LAW OF THE REPUBLIC OF TAJIKISTAN

of August 3, 2018 No. 1537

About personal data protection

Accepted by the Resolution MH MOPT of June 8, 2018, No. 1115

Approved by the Resolution MM MORT of August 2, 2018, No. 561

This Law determines legal and organizational basis of the activities connected with collection, processing and personal data protection.

Chapter 1. General provisions

Article 1. Basic concepts

In this Law the following basic concepts are used:

- biometric personal data - the personal data determining physiological and biological features of the subject;

- personal data - the data on the facts, events and circumstances of life of the subject of personal data allowing to identify his personality;

- collection of personal data - the actions directed to receipt of personal data;

- destruction of personal data - actions as a result of which it is impossible to recover personal data;

- depersonalization of personal data - actions as a result of which becomes impossible without use of the additional information to determine accessory of personal data to the specific subject of personal data;

- base of personal data (further - the database) - set of the arranged personal data;

- the owner of the database (further - the owner) - the state body, physical person and legal entity having according to the legislation of the Republic of Tajikistan right of possession, uses, orders of the database;

- the database operator (further - the operator) - the state body, physical person and legal entity performing based on the legislation of the Republic of Tajikistan or the agreement with the owner processing and personal data protection;

- personal data protection - package of measures, performed for the purpose of prevention of illegal access to personal data;

- personal data processing - the actions directed to record, systematization, storage, change, amendment, extraction, use, distribution, depersonalization, blocking and destruction of personal data;

- use of personal data - the actions with personal data directed to realization of the purposes of activities of the owner, operator and the third party;

- personal data storage - actions for ensuring integrity, confidentiality and availability of personal data;

- distribution of personal data - the actions directed to transfer of personal data to the indefinite group of people;

- the subject of personal data (further - the subject) - physical person to which the relevant personal data belong;

- the third party - person which is not the subject, the owner and the operator, but related circumstances or legal relationship on personal data;

- material carriers - material objects, (including physical fields) in which personal data are reflected in the form of characters, types and sound;

- actions (transaction) of the owner with personal data - collection, storage, refining, transfer, withdrawal, depersonalization and destruction of personal data;

- the mode of confidentiality of personal data - the statutory rules determining availability, transfer and storage conditions of personal data;

- cross-border transfer of personal data - transfer of personal data on the territory of foreign states.

Article 2. Legislation of the Republic of Tajikistan on personal data protection

The legislation of the Republic of Tajikistan on personal data protection is based on the Constitution of the Republic of Tajikistan and consists of this Law, other regulatory legal acts of the Republic of Tajikistan, and also the international legal acts recognized by Tajikistan.

Article 3. Coverage of this Law

1. This Law governs the relations connected with collection, processing and personal data protection.

2. Operation of this Law does not extend on:

- processing and personal data protection by subjects only for personal and family needs if at the same time the rights of other physical and (or) legal entities are not violated;

- forming, storage, accounting and use of the documents of National Archive Fund of the Republic of Tajikistan and other archive documents containing personal data according to the legislation of the Republic of Tajikistan;

- processing and personal data protection, carried according to the legislation of the Republic of Tajikistan to the state secrets.

Article 4. Principles of collection, processing and personal data protection

Collection, processing and personal data protection is based on the following principles:

- observance of the rights and freedoms of the citizen and person;

- legality;

- justice;

- publicity and transparency;

- confidentiality of personal data of limited access;

- equal rights of subjects, owners and operators;

- safety of the personality, society and state.

Chapter 2. State guarantee and regulation of personal data protection

Article 5. State guarantee of personal data protection

1. Personal data protection is guaranteed by the state.

2. Collection and personal data processing are performed in the presence of the certificate of conformity of authorized state body on personal data protection and information security.

3. For ensuring protection of personal data measures for their protection against inadvertent or unauthorized leakage, copying, plunder, loss, change (counterfeit), disclosure or destruction shall be taken.

Article 6. Powers of the President of the Republic of Tajikistan on personal data protection

On personal data protection is included into power of the President of the Republic of Tajikistan:

- approval of regulatory legal acts on personal data protection;

- determination of authorized state body on personal data protection and approval of its provision;

- implementation of other powers, stipulated by the legislation Republic of Tajikistan.

Article 7. Powers of the state authorized body on personal data protection

The state authorized body on personal data protection has the following powers:

- realization of state policy on personal data protection;

- development of regulatory legal acts on personal data protection and representation to the President of the Republic of Tajikistan on approval;

- approval of the list of the personal data necessary and sufficient for implementation of activities by the owner, operator and the third party;

- approval of procedure by the owner, operator and the third party of measures for personal data protection;

- consideration of appeals of physical persons and legal entities concerning personal data protection;

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info