LexLint.ioBeta

Know the law your code answers to.

Law / Uzbekistan

Law on Cybersecurity, cybersecurity incident notification duty

Law No. O'RQ-764 () "On Cybersecurity," Arts. 3, 16, 22-24

In force since .

A vulnerability and incident reporting rule binding private bodies.

Enforcement body
State Security Service of the Republic of Uzbekistan

What it requires

  • Notify the State Security Service of cybersecurity incidents and cybercrimes that have occurred affecting your information systems or resources; the statute sets no numeric deadline or severity threshold.
  • Take steps to prevent the loss of digital evidence needed to fully investigate the incident, and keep the records needed to analyze it.NIST CSF 2.0RS.AN-07
  • If you investigate the incident yourself because you hold the resources and technical means to do so, report the results to the State Security Service.NIST CSF 2.0RS.CO-03

These lines are LexLint's reading of the law's text.

In the frameworks

NIST CSF 2.0
  • RS.AN-07Incident data and metadata are collected, and their integrity and provenance are preserved
  • RS.CO-03Information is shared with designated internal and external stakeholders

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Article 37 refers a violation of the cybersecurity legislation generically to liability "in the established manner," which the statute's own official commentary at that article identifies as the Code of Administrative Liability (Arts. 155, 202-2) and the Criminal Code (Ch. XX-1); the Law itself states no maximum penalty for either track.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

A "cybersecurity subject," defined as any legal entity or individual entrepreneur that owns, uses, or disposes of national information resources, or that provides electronic information services using them, must notify the State Security Service of cybersecurity incidents and cybercrimes as they occur, take measures to prevent the loss of digital evidence needed to fully expose the incident, and keep the records needed to analyze it.

The Law sets no numeric reporting deadline and no severity or materiality threshold for this duty. Where the affected resource's owner has the resources and technical means to investigate the incident itself, it may do so, but must then report the results to the State Security Service.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example  ·  Lint your app

Page updated .