Uzbekistan

Point 1 of the order approves ethics rules for creating, deploying and using solutions based on artificial intelligence. The Ministry of Justice registered the order on 14 March 2026 under number 3787. The rules define AI participants as the natural persons and legal persons in Uzbekistan that develop, deploy or use artificial intelligence technologies and systems. Those participants must strictly comply with the rules.

Participants must not accept a decision taken by an artificial intelligence technology or system as the final decision. Developers and deployers must keep their technologies and systems under human oversight and review and make sure that a person takes the final decision. Developers and deployers must make the algorithms of their technologies and systems transparent and understandable. Developers and deployers must prevent possible bias in their technologies and systems.

Developers and deployers must give open information on the capabilities, limits and possible risks of their technologies and systems. Developers and deployers must tell users the rules of use, what the system may and may not be used for, and that AI-based solutions or decisions are not always correct and their results may be used as advice or information only. Developers and deployers must write and publish a user guide for their technologies and systems.

Participants must not rely only on the conclusions of information resources created with artificial intelligence or of AI-based information systems when taking decisions that bear on a person's rights, freedoms and legitimate interests or decisions in health care. The order takes effect three months after its official publication. The national legislation database published the order on 16 March 2026. The lex.uz record gives 17 June 2026 as the date the order took effect.

Article 7-1, inserted into the Law on Informatization by Law No. ZRU-1115 (21 January 2026), reaches any information resource created using artificial intelligence and any information system that functions on artificial-intelligence technology. Such a resource or system must not harm a person's life, health, freedom, honor, or dignity, or violate the person's other inalienable rights.

A legally significant decision affecting a person's rights or freedoms may not rest exclusively on the conclusions of an information resource or system built on artificial-intelligence technology.

Article 26 defines biometric data as personal data characterizing the anatomical and physiological characteristics of the subject, and gives no illustrative list naming face, voice or fingerprint. Article 26 defines genetic data as personal data on the inherited or acquired characteristics of the subject that results from analysis of the subject's biological profile or of another element that yields alternative information.

Biometric and genetic data used to identify the subject may be processed only with the subject's consent, except in cases connected with the implementation of the international treaties of Uzbekistan, the administration of justice and enforcement proceedings, and in other cases provided for by legislation. Electronic biometric and genetic data that are used or stored outside information systems may be held only on material media that exclude unauthorized access to them.

Article 26 sets no retention or destruction period of its own for biometric data, and the grounds for destroying personal data in Article 17 apply, including achievement of the purpose of processing.

Law ZRU-547 applies to relations that arise in the processing and protection of personal data regardless of the means of processing used, including information technologies. Article 3 does not apply the Law to processing of personal data by an individual for personal and household purposes. Article 3 also does not apply the Law to relations arising in operational-search, intelligence and counterintelligence activity, in combating crime and in maintaining public order.

Article 3 also provides that relations on the processing and protection of personal data in a territory where a special legal regime has been established by a Constitutional Law are governed by rules different from those the Law sets. Article 4 defines the operator of a personal data database as a state body, individual or legal entity that carries out the processing of personal data.

Article 4 defines the owner of a personal data database as a state body, individual or legal entity that has the right to possess, use and dispose of the database. Article 4 defines a third party as any person, other than the subject, owner or operator, who is connected with them through circumstances or relations concerning the processing of personal data. Article 18 lists the grounds on which personal data are processed, the first of which is the subject's consent to the processing.

Article 18 also permits processing that is necessary to perform a contract to which the subject is a party. Article 21 provides that the subject gives consent in any form that allows the fact of obtaining it to be confirmed. Article 21 provides that the subject revokes consent in the form in which it was given or in writing, including as an electronic document.

Article 20 provides that only the personal data bases that must be stored in Uzbekistan under the second part of Article 27-1 are registered in the State Register of Personal Data Bases. Article 23 requires the owner or operator to notify the subject in writing within three days when personal data are given to a third party.

Article 28 requires the owner, the operator and other persons permitted to use personal data not to disclose or disseminate them to third parties without the subject's consent. Article 31 requires the owner and the operator to take the necessary legal, organizational and technical measures to protect personal data.

Article 15 defines cross-border transfer as the transfer of personal data by an owner or operator outside the territory of Uzbekistan. Article 15 provides that transfer is made to the territory of foreign states that ensure uniform protection of the rights of data subjects. Where the destination state does not ensure uniform protection, Article 15 permits transfer if the subject has consented to the transfer of the subject's personal data.

