UzbekistanRegulation on levels of protection of personal data, special, biometric and genetic data
Resolution of the Cabinet of Ministers No. 570 () Annex 1 (Regulation on setting the levels of protection of personal data in processing), paras. 1-2, 9-17
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that owns or operates a database of Uzbek data subjects' personal data must protect it with organizational and technical measures chosen from the threats to it, and must apply the protection level its threat type and data categories fix: the first level where the database holds special, biometric or genetic data and faces type 1 threats, with the access-authority log, the responsible official and the facility and access-list measures of the lower levels.
These lines are LexLint's reading of the law's text.
What it makes you log
What the log must hold
Access record
Logging duty
Paragraph 17 requires, for the first level of protection, that changes in an owner's or operator's employee's authority to access the personal data in the databases be registered automatically in an electronic security log. Paragraph 16 lets only employees or authorized persons who need it for their duties access the electronic message log of the database, and names no regulator, court or data subject entitled to it, so no accessor is coded. The annex sets no retention period for the log and requires no audit of it. Paragraph 19 makes those at fault for breaching the annex answerable under legislation. The annex names no territorial clause.
- Kind
- Explicit
- As of
- Provision
- Annex 1, para. 17 (electronic security log of changes in employee access authority)
- Trigger
- personal_data_processing
What this law does
Annex 1 to Cabinet of Ministers Resolution No. 570 of sets four levels of protection for personal data processed in databases. The first level of protection applies where the database faces type 1 threats and holds special, biometric or genetic data. The first level of protection requires the owner or operator to record changes in an employee's authority to access the personal data automatically in an electronic security log.
The third level of protection requires the owner or operator to appoint an official or employee responsible for the security of the personal data in the database.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .