Data protection & privacy law in Tajikistan (2026)
Data protection in Tajikistan: comprehensive law.
Tajikistan has a comprehensive, generally applicable personal-data protection law (No. 1537, in force since 3 August 2018) covering the collection, processing and protection of personal data of identifiable individuals. The state authorized body is the Communication Service under the Government of the Republic of Tajikistan, with sectoral state bodies holding parallel powers in their areas; there is no separate, fully independent GDPR-style data-protection authority. The regime is largely untested in practice, with little or no published case law, and enforcement runs through administrative and criminal liability.
Legal framework
Law of the Republic of Tajikistan No. 1537 of 3 August 2018 "On Personal Data Protection," supplemented by subsidiary acts of the Communication Service (Aloqa) under the Government of the Republic of Tajikistan, which acts as the state authorized body.
Key points: data & privacy in Tajikistan
Comprehensive law
Law No. 1537 of 3 August 2018 "On Personal Data Protection" governs collection, processing and protection of personal data across sectors, built on the Constitution and recognized international acts. It defines personal data as information about facts, events and circumstances of an individual's life that allows identification.
Supervisory authority
The state authorized body is the Communication Service (Aloqa) under the Government of the Republic of Tajikistan, responsible for implementing state policy, drafting regulatory acts and handling individuals' complaints; sectoral state bodies retain parallel powers within their domains.
Consent and legal basis
Controllers (owners/operators) and processors must generally obtain the data subject's consent to process personal data; alternative grounds such as binding corporate rules or standard contractual clauses are not provided for under the law.
No mandatory database registration
There is no requirement to pre-notify or register databases with the regulator before collecting, processing or maintaining personal data, distinguishing the regime from some other CIS notification-based systems.
Cross-border transfers
Transborder transfer of personal data is permitted with the data subject's consent or where the foreign state ensures adequate protection; the law does not define "adequate protection" or set out an evaluation procedure.
Data subject rights and enforcement
Data subjects may demand clarification, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or no longer needed. Implementation measures are detailed in the Communication Service decree of 02.07.2021 (No. 2.21-11), with breaches subject to administrative and criminal liability; the law remains largely untested with little case law.
Sources
Next for Tajikistan: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026