Uzbekistan personal data law: a guide for IT teams

You run an app, a SaaS or a fintech product, and your servers sit in Frankfurt, Dublin or Virginia. Uzbek users sign up, upload a selfie, enter a phone number. Do you have to move any of it? Do you have to register anything? The rules are shorter than most guides make them sound, but three of them can stop a launch. Building for the wider market? See also regulation of startups in Uzbekistan and our fintech product advisory.

Short answer

Do I have to store personal data in Uzbekistan? Only three kinds: biometric data, genetic data, and data of people who use a telecom operator's services in Uzbekistan (art. 27-1 part 2 of the personal data law). Everything else may be stored and processed abroad if you meet one of three conditions (part 6):

1. the country is recognized as ensuring adequate protection — the Cabinet's list names 49 (Resolution 415 of 29 July 2026);
2. you adopt and follow standard contractual clauses or binding corporate rules that meet the authorized body's requirements;
3. you follow international personal-data standards from a list the authorized body approves.

Two things to know before you plan. The requirements for route 2 were ordered on 29 July 2026 with a three-month deadline, and we found no approved requirements in the Lex database on 14 October 2026. And the localized categories are registered in a state register (see below).

The law is ZRU-547 of 2019, amended since, with a Cabinet resolution on the country list. Older guides online describe a broader localization rule. Note that the Administrative Liability Code (art. 46-2) and the Criminal Code (art. 141-2) still use that older wording: they penalize failing to collect, systematize and store citizens' data processed through IT and the Internet on technical means physically in Uzbekistan and in registered bases. How this sits with the narrower art. 27-1 the text does not say, so ask before you rely on the narrower rule alone.

Owner, operator, third party

The law uses three roles (art. 4):

• the owner of a personal data base has the right to possess, use and dispose of it;
• the operator is the body or person that processes the data;
• a third party is anyone else tied to them through the processing.

The law also lets an owner or operator hand processing to a third party, but only with the person's written (or electronic) consent, to perform a contract with that person, or where legislation allows it (art. 31 parts 15–18).

The law does not say who is who in a modern stack. This is our reading, for planning:

A person who processes data purely for personal and household purposes is outside the law (art. 3). Also outside it: archive documents, state secrets and defense or national-security data, data from law-enforcement, intelligence and anti-money-laundering work, and territories with a special legal regime.

What must stay in Uzbekistan

The law defines biometric data as data characterizing a person's anatomical and physiological features (art. 26), and genetic data as data on inherited or acquired characteristics from a biological sample. It gives no list of examples. Applying it to your data:

Localized data stays in Uzbekistan. Whether you may also keep a copy abroad is not answered by the text of art. 27-1: the part speaks of mandatory storage in Uzbekistan and sets conditions for other data. Do not assume a mirror abroad is allowed without advice.

Biometric and genetic data in electronic form outside information systems may be kept only on carriers that rule out unauthorized access (art. 26 part 4).

Sending data abroad

Two articles apply. Art. 27-1 sets where non-localized data may be stored and processed. Art. 15 deals with transfers: a transfer goes to a state with adequate protection; to a state without it, only with the person's consent, to protect the constitutional order, public order, citizens' rights and freedoms, or public health and morals, or under an international treaty (art. 15 parts 2–6). The text does not explain how the two interact. If you pick a route, check it against both.

Route 1: the country list. Resolution 415 names 49 states and territories (annex): all 27 EU members, Iceland, Liechtenstein, Norway, the UK and its Crown dependencies (Guernsey, Jersey, Isle of Man), the Faroe Islands, Andorra, Switzerland, Argentina, Brazil, Canada, Hong Kong, Israel, Japan, South Korea, New Zealand, Russia, Singapore, Uruguay and the United States. The United States is on the list only for companies operating under the EU–US Data Privacy Framework. Countries not on it include the UAE, Turkey, Kazakhstan, India, China and Australia.

For listed states, data moving through information systems set up under international agreements goes with no extra permit and no notice to the authorized body, provided you take measures to prevent leaks (p. 4).

Route 2: contractual clauses. For states not on the list, the resolution says transfer is allowed when the legal, organizational and technical conditions set by the authorized body are met (p. 4). The requirements for standard contractual clauses and binding corporate rules are due three months after 29 July 2026 (p. 7). Until they are published, we cannot tell you what a compliant clause looks like. A US vendor outside the Privacy Framework, or a cloud region in an unlisted country, sits here.

Route 3: international standards. The list is the authorized body's to approve. We did not find it in the Lex database.

The state register

Registration is by notification: you file an application with the authorized body (art. 20 part 2). The law says that bases subject to mandatory storage in Uzbekistan must be registered (part 1). Separately, art. 31 part 13 lists registration of “bases it owns or processes” among the owner's and operator's duties. Resolution 71 (p. 5) also says, without limiting it to localized data, that owners and operators must register their personal data bases. We read this as: register at least the localized bases, and ask us if you hold other bases that no exemption covers.

Bases that do not need registering (art. 20 parts 4–10) include those that hold only names, data processed without automation, data processed under labor law, data a person made public, and one-time entry passes.

How it works (Resolution 71):

Incorrect or incomplete data is grounds for refusal, and the applicant answers for wrong data (p. 11, p. 21). Resolution 71 pre-dates the current art. 20, so check the current wording of its process before filing.

Consent and user requests

Build these into the product:

• Consent in any form that lets you prove it was given (art. 21 part 1). A checkbox with a log can be proof; the law does not say it is enough. You must be able to show the consent when the law requires it (art. 31 part 7).
• Written or electronic-document consent for special data (health, religion, politics, criminal record, private life — art. 25), and for minors and incapacitated persons through a parent or legal representative (art. 21 parts 2–4).
• Withdrawal in the form in which consent was given, or in writing (art. 21 part 7). After withdrawal you must destroy the data (art. 17).
• A new purpose needs new consent (art. 19 part 3).
• Tell the person in writing about the purposes and their rights when you add their data to a base (art. 23 part 1), and within three days when you give their data to a third party (part 2).
• Information on request: whether you process their data, why, who has access, how long you keep it, and any cross-border transfer (art. 22).
• Electronic requests: you must let people file a request to suspend processing or destroy their data electronically (art. 31 part 10).
• Decisions based solely on automated processing that affect a person's rights and have legal effects are allowed only with written (or electronic-document) consent, to perform a contract with the person, or where legislation allows. You must explain the process, accept an objection, and answer in writing within ten days (art. 24).
• A responsible unit or officer for data work (art. 31 part 20).

Leaks and who regulates

Leaks. We found one breach-notification deadline: when a leak is detected during a cross-border transfer, the operator must tell the authorized body within 24 hours and give a detailed report on causes and fixes within 72 hours (Resolution 415 p. 4). The database shows no general breach-notification rule in the personal data law itself. The cybersecurity law (ZRU-764, art. 16) separately obliges cybersecurity subjects to report incidents to the authorized body; it sets no clock. Sector rules for banks and payment organizations may add their own; this guide does not cover them.

Regulator. The law names the State Personalization Center under the Cabinet as the authorized body (art. 8). Resolution 415, and Resolution 71 as amended on 24 December 2025, give the role of “authorized state body” to the Migration and Personalization Department under the Ministry of Internal Affairs. Address your filings to the body named on the service page you use, and confirm before you file.

Penalties. Art. 33 says only that violators are liable “in the established procedure”. The penalties are in the Administrative Liability Code (art. 46-2) and the Criminal Code (art. 141-2), and both still use the older localization wording (see above). We do not quote amounts here.

Checklist

• List the data you collect and mark biometric, genetic and telecom-user data.
• Keep the localized categories on servers in Uzbekistan and register those bases.
• For everything else, name your route per vendor: listed country, clauses (when published), or standards.
• Check every US vendor for Data Privacy Framework status.
• Decide who is owner and operator in each flow and write it into contracts.
• Add consent screens with logging, a withdrawal path and an electronic request form.
• Send the written notice on adding data and on giving it to a third party (3 days).
• Appoint a responsible person; write a 24-hour/72-hour leak runbook for transfers.
• Recheck the clause requirements and the standards list after 29 October 2026.

Questions

Can we keep everything in Frankfurt? Not if it includes biometric, genetic or telecom-user data. Other data can sit in Germany, which is on the list.

Is our phone-number login data localized? On our reading, no: the telecom category covers users of telecom operators' services. If you are such an operator, yes.

We use a US cloud. What do we do? If the provider is certified under the Data Privacy Framework, the United States entry applies. If not, you need another route, and the clause rules are not yet published.

Is a checkbox enough for consent? The law accepts any form that proves it was given. A logged checkbox may do for ordinary data; for special data you need written or electronic-document consent.

Sources: Law No. ZRU-547 of 2 July 2019 “On Personal Data” (arts. 3, 4, 8, 15, 17, 19–26, 27-1, 31, 33); Cabinet of Ministers resolution No. 415 of 29 July 2026; Cabinet of Ministers resolution No. 71 of 8 February 2020. Checked 14 October 2026. Quotations from the regulation are our translation of the Uzbek text.

Checked against the law in Lex on 14 October 2026 · Juris Advisory