Is a lender, in Uzbekistan

Law No. ZRU-301 (4 October 2011), Arts. 6, 7, 8, 12-1, 14, 19, 22 to 24 and 28 · Read the law's page

• Hold a licence from the Central Bank of Uzbekistan, which also registers the bureau, before operating a credit bureau (Articles 7 and 8).
• Provide a credit report to a credit information user only with the subject's consent, given in writing or as an electronic document that states the date, the user and the purpose (Article 19).
• Do not provide credit information, credit histories or credit reports to anyone who is not a credit information user (Article 24, last part).
• Protect stored credit information against unauthorized access, destruction, alteration, use or disclosure, and keep it for five years (Articles 14 and 23).
• Give the subject a credit report on the subject on request, free of charge once a year, within two working days of the request (Articles 6 and 22).

Law No. O'RQ-764 (15 April 2022) "On Cybersecurity," Arts. 26-29 · Read the law's page

• Keep the information systems of your critical information infrastructure objects running without interruption (Article 28).
• Meet the cybersecurity requirements the authorized state body, the State Security Service, sets for your critical information infrastructure objects (Article 29).
• Install and use monitoring systems that meet the technical requirements for the hardware, software and hardware-software tools used, and carry out the instructions the State Security Service gives to remove violations found (Article 28).
• Give the State Security Service access to your monitoring systems or objects so it can monitor the state of cybersecurity, and connect your objects' cybersecurity system to its monitoring and incident management system when it so decides (Articles 28 and 29).
• Have the staff responsible for the cybersecurity of the objects pass the attestation the State Security Service holds, and tell it when the registry data for an object change (Articles 28 and 29).
• Applies to a subject of critical information infrastructure, meaning a state body or organization, or a legal entity or individual entrepreneur, that holds a critical information infrastructure object by ownership, lease or another lawful basis, in fields such as public administration, defense, energy, health, the banking and finance system, transport and information and communication technology (Article 3); categorization of an object and its entry in the unified registry follow the State Security Service's rules (Articles 26-28).

Law No. O'RQ-764 (15 April 2022) "On Cybersecurity," Arts. 3, 16, 22-24 · Read the law's page

• Notify the State Security Service of cybersecurity incidents and cybercrimes that have occurred affecting your information systems or resources; the statute sets no numeric deadline or severity threshold.
• Take steps to prevent the loss of digital evidence needed to fully investigate the incident, and keep the records needed to analyze it.
• If you investigate the incident yourself because you hold the resources and technical means to do so, report the results to the State Security Service.

Order No. 118 of the Chairman of the State Security Service of the Republic of Uzbekistan (24 October 2024, registered by the Ministry of Justice under 3570), Temporary Regulation on categorizing critical information infrastructure objects, paras. 3-6, 14, 15 and 18 · Read the law's page

• Categorize each of your critical information infrastructure objects at least once a year as a high, medium or low level object, through a commission you head or an organization agreed with the State Security Service, and complete the categorization within thirty working days (paragraphs 3-6 and 9).
• Draw up an act of the categorization result with the contents paragraph 10 lists, and within five working days of the act send the State Security Service your application to enter the object in the temporary unified registry, on the form in Annex 1 (paragraphs 10-14).
• Review each object's category at least once a year, and within thirty working days after you add or remove software or technical tools or change the object's configuration, cyber protection tools, scale or purpose; send the new act and application within five working days (paragraphs 15 and 18).
• Applies to the owner of a critical information infrastructure object, meaning a state body or organization, or a legal entity or individual entrepreneur, that holds the object by ownership, lease or another lawful basis, in fields such as public administration, defense, energy, health, the banking and finance system, transport, information and communication technology and telecommunications (paragraphs 1 and 9).