Where the destination state does not ensure uniform protection, Article 15 also permits transfer if it is necessary to protect the constitutional order, public order, the rights and freedoms of citizens, or public health and morals. Where the destination state does not ensure uniform protection, Article 15 also permits transfer in the cases provided for by the international treaties of Uzbekistan.

Article 15 provides that transfer may be prohibited or restricted to protect the foundations of the constitutional order, the morals, health, rights and legitimate interests of citizens, national defense and state security. Law ZRU-1125 of 26 March 2026 restated Article 27-1 and entered into force on 27 March 2026. The second part of Article 27-1 lists personal data that must be stored on the territory of Uzbekistan.

The list includes the biometric data of individuals, their genetic data, and the data of individuals who use the services of telecommunications operators active in Uzbekistan. Personal data not covered by the second part of Article 27-1 may be stored and processed outside Uzbekistan if one of three listed conditions is met.

The conditions are recognition of the foreign state as one that ensures uniform protection of personal data, adoption by the operator of standard contractual clauses or binding corporate rules that meet requirements approved by the authorized state body, and compliance by the operator with international standards on a list that body approves.

Article 30 gives the subject the right to know that an owner, operator or third party holds the subject's personal data and what they contain. Article 30 gives the subject the right to obtain information on the processing of the data from the owner or operator on request. Article 30 gives the subject the right to obtain information on the conditions for access to the subject's personal data.

Article 30 gives the subject the right to apply to the authorized state body or a court to protect the subject's rights and legitimate interests. Article 30 gives the subject the right to give consent to the processing of the subject's personal data and to withdraw it, except in the cases the Law provides for. Article 30 gives the subject the right to consent to the dissemination of the subject's personal data in publicly available sources.

Article 30 gives the subject the right to require the owner or operator to suspend the processing temporarily where the data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the purposes of processing.

Law ZRU-1115 of 21 January 2026 adds a second part to Article 46-2 of the Code of Administrative Responsibility, which makes unlawful processing of personal data using artificial intelligence technologies, and the distribution of such data in the media, telecommunications networks or the internet, an administrative offence. The offence carries a fine of 50 to 100 basic calculated values, with confiscation of the objects of the administrative offence.

Article 12-1 of the Law on Informatization requires a website owner, including a blogger, not to allow a website, page or other information resource on which publicly available information is posted to be used for the purposes it lists. Law ZRU-1115 added to that list the unlawful processing of personal data using artificial intelligence technologies and the distribution of such data in the media, telecommunications networks or the internet.

The Law enters into force on the day of its official publication. The official legislation portal gives 21 January 2026 as its date of entry into force.

Article 33 provides that persons guilty of violating the legislation on personal data bear liability in the established manner, and it sets no penalty schedule, names no authority and states no private right of action. Article 8 names the authorized state body in the field of personal data: the State Personalization Center under the Cabinet of Ministers of Uzbekistan.

Cabinet of Ministers Resolution No. 415 of 29 July 2026 designates the Migration and Personalization Department under the Ministry of Internal Affairs as the authorized state body for its own provisions and makes it responsible for preparing proposals to add foreign states to, or remove them from, the list of states that ensure uniform protection of personal data.

Under Article 8 the authorized state body exercises state control, within its powers, over compliance with the legislation on personal data. It issues instructions on remedying violations of that legislation, which are binding on legal entities and individuals. It keeps the State Register of Personal Data Bases. The official legislation portal's note on Article 33 refers to Article 46-2 of the Code of Administrative Responsibility and Article 141-2 of the Criminal Code.

Article 25 defines special personal data as data on racial or social origin, political, religious or ideological beliefs, membership of political parties and trade unions, physical or mental health, private life and criminal record. Article 25 prohibits the processing of special personal data except in the cases listed in its third part. The listed cases include processing by the authorized state body to protect state security against external and internal threats.

They include processing where the subject has given consent in writing, including as an electronic document. They include processing of special personal data that the subject has published in publicly available sources. They include processing to protect the rights and legitimate interests of the subject or of other persons. They also include processing by courts and law enforcement bodies in a pending criminal case or enforcement proceeding. Biometric and genetic data are not in the Article 25 list and are governed separately by Article 26.

Annex 1 to Cabinet of Ministers Resolution No. 570 of 5 October 2022 sets four levels of protection for personal data processed in databases. The first level of protection applies where the database faces type 1 threats and holds special, biometric or genetic data. The first level of protection requires the owner or operator to record changes in an employee's authority to access the personal data automatically in an electronic security log.

