Data protection & privacy laws in Tajikistan (2026)

Law No. 1537 of 3 August 2018 "On Personal Data Protection" governs collection, processing and protection of personal data across sectors, built on the Constitution and recognized international acts. It defines personal data as information about facts, events and circumstances of an individual's life that allows identification.

The state authorized body is the Communication Service (Aloqa) under the Government of the Republic of Tajikistan, responsible for implementing state policy, drafting regulatory acts and handling individuals' complaints; sectoral state bodies retain parallel powers within their domains.

Controllers (owners/operators) and processors must generally obtain the data subject's consent to process personal data; alternative grounds such as binding corporate rules or standard contractual clauses are not provided for under the law.

There is no requirement to pre-notify or register databases with the regulator before collecting, processing or maintaining personal data, distinguishing the regime from some other CIS notification-based systems.

Transborder transfer of personal data is permitted with the data subject's consent or where the foreign state ensures adequate protection; the law does not define "adequate protection" or set out an evaluation procedure.

Data subjects may demand clarification, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or no longer needed. Implementation measures are detailed in the Communication Service decree of 02.07.2021 (No. 2.21-11), with breaches subject to administrative and criminal liability; the law remains largely untested with little case law.