Processes biometric data, in Uzbekistan

Law No. 560-II (11 December 2003) "On Informatization," Arts. 19-20 · Read the law's page

• Where your information resources or systems contain state secrets or confidential information (which includes personal data of individuals), you must protect them under the procedure the Cabinet of Ministers sets for that category.
• For any other information resource or system, you set your own protection procedure; the statute states no external minimum standard for it.

Law No. ZRU-547 (2 July 2019), Art. 26 · Read the law's page

• An app that processes a faceprint, voiceprint, or other biometric or genetic identifier of an Uzbek data subject for identification purposes must have the subject's consent, unless the processing implements an international treaty of Uzbekistan, administers justice or serves enforcement proceedings, or another case provided for by legislation applies. Electronic biometric or genetic data kept outside an information system must be held only on media that exclude unauthorized access.

Law ZRU-547 (2 July 2019), Article 15; Article 27-1 (as restated by Law ZRU-1125 of 26 March 2026) · Read the law's page

• An app transferring the personal data of an Uzbek data subject outside Uzbekistan must transfer it to a state that ensures uniform protection of data subjects' rights or, where the destination does not, rely on the subject's consent, a protective purpose listed in Article 15, or an international treaty of Uzbekistan. An app must store the biometric data and the genetic data of individuals, and the data of individuals who use the services of telecommunications operators active in Uzbekistan, on the territory of Uzbekistan, and must register the personal data bases it must keep there in the State Register of Personal Data Bases. It may store and process other personal data outside Uzbekistan only if a condition in the third part of Article 27-1 is met.

Law No. O'RQ-764 (15 April 2022) "On Cybersecurity," Arts. 3, 16, 22-24 · Read the law's page

• Notify the State Security Service of cybersecurity incidents and cybercrimes that have occurred affecting your information systems or resources; the statute sets no numeric deadline or severity threshold.
• Take steps to prevent the loss of digital evidence needed to fully investigate the incident, and keep the records needed to analyze it.
• If you investigate the incident yourself because you hold the resources and technical means to do so, report the results to the State Security Service.

Law No. O'RQ-764 (15 April 2022) "On Cybersecurity," Arts. 3, 16, 37 · Read the law's page

• Applies to any legal entity or individual entrepreneur that owns, uses, or disposes of national information resources, or that provides electronic information services using them.
• Prevent unlawful disclosure, theft, loss, corruption, blocking, or falsification of data in your information systems and resources, and act promptly when such a case is detected.
• Comply with the cybersecurity requirements the State Security Service sets for protecting information systems and resources.
• Maintain a functioning capability to respond to cybersecurity incidents, or use an outsourced provider with the State Security Service's authorization if you have none of your own.

Resolution of the Cabinet of Ministers No. 570 (5 October 2022), Annex 1 (Regulation on setting the levels of protection of personal data in processing), paras. 1-2, 9-17 · Read the law's page

• An app that owns or operates a database of Uzbek data subjects' personal data must protect it with organizational and technical measures chosen from the threats to it, and must apply the protection level its threat type and data categories fix: the first level where the database holds special, biometric or genetic data and faces type 1 threats, with the access-authority log, the responsible official and the facility and access-list measures of the lower levels.