalls).
2. The entity or its legal representative agrees to the collection and processing of the data
personal withdrawal in the cases provided for in Article 9 of this Law
cannot.
Article 12. Collection and processing of personal data without the consent of the subject

Collection and processing of personal data without the consent of the subject or his legal representative
The following cases are implemented:
- performance by state bodies of the functions specified in the legislation of the Republic
Tajikistan are provided;
- protection of the constitutional rights and freedoms of man and citizen.
Article 13. Confidentiality of personal data

1. Holder, operator and third party who have access to personal information
limited access, its confidentiality by complying with road requirements
not to disseminate it without the consent of the subject or his legal representative
they are.
2. Persons to whom personal information has limited access in connection with
professional, service needs, as well as labor relations are identified.
are obliged to ensure its confidentiality.
3. Confidentiality of personal biometric data in accordance with the legislation of the Republic
Tajikistan is established.
Article 14. Backup and storage of personal data

1. Save personal data by collecting personal data for
implementation of the activities of the owner, operator and third party is necessary and sufficient.
takes place.

Page 7

2. The storage of personal data by the owner, operator and third party
its database is located only in the territory of the Republic of Tajikistan, except
cases with the authorized state body for the protection of personal data
agreed, will be implemented.
3. Term of storage of personal data with the date of achievement of processing purposes
they shall be determined unless otherwise provided by the legislation of the Republic of Tajikistan
not provided.
Article 15. Change and addition of personal data

Modification and addition of personal information by the owner, operator and person
third on the basis of the application (request) of the subject or his legal representative or in cases
other stipulated by the legislation of the Republic of Tajikistan.
Article 16. Dissemination of personal data

1. The dissemination of personal information is permitted if rights and freedoms
the subject is not discriminated against, as well as the legitimate interests of individuals
and other legal damages, except as otherwise provided
Legislation of the Republic of Tajikistan.
2. Dissemination of personal information in cases beyond the previously announced scope
the purposes for which it is collected and processed, with the consent of the subject or representative
his legitimacy, except as otherwise provided by the legislation of the Republic
Tajikistan, implemented.
Article 17. Personal biometric data

1. Information that reflects the physiological and biological characteristics of a person, in
the basis of which can be identified by his identity (personal biometric data)
and also it is used by the operator to identify
the subject of personal data used may exist only in the case
the written consent of the subject of personal data, except as otherwise provided
provided for by part 2 of this article.
2. Processing of personal biometric data may be carried out without the consent of the data subject
personal due to the implementation of criminal prosecution and justice, execution of acts
court, as well as in cases provided by the legislation of the Republic of Tajikistan
on defense, security, operational-search activities, resistance to
terrorism, extremism, corruption and money laundering
obtained through crime, terrorist financing and financing
proliferation of weapons of mass destruction, execution of criminal penalties, acquisition and termination
citizenship of the Republic of Tajikistan and civil service.
Article 18. Transnational transfer of personal data

1. Transnational transfer of personal data to the territories of foreign states that protect it
ensure the same rights of subjects of personal data, according to
This law is enforced. Transnational transfer of personal data with
the purpose of protection of bases of constitutional structure of the Republic of Tajikistan,

Page 8

morality, health, rights and legitimate interests of citizens, security
the defense of the country and the security of the state may be prohibited or restricted.
2. Transnational transfer of personal data to the territories of foreign states that protect it
do not provide personal information, is carried out in the following cases:
- the consent of the subject or his legal representative to the transboundary transfer
his personal information;
- circumstances stipulated by international treaties recognized by Tajikistan;
- the cases provided by the legislation of the Republic of Tajikistan, if this is the purpose
protection of the constitutional order, public order, human and civil rights and freedoms,
health and morale of the population, ensuring the defense of the country and the security of the state
be;
- protection of the constitutional rights and freedoms of man and citizen, if obtaining consent
the subject or his legal representative is impossible.
Article 19. Privacy of personal data

When processing personal data to conduct statistical, social and
the scientific owner, the operator and the third party are obliged to exclude them.
Article 20. Deletion of personal data

Personal information is required by the owner, operator and third party in the following cases
to be destroyed:
- upon expiration of the storage period in accordance with part 3 of article 14 of this Law;
- in case of termination of legal relations between the subject and the owner, operator or
third party;
- when a court decision enters into force.
Article 21. Notification of the transfer of personal data

