Uzbekistan

Law of the Republic of Uzbekistan 'On Personal Data' (ZRU-547 of 2 July 2019), Article 3, states that the law applies to relations arising in the processing and protection of personal data regardless of the means of processing used. The extraterritorial hook is indirect rather than express: the localisation article (Article 27-1) and the registration duty in Article 20 attach to any owner or operator of a database containing personal data of citizens of Uzbekistan. In 2021 the authorities treated foreign social platforms as caught by that duty. We could not locate an express scope sentence of the kind found in the EU General Data Protection Regulation, nor any local-representative obligation, so scope is recorded at medium confidence.

Article 27-1 of the Law on Personal Data was rewritten by Law ZRU-1125 of 26 March 2026. Part 2 lists the data that must be kept on Uzbek territory: biometric data of natural persons, genetic data of natural persons, and data of natural persons who are users of telecommunications operators' services. Part 3 allows all other personal data to be stored and processed outside Uzbekistan where one of three conditions is met. The blanket requirement that data about citizens of Uzbekistan be handled on technical means physically located in the country, which drove the 2021 blocking of foreign platforms, no longer appears in the article. Sector overrides: telecoms is a hard wall by statute; banking is not localised but the Central Bank forbids outsourcing the management of a bank's technology and security systems; credit bureaus must keep biometric data in-country; detailed mapping and geodetic material sits under a state-secrecy classification regime; government systems run on the state e-government data centre. We found no localisation rule specific to insurance, securities, education or online gaming, checked 18 August 2026.

Article 15 of the Law on Personal Data allows transfer to states that provide adequate protection of the rights of data subjects; transfer to other states is permitted with the person's consent, where required to protect constitutional order, public order, health or morals, or under an international treaty. Article 15 also lets the state restrict or prohibit cross-border transfer to protect constitutional foundations, morality, health, the rights of citizens and state security. Article 27-1 part 3 as amended in March 2026 adds the adequacy list, standard contractual conditions or binding corporate rules, and compliance with international data management standards as the three routes for storing data abroad. The list of adequate states is Cabinet of Ministers Resolution No. 415 of 29 July 2026, in force 3 August 2026. A full-text search of the national legislation database on 18 August 2026 returned only three documents mentioning adequate protection of personal data — the law, the 2026 amending law and Resolution 415 — which suggests no separate instrument approving standard contractual conditions has been published yet.

Article 8 of the Law on Personal Data names the authorised state body: 'Уполномоченным государственным органом в области персональных данных является Государственный центр персонализации при Кабинете Министров Республики Узбекистан'. Its listed powers include issuing binding orders to legal and natural persons to remedy breaches of personal data legislation, and maintaining the State Register of personal data bases. Cabinet of Ministers Resolution No. 71 of 8 February 2020 sets out the register as a free public service decided within five working days, with refusal permitted only for inaccurate or incomplete information. Penalty provisions exist in both the Code on Administrative Liability (Article 46-1, breach of personal data legislation) and the Criminal Code (Article 141-2, breach of personal data legislation), confirmed present in the official texts. Separately, the State Security Service is the authorised body for cybersecurity under Law ZRU-764 of 15 April 2022, and Uzkomnazorat, the inspection body under the Ministry of Digital Technologies, supervises the information technology and telecommunications sector. We found no published enforcement decisions from any of them on personal data during this run.

Article 10 of the Law on Personal Data ties the storage period to the date the collection and processing purposes are achieved. Article 17 requires destruction of personal data on achieving the purpose, on withdrawal of consent, on expiry of the period fixed by the consent, or on a court decision taking legal effect. Law ZRU-764 of 15 April 2022 on Cybersecurity requires a backup copy with a retention period of not less than the last three months. Where a keeping duty under tax, accounting or banking rules collides with the destruction duty, the specific statutory keeping duty prevails in practice, but we did not find a single provision that states the conflict rule expressly.

Law ZRU-764 of 15 April 2022 on Cybersecurity makes the State Security Service the authorised body and obliges cybersecurity subjects to notify it of cybersecurity incidents that have occurred. A twenty-four hour figure appears in the law but our reading placed it in a different provision, so we do not assert it as the incident deadline. The Law on Personal Data contains no breach notification article. The practical effect is that a company suffering a hack in Uzbekistan reports up the security chain, not to the privacy regulator, and affected individuals have no statutory right to be told.

Trap 1: Article 20 of the Law on Personal Data requires registration in the State Register of personal data bases; Cabinet Resolution No. 71 of 2020 makes it a free notification service decided in five working days, refusable only for inaccurate or incomplete information. Trap 2: administrative liability sits in Article 46-1 of the Code on Administrative Liability and criminal liability in Article 141-2 of the Criminal Code, both headed 'breach of personal data legislation'; we confirmed both articles exist in the official texts but could not extract the penalty figures. Trap 3: biometric and genetic data must be held inside Uzbekistan, and the Central Bank has applied that specifically to credit bureaus from 25 December 2025. Trap 4: the Central Bank's minimum information security and cybersecurity requirements for commercial banks, effective 20 November 2025, prohibit outsourcing the management of a bank's information and communication technology infrastructure and of its information security and cybersecurity systems, and prohibit transmitting state secret information over telecommunications networks. Trap 5: only three documents in the national legislation database mention adequate protection of personal data, so the standard contractual conditions promised by the March 2026 amendment do not appear to have been issued yet.

Dormant switches to watch. First, Article 15 of the Law on Personal Data lets the state restrict or prohibit cross-border transfer to protect constitutional foundations, morality, health, citizens' rights and state security — a power exercisable without consultation. Second, the adequacy list is a Cabinet of Ministers resolution, so countries can be added or removed by a single act. Third, Article 27-1 part 2 is a list of data categories that must stay in the country; adding a category is an amendment to one sentence. Pending or new instruments: Cabinet of Ministers Resolution No. 415 of 29 July 2026 (adequacy list, in force 3 August 2026); Law ZRU-1158 of 13 July 2026 on the Tashkent International Financial Centre, in force 25 July 2026, which is listed among the acts amending the Law on Personal Data and creates a Financial Services Authority with its own acts; Presidential Decree UP-38 of 10 March 2026 approving the Cybersecurity Strategy and improving cybercrime prevention.