Tajikistan Law 1537

Law on Protection of Personal Data No. 1537

Flag of TJ
TajikistanOpt-inNational
Back to Regulations Guide

Key Facts

Effective Date
August 3, 2018
Enacted
August 3, 2018
Enforcing Authority
Authorized state body determined by the President of Tajikistan
Consent Model
Opt-in
Applies To
Government and private sector entities processing personal data in Tajikistan

Overview

Tajikistan's 2018 Law on Protection of Personal Data provides a basic framework for data protection. Enforcement is in its infancy, with very low penalties and minimal practical enforcement activity. The authorized enforcement body is determined by the President.

What This Means for Your Website

  • Consent is required for processing personal data of Tajik visitors
  • Penalties are among the lowest globally (up to ~USD 2,515 for citizens)
  • Practical enforcement is minimal
  • Security measures for personal data are required

Key Requirements

The President-designated enforcement body oversees compliance with very low penalties. Legal entities face up to TJS 11,600 (~USD 1,008). Enforcement is administered through the Criminal Code. The law was recently supplemented by the E-Commerce Law for digital transactions.

How ConsentStack Handles This

ConsentStack applies consent-based processing for Tajik visitors as a best-practice measure.

Penalties

Legal entities: up to TJS 11,600 (~USD 1,008). Citizens: up to TJS 29,000 (~USD 2,515). Public officials: up to TJS 2,320.

Maximum Fine
TJS29,000 per violation

Key Requirements

  • Consent required for processing personal data
  • Data protection obligations for data operators
  • Restrictions on data transfers
  • Security measures required

Notable Provisions

  • Enforcement in infancy with minimal activity
  • Among the lowest penalties globally
  • President determines enforcement body
  • Recently adopted E-Commerce Law for digital transactions

Other Central Asia Regulations

Kazakhstan LPDPKazakhstan
Kazakhstan's LPDP requires written consent before collecting personal data with detailed specifications. Data must be stored within Kazakhstan (data localization). A massive 2025 breach affecting 16 million individuals prompted proposals for criminal liability for mass leaks. Breach notification is required within one business day.
Uzbekistan PDLUzbekistan
Uzbekistan's 2019 law requires explicit consent for data collection, third-party provision, and cross-border transfers. Presidential Decree PP-153 (April 2025) marks a shift toward practical enforcement with compulsory breach notifications in the financial sector. A new AI regulation bill is under parliamentary review.
Kyrgyzstan Law 58Kyrgyzstan
Kyrgyzstan's 2008 law provides a basic data protection framework. The May 2025 amendment introducing administrative liability for violations represents a significant step, as previously the law lacked effective penalty mechanisms. Enforcement is still minimal but growing.
Turkmenistan Law 519-VTurkmenistan
Turkmenistan has the weakest data protection framework among Central Asian states. No dedicated data protection authority exists, penalties are very low (120-150 EUR for administrative violations), and practical enforcement is essentially non-existent. No Central Asian state has acceded to Council of Europe Convention 108+.

Frequently Asked Questions

Is Tajikistan enforcing data protection?

Enforcement is in its infancy with minimal practical activity. Penalties are among the lowest globally.

What are Tajikistan's penalties?

Up to TJS 29,000 (~USD 2,515) for citizens and TJS 11,600 (~USD 1,008) for legal entities — among the lowest globally.

Does Tajikistan have a dedicated DPA?

The authorized enforcement body is determined by the President rather than being an independent agency.

Stay compliant with Tajikistan Law 1537

ConsentStack helps you implement Opt-in consent for Tajikistan automatically.

Get started