1. The holder or operator who has transferred personal data to third parties
as well as a third party who obtained personal information from the subject of that information
not obliged to notify the subject within a period not exceeding three business days
send a notice containing the information specified in Part 2 of this Article
to represent.
2. The notice shall contain the following information:
- last name and first name of the individual, name of the legal entity, address of the third party who provided the information
received personal;
- the purpose of processing personal data in accordance with Article 5 of this Law;

Page 9

- source of personal data.
3. The holder, operator and third party shall be liable in accordance with Part 1 in the following cases
are exempt from the provisions of this article:
- if the subject has given his consent to the transfer of personal data;
- when performing duties by state bodies in accordance with the legislation
The Republic of Tajikistan;
- disclosure of personal data by the subject or at his request;
- if the subject is provided with the information specified in Paragraph 2 of this Article
infringe the rights and legitimate interests of others.
4. Processing of transmitted personal data for statistical research purposes or
Other research is carried out if the rights and legitimate interests
the subject of personal data is not violated.
CHAPTER 4. RIGHTS AND OBLIGATIONS OF THE SUBJECT
Article 22. Right to access personal data to the subject

1. The subject to receive the information referred to in part 4 of this article, to
except as provided in part 5 of this article.
The subject has the right to clear, close or destroy the owner, operator and third party
require the disclosure of your personal information, if such information is incomplete,
obsolete, inaccurate, illegally obtained or for the stated purpose
Processing is not necessary, as well as measures to protect your rights
provided by the legislation of the Republic of Tajikistan.
2. The information specified in Part 4 of this Article shall be disclosed to the subject or
his legal representative by the owner, operator and third party at the time
appeal or acceptance of the request submitted by the subject or his legal representative
will be.
3. The information provided in Part 4 of this Article shall be provided by
holder, operator and third party in a form available to the subject
and it must contain personal information belonging to other entities
except as otherwise provided for the disclosure of such personal information
have a legal basis.
4. The subject to receive information related to the collection and processing of data
has the right to personal information, which includes the following information:
- Confirmation of the reality of collection and processing;
- legal basis and purposes of collection and processing;
- the purpose and methods used for collection and processing;

Page 10

- name and location of the owner, operator and third party, information about
persons (excluding the owner, operator and third party employees) who have access to the information
have personal access or may have access to personal information;
- terms of collection and processing of personal data, including terms of their storage;
- the procedure for the exercise by the subject of the rights provided by this Law
have been;
- information on the performed or planned cross-border data transfer.
5. The right of the subject to access his / her personal data in accordance with the legislation
The Republic of Tajikistan may be limited.
Article 23. Obligations of the subject

The subject is obliged to provide his personal information in the prescribed cases
legislation of the Republic of Tajikistan.
CHAPTER 5. RIGHTS AND OBLIGATIONS OF THE OWNER, OPERATOR AND THIRD PERSON
Article 24. Rights of the owner, operator and third party The owner, operator and third party have the right:

- the collection and processing of personal data in the manner prescribed by this Law
and implement other regulatory legal acts of the Republic of Tajikistan;
- measures for the protection of personal data in accordance with the laws of the Republic of Tajikistan
consider necessary, including legal, organizational and technical.
Article 25. Obligations of the owner, operator and third party

1. The owner, operator and the third party are obliged:
- confirm the list of personal data necessary and sufficient for the performance of their duties
unless otherwise provided by the legislation of the Republic of Tajikistan
be;
- if successful for the purpose of collecting and processing personal data;
as well as other cases stipulated by the present Law and other normative acts
legal authorities of the Republic of Tajikistan to take measures for the destruction of personal data;
- Evidence in cases provided by the legislation of the Republic of Tajikistan
confirming receipt of the subject's consent for the collection and processing of the data
to present him personally;
- to the subject or his legal representative the information belonging to him within three days
work from the date of receipt of the application.

Page 11

2. The owner, operator and third party are responsible for the protection of personal data
take the necessary measures and they should ensure the solution of the following issues:
- prevent unauthorized access to personal data;
- Timely detection of evidence of unauthorized access to personal data;
- minimizing the unintended consequences of unauthorized access to information
personal.
3. Obligations of the owner, operator and third party to protect personal data from
occur at the time of collection of personal data and until the moment of destruction or
their characterization is valid.
CHAPTER 6. FINAL PROVISIONS
Article 26. Liability for non-compliance with the requirements of this Law

Individuals and legal entities for non-compliance with the requirements of this Law in the prescribed manner
established by the legislation of the Republic of Tajikistan.
Article 27. Procedure for entry into force of this Law

This Law shall enter into force after its official publication.

President
Republic of Tajikistan

ш. Monday,
August 3, 2018,
№ 1537

Emomali Rahmon

