UzbekistanLaw on Personal Data, comprehensive regime and lawful bases
Law No. ZRU-547 (), Arts. 1-14, 18-23, 28, 30-31
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes the personal data of individuals in Uzbekistan must rely on one of the grounds listed in Article 18 of Law ZRU-547, the first of which is the subject's consent, and must not disclose or disseminate the data to third parties without the subject's consent.
These lines are LexLint's reading of the law's text. Also read by: Resolution No. 21 of the Plenum of the Supreme Court of the Republic of Uzbekistan, , On the practice of application by courts of the legislation on the protection of personal non-property rights and other intangible benefits (recorded ).
Who enforces it
Settledness
- As of
- Case link
- https://lex.uz/mact/-7901164
- Case citation
- Resolution No. 21 of the Plenum of the Supreme Court of the Republic of Uzbekistan, , On the practice of application by courts of the legislation on the protection of personal non-property rights and other intangible benefits
- Open questions
- Which purposes count as ижтимоий аҳамиятга молик мақсадларга эришиш учун ("to achieve purposes of social significance") in the Article 18 ground for processing to exercise the rights and legitimate interests of the owner, the operator or a third party, a phrase Article 4 does not define?
- Does the exclusion in Article 3 for processing by an individual for шахсий ва маиший мақсадларда ("for personal and household purposes") cover an individual who processes personal data in a professional or commercial activity, a point Article 3 does not address?
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 21 requires consent to be given in a form that allows the fact of its receipt to be confirmed, and Article 31 obliges the owner or operator, in the cases the legislation provides, to produce evidence that the subject's consent was obtained. Both need a kept record of consent. The row's other articles ask for no record: Article 20 has databases entered in the state register of personal data databases and Article 22 and 23 set notices to the subject, which are a filing and notices and not records the operator keeps, and Article 10 ties the storage period of the data to the purpose, which limits the data. The articles name no period for the consent record, no audit and no body entitled to it. Article 3 states that the Law applies whatever the means of processing, which is no territorial hook, so none is coded.
- Kind
- Implicit
- As of
- Provision
- Law ZRU-547, Article 21, first part, with Article 31, second part (consent must be provable)
- Trigger
- consent_or_optout
What this law does
Law ZRU-547 applies to relations that arise in the processing and protection of personal data regardless of the means of processing used, including information technologies. Article 3 does not apply the Law to processing of personal data by an individual for personal and household purposes. Article 3 also does not apply the Law to relations arising in operational-search, intelligence and counterintelligence activity, in combating crime and in maintaining public order.
Article 3 also provides that relations on the processing and protection of personal data in a territory where a special legal regime has been established by a Constitutional Law are governed by rules different from those the Law sets. Article 4 defines the operator of a personal data database as a state body, individual or legal entity that carries out the processing of personal data.
Article 4 defines the owner of a personal data database as a state body, individual or legal entity that has the right to possess, use and dispose of the database. Article 4 defines a third party as any person, other than the subject, owner or operator, who is connected with them through circumstances or relations concerning the processing of personal data. Article 18 lists the grounds on which personal data are processed, the first of which is the subject's consent to the processing.
Article 18 also permits processing that is necessary to perform a contract to which the subject is a party. Article 21 provides that the subject gives consent in any form that allows the fact of obtaining it to be confirmed. Article 21 provides that the subject revokes consent in the form in which it was given or in writing, including as an electronic document.
Article 20 provides that only the personal data bases that must be stored in Uzbekistan under the second part of Article 27-1 are registered in the State Register of Personal Data Bases. Article 23 requires the owner or operator to notify the subject in writing within three days when personal data are given to a third party.
Article 28 requires the owner, the operator and other persons permitted to use personal data not to disclose or disseminate them to third parties without the subject's consent. Article 31 requires the owner and the operator to take the necessary legal, organizational and technical measures to protect personal data.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .