Support Centre

Uzbekistan

Summary

Law: Law of the Republic of Uzbekistan of 2 July 2019 No. ЗРУ-547 on Personal Data (only available in Russian here) ('the Law on Personal Data')

Regulator: The State Personalisation Centre of Uzbekistan and the Cabinet of Ministers of the Republic of Uzbekistan

Summary: The Law on Personal Data came into effect on 1 October 2019 and is the first unified data protection law in the Republic of Uzbekistan. The Law on Personal Data outlines requirements on data subjects' consent, the purposes of processing, and notifying data subjects when transferring their personal data to a third party. In addition, personal data should be stored by operators, data owners and/or third parties in databases, however the Law on Personal Data does not specify whether these need to be located in Uzbekistan. Furthermore, the Law on Personal Data excludes biometric, educational, criminal and health information, previously included in a draft version, from its application. More recently, the Law of the Republic of Uzbekistan of 15 April 2022 No. RK-764 on Cybersecurity (only available in Uzbek and Russian here) ('the Law on Cybersecurity') was enacted and entered into force on 17 July 2022. The Law on Cybersecurity regulates relations in the field of cybersecurity, establishes requirements for cybersecurity of information systems, and establishes an authority specifically for the sector.

Finally, the Cabinet of Ministers adopted, on 5 October 2022, Resolution No. 570 on the approval of certain normative legal documents in the field of processing of personal data ('the Resolution'), which entered into enforced on 7 January 2023. In particular, the Resolution approved two Regulations, namely, the Regulation on determining the levels of protection of personal data during their processing and the Regulation on the requirements for physical objects containing biometric and genetic data and technologies for storing such data outside personal databases.

Insights

The Law of the Republic of Uzbekistan of July 2, 2019 No. ЗРУ-547 on Personal Data (Personal Data Law) (only available in Russian here) is the main law that governs the processing, protection, and requirements related to personal data. While the Personal Data Law establishes general principles of personal data protection and processing, the Uzbek legal system relies on additional regulations to provide more detailed guidelines.

In this context, Resolution No. 570 (the Resolution), approved by the Cabinet of Ministers on October 5, 2022, plays a crucial role in specifying how the protection of personal data must be ensured. In this Insight article, Abdumalik Mukhtorov and Azizbek Suyunboev, from Azizov & Partners Firm of Advocates, aim to shed light on the interplay between the requirements outlined in these two Regulations and the provisions of the Personal Data Law.

On 15 January 2021, Law of 2 July 2019 No. ЗРУ-547 on Personal Data ('the Law') was amended to introduce data localisation requirements which will come into force on 16 April 2021. Ulugbek Abdullaev and Asol Iskhaeva, Counsel and Paralegal respectively at Dentons, answers some key questions on the new requirements.

Feedback