UzbekistanLaw on Personal Data, cross-border transfer and citizen data localization
Law ZRU-547 (), Article 15; Article 27-1 (as restated by Law ZRU-1125 of )
In force since .
A cross border transfer rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- An app transferring the personal data of an Uzbek data subject outside Uzbekistan must transfer it to a state that ensures uniform protection of data subjects' rights or, where the destination does not, rely on the subject's consent, a protective purpose listed in Article 15, or an international treaty of Uzbekistan. An app must store the biometric data and the genetic data of individuals, and the data of individuals who use the services of telecommunications operators active in Uzbekistan, on the territory of Uzbekistan, and must register the personal data bases it must keep there in the State Register of Personal Data Bases. It may store and process other personal data outside Uzbekistan only if a condition in the third part of Article 27-1 is met.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
Cabinet Resolution No. 415 of designates the Migration and Personalization Department under the Ministry of Internal Affairs as the authorized state body for its own provisions and makes it responsible for preparing proposals to add foreign states to, or remove them from, the list of states that ensure uniform protection of personal data.
- As of
- Open questions
- Is the Давлат персоналлаштириш маркази ("State Personalization Center") that Article 8 names as the authorized state body still the body whose approvals Article 27-1 calls for in the words ваколатли давлат органи тасдиқлайдиган талабларга ("requirements that the authorized state body approves"), given that Cabinet Resolution No. 415 of designates the Migration and Personalization Department under the Ministry of Internal Affairs as the authorized state body for its own provisions?
- What requirements apply to стандарт шартномавий шартлар ёки мажбурий корпоратив қоидалар ("standard contractual terms or binding corporate rules") that the authorized state body approves under the third part of Article 27-1?
- Which standards are on the list of шахсга доир маълумотларни бошқариш ва сақлаш соҳасидаги халқаро стандартларга ("international standards in the field of managing and storing personal data") that the authorized state body approves under the third part of Article 27-1?
- Does the storage duty in the second part of Article 27-1 for data of users held телекоммуникациялар операторларидаги ("at telecommunications operators") reach an app provider that is not itself a telecommunications operator, a term the Law does not define?
- Does the duty to store жисмоний шахсларнинг биометрик маълумотлари ("biometric data of individuals") in Uzbekistan reach individuals who are not Uzbek citizens, given that the first part of Article 27-1 speaks of the personal data of Ўзбекистон Республикаси фуқароларининг ("citizens of the Republic of Uzbekistan")?
What it makes you log
Logging duty
Article 15 allows transfer to states that ensure uniform protection of subjects' rights, and elsewhere only with the subject's consent or in the listed public-interest cases; Article 27-1 requires biometric and genetic data and the subscriber data of telecommunications operators active in Uzbekistan to be stored in Uzbekistan, and lets other data be stored and processed abroad where the destination is recognized as protective, the operator adopts approved standard contractual terms or binding corporate rules, or it follows approved international standards. These are conditions on the transfer and on where data are kept and set no log or record duty and no audit. The entry of databases that must be kept in Uzbekistan in the state register (Article 20, first part) is a filing and is outside this row. The first sentence of Article 27-1 refers to the personal data of citizens of Uzbekistan; a nationality test takes no hook value. The hook coded is the telecommunications-operator prong, which applies the localization rule to operators carrying out their activity in the country.
- Kind
- None
- As of
What this law does
Article 15 defines cross-border transfer as the transfer of personal data by an owner or operator outside the territory of Uzbekistan. Article 15 provides that transfer is made to the territory of foreign states that ensure uniform protection of the rights of data subjects. Where the destination state does not ensure uniform protection, Article 15 permits transfer if the subject has consented to the transfer of the subject's personal data.
Where the destination state does not ensure uniform protection, Article 15 also permits transfer if it is necessary to protect the constitutional order, public order, the rights and freedoms of citizens, or public health and morals. Where the destination state does not ensure uniform protection, Article 15 also permits transfer in the cases provided for by the international treaties of Uzbekistan.
Article 15 provides that transfer may be prohibited or restricted to protect the foundations of the constitutional order, the morals, health, rights and legitimate interests of citizens, national defense and state security. Law ZRU-1125 of restated Article 27-1 and entered into force on . The second part of Article 27-1 lists personal data that must be stored on the territory of Uzbekistan.
The list includes the biometric data of individuals, their genetic data, and the data of individuals who use the services of telecommunications operators active in Uzbekistan. Personal data not covered by the second part of Article 27-1 may be stored and processed outside Uzbekistan if one of three listed conditions is met.
The conditions are recognition of the foreign state as one that ensures uniform protection of personal data, adoption by the operator of standard contractual clauses or binding corporate rules that meet requirements approved by the authorized state body, and compliance by the operator with international standards on a list that body approves.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .