Cybersecurity law & regulation in Tajikistan (2026)
Cybersecurity in Tajikistan: sectoral rules.
Tajikistan has no consolidated NIS2-style cybersecurity law; obligations are spread across an informatization law, an information-protection law, a 2018 personal data protection law, and dedicated cybercrime articles in the Criminal Code, supplemented by a presidential Information Security Concept. Enforcement authority is fragmented between the telecom/communications regulator and sectoral state bodies, and the personal data law imposes the principal breach-notification duty. The procedural toolkit for investigating cyber incidents remains underdeveloped relative to international (Budapest Convention) standards.
Legal framework
No single comprehensive cybersecurity statute. Information/cyber security is governed by a patchwork of sector- and topic-specific instruments: the Law on Informatization (No. 40, 6 Aug 2001), the Law on Protection of Information (No. 631, 15 May 2002), the Law on Personal Data Protection (No. 1537, 3 Aug 2018), cybercrime provisions in the Criminal Code (Section XII, Chapter 28), and the presidentially-approved Concept/National Strategy on Information Security and ICT for Development. Oversight is split between the Communication Service (Service for Communications) regulator and individual state bodies in their sectors.
Key points: cybersecurity in Tajikistan
No comprehensive cyber law
Cybercrime in Criminal Code
Crimes against information security are codified in Section XII, Chapter 28 of the Criminal Code, including illegal access (Art. 298), illegal interception (Art. 301-1), data/system interference (Arts. 299-300) and misuse of devices (Arts. 302-303). Implementation of several Budapest Convention offences is only partial.
Personal data protection
The Law on Personal Data Protection (No. 1537, 3 Aug 2018) requires operators to secure personal data and is the main source of a breach-notification duty; the authorized data-protection state body is designated by the President.
Breach / incident notification
Under the personal data law, operators must notify the relevant authority and affected individuals in the event of a data breach. There is no published, generally-applicable critical-infrastructure incident-reporting regime or national CERT obligation comparable to NIS2.
Policy / strategy layer
A Concept of Information Security and the National Strategy 'ICT for Development of the Republic of Tajikistan' (Presidential Decree No. 1174, 5 Nov 2003) provide the strategic basis, but these are policy instruments rather than binding sectoral cybersecurity duties on operators.
Fragmented oversight & lawful access
The Communication Service acts as sector regulator while individual state bodies hold parallel powers in their domains. Since 2001 operators must install operational-search (SORM-style) capabilities granting the state access to communications data.
Sources
- coe.int/en/web/octopus/-/tajikist-1
- wipo.int/wipolex/en/legislation/details/10429
- bwcimplementation.org/sites/default/files/resource/TJ_Criminal%20Code%20of%20Rep%20of%20Taj
- natlex.ilo.org/dyn/natlex2/r/natlex/fe/details?p3_isn=109580
- cis-legislation.com/document.fwx?rgn=108952
- cis-legislation.com/docs_list.fwx?countryid=009&page=1
- dlapiperdataprotection.com/?t=law&c=TJ
- dataguidance.com/jurisdictions/tajikistan
Next for Tajikistan: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026