Uzbekistan

The Law of the Republic of Uzbekistan 'On Personal Data' is ZRU-547 of 2 July 2019. Its Article 3 says the law applies to the handling and protection of personal data, whatever means are used. There is no express sentence saying the law reaches companies with no presence in the country. The link is indirect. Two articles carry the weight. They are the storage article (Article 27-1) and the registration duty in Article 20. Both attach to any owner or operator of a database holding personal data of citizens of Uzbekistan. In 2021 the authorities treated foreign social platforms as caught by that duty. We could not find a scope sentence like the one in the EU General Data Protection Regulation. We found no duty to appoint a local representative either. So we record scope at medium confidence.

Article 27-1 of the Law on Personal Data was rewritten by Law ZRU-1125 of 26 March 2026. Part 2 lists the data that must stay on Uzbek soil. That is biometric data about people, genetic data about people, and data about people who use telecommunications operators' services. Part 3 allows all other personal data to be stored and used outside Uzbekistan where one of three conditions is met. The old blanket requirement is gone. It said data about citizens of Uzbekistan had to be handled on equipment physically located in the country. That rule drove the blocking of foreign platforms in 2021. It no longer appears in the article. Industry overrides follow. Telecoms data must stay in the country by law. Banks are not told where to keep data. But the Central Bank forbids them from outsourcing the running of their technology and security systems. Credit bureaus must keep biometric data in the country. Detailed mapping and survey material is classified under state-secrecy rules. Government systems run on the state e-government data centre. We found no rule about where data must sit for insurance, securities, education or online gaming, checked 18 August 2026.

Article 15 of the Law on Personal Data allows transfers to states that adequately protect the rights of the people the data is about. Transfers to other states are allowed with the person's consent. They are also allowed where needed to protect constitutional order, public order, health or morals, or under an international treaty. Article 15 also lets the state restrict or ban cross-border transfers. It can do so to protect constitutional foundations, morality, health, citizens' rights and state security. Article 27-1 part 3, as amended in March 2026, adds three routes for storing data abroad. They are the approved country list, standard contract conditions or binding corporate rules, and meeting international data management standards. The list of approved states is Cabinet of Ministers Resolution No. 415 of 29 July 2026, in force 3 August 2026. We searched the full text of the national legislation database on 18 August 2026. Only three documents mention adequate protection of personal data. They are the law, the 2026 amending law and Resolution 415. That suggests no separate act approving standard contract conditions has been published yet.

Article 8 of the Law on Personal Data names the authorised state body. It is the State Centre for Personalization under the Cabinet of Ministers of the Republic of Uzbekistan. Its listed powers include issuing binding orders to companies and people to fix breaches of personal data law. It also maintains the State Register of personal data bases. Cabinet of Ministers Resolution No. 71 of 8 February 2020 sets up the register as a free public service. It must be decided within five working days. It can be refused only for inaccurate or incomplete information. Penalties exist in two places. The Code on Administrative Liability, Article 46-1, covers breach of personal data law. The Criminal Code, Article 141-2, does the same. We confirmed both are present in the official texts. Separately, the State Security Service is the authorised body for cybersecurity under Law ZRU-764 of 15 April 2022. Uzkomnazorat is the inspection body under the Ministry of Digital Technologies. It supervises the information technology and telecommunications industry. We found no published enforcement decisions on personal data from any of them.

Article 10 of the Law on Personal Data ties the storage period to the date you achieve the purposes you collected the data for. Article 17 requires you to destroy personal data when you achieve the purpose. You must also destroy it when consent is withdrawn. Or when the period set in the consent expires. Or when a court decision takes legal effect. Law ZRU-764 of 15 April 2022 on Cybersecurity requires a backup copy covering at least the last three months. Sometimes a duty to keep data under tax, accounting or banking rules clashes with the duty to destroy it. The specific keeping duty usually wins. We found no single sentence in the law that states that tie-breaker.

Law ZRU-764 of 15 April 2022 on Cybersecurity makes the State Security Service the authorised body. It requires the organisations it covers to tell that service about cybersecurity incidents that have happened. A twenty-four hour figure appears in the law. Our reading found it in a different part of the law, so we do not state it as the incident deadline. The Law on Personal Data has no breach notification article. So a company hacked in Uzbekistan reports up the security chain, not to the privacy regulator. People affected have no legal right to be told.

Trap 1. Article 20 of the Law on Personal Data requires registration in the State Register of personal data bases. Cabinet Resolution No. 71 of 2020 makes it a free notification service, decided in five working days. It can be refused only for inaccurate or incomplete information. Trap 2. Administrative liability sits in Article 46-1 of the Code on Administrative Liability. Criminal liability sits in Article 141-2 of the Criminal Code. Both are headed 'breach of personal data legislation'. We confirmed both articles exist in the official texts, but could not read the penalty figures. Trap 3. Biometric and genetic data must be held inside Uzbekistan. The Central Bank has applied that specifically to credit bureaus from 25 December 2025. Trap 4. The Central Bank set minimum information security and cybersecurity requirements for commercial banks, effective 20 November 2025. Banks may not outsource the running of their information and communication technology infrastructure. They may not outsource the running of their information security and cybersecurity systems. They also may not send state secret information over telecommunications networks. Trap 5. Only three documents in the national legislation database mention adequate protection of personal data. So the standard contract conditions promised by the March 2026 amendment do not appear to have been issued yet.

Powers already held that you should watch. First, Article 15 of the Law on Personal Data lets the state restrict or ban cross-border transfers. It can do so to protect constitutional foundations, morality, health, citizens' rights and state security. No consultation is needed. Second, the approved country list is a Cabinet of Ministers resolution. Countries can be added or removed by a single act. Third, Article 27-1 part 2 lists the data that must stay in the country. Adding a category means amending one sentence. New or pending laws follow. Cabinet of Ministers Resolution No. 415 of 29 July 2026 is the approved country list, in force 3 August 2026. Law ZRU-1158 of 13 July 2026 on the Tashkent International Financial Centre came into force on 25 July 2026. It is listed among the acts amending the Law on Personal Data. It creates a Financial Services Authority with its own rules. Presidential Decree UP-38 of 10 March 2026 approved the Cybersecurity Strategy and improved cybercrime prevention.