Processes personal data, in Uzbekistan

Law No. 560-II (11 December 2003) "On Informatization," Arts. 19-20 · Read the law's page

• Where your information resources or systems contain state secrets or confidential information (which includes personal data of individuals), you must protect them under the procedure the Cabinet of Ministers sets for that category.
• For any other information resource or system, you set your own protection procedure; the statute states no external minimum standard for it.

Law No. ZRU-301 (4 October 2011), Arts. 6, 7, 8, 12-1, 14, 19, 22 to 24 and 28 · Read the law's page

• Hold a licence from the Central Bank of Uzbekistan, which also registers the bureau, before operating a credit bureau (Articles 7 and 8).
• Provide a credit report to a credit information user only with the subject's consent, given in writing or as an electronic document that states the date, the user and the purpose (Article 19).
• Do not provide credit information, credit histories or credit reports to anyone who is not a credit information user (Article 24, last part).
• Protect stored credit information against unauthorized access, destruction, alteration, use or disclosure, and keep it for five years (Articles 14 and 23).
• Give the subject a credit report on the subject on request, free of charge once a year, within two working days of the request (Articles 6 and 22).

Law No. ZRU-547 (2 July 2019), Art. 25 · Read the law's page

• An app processing an Uzbek data subject's racial or social-origin, political, religious, ideological, party or trade-union membership, health, private-life, or criminal-record data must not process it unless a case listed in Article 25 applies, such as the subject's written consent (which may be an electronic document), a state-security purpose of the authorized state body, or data the subject has published in publicly available sources.

Law No. ZRU-547 (2 July 2019), Art. 30 · Read the law's page

• An app must let an Uzbek data subject learn whether it holds the subject's data and what they contain, obtain information about the processing and the conditions for access on request, give and withdraw consent to the processing, consent to or withdraw the dissemination of the data in publicly available sources, and require the processing to be suspended temporarily where the data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the purposes of processing.

Law No. ZRU-547 (2 July 2019), Art. 33 · Read the law's page

• An app processing personal data in Uzbekistan must comply with the legislation on personal data, and a legal entity or individual must carry out the instructions the authorized state body issues to remedy a violation of that legislation.

Law No. ZRU-547 (2 July 2019), Arts. 1-14, 18-23, 28, 30-31 · Read the law's page

• An app that processes the personal data of individuals in Uzbekistan must rely on one of the grounds listed in Article 18 of Law ZRU-547, the first of which is the subject's consent, and must not disclose or disseminate the data to third parties without the subject's consent.

Law ZRU-547 (2 July 2019), Article 15; Article 27-1 (as restated by Law ZRU-1125 of 26 March 2026) · Read the law's page

• An app transferring the personal data of an Uzbek data subject outside Uzbekistan must transfer it to a state that ensures uniform protection of data subjects' rights or, where the destination does not, rely on the subject's consent, a protective purpose listed in Article 15, or an international treaty of Uzbekistan. An app must store the biometric data and the genetic data of individuals, and the data of individuals who use the services of telecommunications operators active in Uzbekistan, on the territory of Uzbekistan, and must register the personal data bases it must keep there in the State Register of Personal Data Bases. It may store and process other personal data outside Uzbekistan only if a condition in the third part of Article 27-1 is met.

Law No. O'RQ-764 (15 April 2022) "On Cybersecurity," Arts. 3, 16, 22-24 · Read the law's page

• Notify the State Security Service of cybersecurity incidents and cybercrimes that have occurred affecting your information systems or resources; the statute sets no numeric deadline or severity threshold.
• Take steps to prevent the loss of digital evidence needed to fully investigate the incident, and keep the records needed to analyze it.
• If you investigate the incident yourself because you hold the resources and technical means to do so, report the results to the State Security Service.

Law No. O'RQ-764 (15 April 2022) "On Cybersecurity," Arts. 3, 16, 37 · Read the law's page

• Applies to any legal entity or individual entrepreneur that owns, uses, or disposes of national information resources, or that provides electronic information services using them.
• Prevent unlawful disclosure, theft, loss, corruption, blocking, or falsification of data in your information systems and resources, and act promptly when such a case is detected.
• Comply with the cybersecurity requirements the State Security Service sets for protecting information systems and resources.
• Maintain a functioning capability to respond to cybersecurity incidents, or use an outsourced provider with the State Security Service's authorization if you have none of your own.

Resolution of the Cabinet of Ministers No. 570 (5 October 2022), Annex 1 (Regulation on setting the levels of protection of personal data in processing), paras. 1-2, 9-17 · Read the law's page

• An app that owns or operates a database of Uzbek data subjects' personal data must protect it with organizational and technical measures chosen from the threats to it, and must apply the protection level its threat type and data categories fix: the first level where the database holds special, biometric or genetic data and faces type 1 threats, with the access-authority log, the responsible official and the facility and access-list measures of the lower levels.

Constitution of Uzbekistan (2023), Art. 31(3), correction and destruction of data · Read the law's page

• When a person in Uzbekistan demands it, correct incorrect data about the person, and destroy data about the person that was collected unlawfully or that no longer has a legal basis.

Constitution of Uzbekistan (2023), Art. 31(3), protection of personal data · Read the law's page

• Treat the protection of personal data as a constitutional right of everyone in Uzbekistan: the Constitution gives every person the right to the protection of data about themselves.

Law of the Republic of Uzbekistan ZRU-1115 (21 January 2026), Article 2 (Code of Administrative Responsibility, Article 46-2, Part 2) and Article 1(5) (Law on Informatization, Article 12-1) · Read the law's page

• Do not process personal data unlawfully using artificial intelligence technologies, and do not distribute personal data so processed in the media, telecommunications networks or the internet; Uzbekistan makes this an administrative offence under Article 46-2, Part 2 of its Code of Administrative Responsibility.
• If you own a website, a page of a website or another information resource, or are a blogger, do not allow it to be used, where publicly available information is posted on it, for the unlawful processing of personal data using artificial intelligence technologies or for the distribution of such data (Law on Informatization, Article 12-1).

Law No. 265-I (29 August 1996) on the Protection of Citizens' Health, Art. 45 · Read the law's page

• Do not disclose a person's health data (that the person sought medical help, the person's state of health, the diagnosis and other data obtained in examination and treatment) without the consent of the person or the legal representative, if you learn it in the course of professional, service or other duties, unless a case in Article 45, third part, applies, such as a threat of the spread of infectious diseases.