UzbekistanLaw on Informatization, information security duty for information resource and system owners
Law No. 560-II () "On Informatization," Arts. 19-20
In force since .
A security baseline statutes rule binding public and private bodies.
What it requires
- Where your information resources or systems contain state secrets or confidential information, you must protect them under the procedure the Cabinet of Ministers sets for that category.
- For any other information resource or system, you set your own protection procedure; the statute states no external minimum standard for it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does any Cabinet of Ministers implementing act set a baseline that reaches an information-system owner outside the state-secret and confidential-information category the Law itself makes mandatory?
What this law does
State bodies, legal entities, and individuals must protect information resources and information systems that contain state secrets or confidential information; the Cabinet of Ministers sets the procedure for that protection. For any other information resource or system whose improper handling could harm its owner or another party, the owner or holder sets its own protection procedure, and the Law states no external minimum standard for it.
The Law's own general-responsibility clause (Art. 23) refers a violation to liability "in accordance with the established procedure" without naming an authority or a penalty.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .