Law on Personal Data, cross-border transfer and citizen data localization

Law No. ZRU-547 (2 July 2019), Art. 15; Art. 27-1 (added 2021, in force April 2021)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 October 2019.

A cross border transfer rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app transferring the personal data of an Uzbek data subject outside Uzbekistan must rely on the destination state's adequate protection, or on consent, statutory necessity, or a treaty where adequacy is absent. Separately, an app processing the personal data of Uzbek citizens, including a voiceprint or other biometric identifier, over the internet must collect, systematize, and store that data on technical means physically located in Uzbekistan and register the database in the State Register of Personal Data Bases. Several major platforms have been blocked in Uzbekistan for noncompliance with this storage duty.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Art. 15 permits cross-border transfer where the destination state ensures adequate protection, or, where it does not, on subject consent, statutory necessity, or an international treaty; transfer may also be restricted for constitutional-order, morality, health, rights, defense, or state-security reasons.

Art. 27-1, added by a 2021 amendment reported in force April 2021, is narrower and separate: when processing the personal data of citizens of Uzbekistan using information technologies, including the internet, the owner or operator must collect, systematize, and store that data on technical means physically located in Uzbekistan and register the database in the State Register of Personal Data Bases.

Enforcement of Art. 27-1 is documented: the State Inspectorate for Control in the Sphere of Informatization and Telecommunications blocked Twitter, TikTok, VKontakte, Skype, and WeChat in July 2021, and Facebook, Instagram, LinkedIn, Odnoklassniki, Telegram, and YouTube in November 2021, citing failure to store Uzbek users' data domestically; several were later unblocked, and TikTok was reported still restricted as of the most recent secondary reporting located.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
processes_voice

Read the law

official text, lex.uz, Uzbekistan's official legislation portal

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app