Tajikistan: technology regulation at a glance

Framework: Presidential Decree No. 798 (27 March 2024) establishing the Agency for Innovation and Digital Technologies; IT Park of Tajikistan licensing regime; Criminal Code Article 253(2) (December 2024)

Tajikistan's crypto sector has long occupied a legal gray zone but is gradually formalizing. Presidential Decree No. 798 (March 2024) created the Agency for Innovation and Digital Technologies as the primary digital-assets regulator and enabled pilot-project licensing while expressly prohibiting use of crypto as a payment medium. As of May 2026 the country's first officially licensed exchange, Bitcom.tj, has launched under an IT Park license, marking a concrete but still early transition toward regulated operations.

Framework: National Strategy for the Development of Artificial Intelligence in the Republic of Tajikistan for the Period up to 2040 (adopted September 2022; signed by President Emomali Rahmon). Coordinated by the Agency for Innovation and Digital Technologies under the President, with an Interdepartmental Commission for the Regulation of AI. A binding Law 'On Artificial Intelligence' is in development but not yet enacted.

Tajikistan governs AI primarily through a non-binding national policy instrument, the AI Development Strategy to 2040, adopted in 2022, making it the first Central Asian (and first low-income) country to adopt such a strategy. Institutional coordination runs through the Agency for Innovation and Digital Technologies and an Interdepartmental Commission for AI Regulation, but no comprehensive or sectoral AI statute is yet in force; a draft Law 'On Artificial Intelligence' defining principles of state regulation is still being prepared.

Framework: Law of the Republic of Tajikistan No. 1537 of 3 August 2018 "On Personal Data Protection," supplemented by subsidiary acts of the Communication Service (Aloqa) under the Government of the Republic of Tajikistan, which acts as the state authorized body.

Tajikistan has a comprehensive, generally applicable personal-data protection law (No. 1537, in force since 3 August 2018) covering the collection, processing and protection of personal data of identifiable individuals. The state authorized body is the Communication Service under the Government of the Republic of Tajikistan, with sectoral state bodies holding parallel powers in their areas; there is no separate, fully independent GDPR-style data-protection authority. The regime is largely untested in practice, with little or no published case law, and enforcement runs through administrative and criminal liability.

Framework: Law of the Republic of Tajikistan 'On Payment Services and the Payment System' (adopted 2017), administered by the National Bank of Tajikistan (NBT) alongside the Laws 'On the National Bank of Tajikistan' and 'On Banking Activities'.

Tajikistan has a dedicated, in-force payments law (2017) under which the National Bank of Tajikistan licenses and supervises payment system operators, participants and e-money issuance, sets settlement rules, and operates national payment infrastructure (RTGS/ACH, instant payments and a unified QR scheme). The regime covers core payments and electronic money and is expanding (national payment gateway, remote e-wallet identification), but it does not yet include dedicated open-banking or BNPL frameworks, and crypto-assets remain largely unregulated.

Framework: Law on the Legal Status of Foreign Citizens and Stateless Persons; visa categories set by the Ministry of Foreign Affairs (MFA) and work permits issued by the Migration Service of the Ministry of Internal Affairs

Tajikistan has no dedicated digital-nomad or remote-work visa, and no freelance/self-employed route exists for remote workers. Foreigners typically enter visa-free (30 days for ~52 nationalities) or on the single-entry e-visa (up to 45 days), neither of which permits employment; long-term legal work requires an employer-sponsored work visa plus a work permit, while an investor visa offers residency only to those committing substantial capital.

Framework: State control via the Communication Service under the Government of the Republic of Tajikistan and the state-owned Single Electronic Communications Switching Center (EKTs), through which all internet traffic is routed and filtered by Tojiktelecom; there is no dedicated 'online safety' statute, but extensive censorship is exercised under telecom regulation and anti-extremism/security powers.

Tajikistan exercises heavy state control over the internet rather than operating a rights-based online-safety regime. Since a 2016 presidential decree, all international traffic must pass through the state-run EKTs ('Single Communications Gateway') operated by Tojiktelecom, giving authorities centralized power to surveil, throttle and block. News sites, major social networks, messaging apps and VPNs are arbitrarily blocked, often after political events or presidential criticism, and 'extremism' designations are used to ban outlets, while the government promotes a domestic messenger (ORIZ) for 'digital sovereignty.'

Framework: No single comprehensive cybersecurity statute. Information/cyber security is governed by a patchwork of sector- and topic-specific instruments: the Law on Informatization (No. 40, 6 Aug 2001), the Law on Protection of Information (No. 631, 15 May 2002), the Law on Personal Data Protection (No. 1537, 3 Aug 2018), cybercrime provisions in the Criminal Code (Section XII, Chapter 28), and the presidentially-approved Concept/National Strategy on Information Security and ICT for Development. Oversight is split between the Communication Service (Service for Communications) regulator and individual state bodies in their sectors.

Tajikistan has no consolidated NIS2-style cybersecurity law; obligations are spread across an informatization law, an information-protection law, a 2018 personal data protection law, and dedicated cybercrime articles in the Criminal Code, supplemented by a presidential Information Security Concept. Enforcement authority is fragmented between the telecom/communications regulator and sectoral state bodies, and the personal data law imposes the principal breach-notification duty. The procedural toolkit for investigating cyber incidents remains underdeveloped relative to international (Budapest Convention) standards.

Framework: Law of the Republic of Tajikistan 'On State Registration of Legal Entities and Individual Entrepreneurs' and the Law 'On Investment'; state registration administered by the Tax Committee under the Government (Department of Registration of Legal Entities and Individual Entrepreneurs) via a single-window system.

Tajikistan law permits 100% foreign ownership in most sectors with no general restriction on foreign participation, and a single-window registration system (adopted in 2019, run by the Tax Committee) makes formal company registration cheap and nominally fast. However, in practice foreign investors face a cumbersome, bureaucratic, and corruption-prone environment, so real-world setup typically takes longer than the official targets and a few strategic sectors require special permission.