The third level of protection requires the owner or operator to appoint an official or employee responsible for the security of the personal data in the database.

Article 29 of the Law on Personal Data defines publicly available personal data as data access to which is free with the subject's consent or which is not subject to a confidentiality requirement.

The Act's general consent and lawful-basis duties, read elsewhere in the Act, are not stated to turn on how the operator collected the data, so a public Uzbek source's data reached by crawling or scraping falls within the same regime as data collected by any other means, unless it independently qualifies as publicly available personal data under Art. 29.

The Law took effect on 17 July 2022. A critical information infrastructure subject must keep the information systems of its objects running without interruption. A critical information infrastructure subject must meet the cybersecurity requirements the authorized state body sets for its objects. The staff responsible for the cybersecurity of critical information infrastructure objects must pass attestation held by the authorized state body. The authorized state body sets the criteria for categorizing critical information infrastructure objects.

The Order took effect on 13 November 2024. The owner of a critical information infrastructure object must categorize its objects at least once a year. The categorization must be completed within thirty working days. Within five working days of the categorization act, the owner must apply to the authorized state body to enter the object in the registry. The Order is valid until 1 January 2029.

Any legal entity or individual entrepreneur that owns, uses, or disposes of national information resources, or that provides electronic information services using them, is a "cybersecurity subject" under the Law and must prevent unlawful disclosure, theft, loss, corruption, blocking, or falsification of data in its information systems and resources, and act promptly when such a case is detected.

It must comply with the cybersecurity requirements the State Security Service sets for protecting information systems and resources, and must keep a functioning capability to respond to cybersecurity incidents, using an outsourced provider with the State Security Service's authorization if it has none of its own. The Law defines no general standard of "reasonable" security beyond compliance with the requirements the State Security Service itself sets.

State bodies, legal entities, and individuals must protect information resources and information systems that contain state secrets or confidential information; the Cabinet of Ministers sets the procedure for that protection. For any other information resource or system whose improper handling could harm its owner or another party, the owner or holder sets its own protection procedure, and the Law states no external minimum standard for it.

The Law's own general-responsibility clause (Art. 23) refers a violation to liability "in accordance with the established procedure" without naming an authority or a penalty.

A "cybersecurity subject," defined as any legal entity or individual entrepreneur that owns, uses, or disposes of national information resources, or that provides electronic information services using them, must notify the State Security Service of cybersecurity incidents and cybercrimes as they occur, take measures to prevent the loss of digital evidence needed to fully expose the incident, and keep the records needed to analyze it.

The Law sets no numeric reporting deadline and no severity or materiality threshold for this duty. Where the affected resource's owner has the resources and technical means to investigate the incident itself, it may do so, but must then report the results to the State Security Service.

Article 16 defines information harmful to children's health as an information product barred from distribution to children altogether, or one whose distribution to children of certain age categories is restricted.

The categories barred outright include material inciting self-harm or suicide, material capable of inducing children to use alcohol, tobacco, narcotic or psychotropic substances, gamble, engage in prostitution, vagrancy or begging, material justifying violence and cruelty, material denying family values or fostering disrespect toward parents, obscene language, and material of a pornographic character, alongside identifying information about a child victim of an unlawful act.

A second, narrower category restricted by age rather than barred outright covers depictions of cruelty or antisocial acts, material inducing fear or panic, and depictions of sexual relations between a man and a woman, which fall under Article 17's age-tiered classification instead.

Article 4 defines an information product to include material distributed using software or placed in telecommunications networks, including the worldwide information network Internet, so an online service reached by children is covered on the same footing as printed, audiovisual or broadcast media.

Article 17 requires the producer or distributor to determine an information product's age classification, if necessary with expert help, before its circulation begins in Uzbekistan, assigning it one of five categories marked "0+", "7+", "12+", "16+" or "18+" based on its theme, genre, content and artistic design, how a child of the relevant age is likely to perceive it, and the likelihood of harm to a child's health.

Articles 18 and 19 direct the Cabinet of Ministers to set the administrative, organizational, hardware and software measures for protecting children from harmful information, bar its circulation in public places without those measures, require printed material carrying it to be sold only in sealed packaging, and bar its distribution in institutions intended for children.

Article 26 permits, with the author's name and the source of borrowing indicated and provided it does not harm the normal use of the work or infringe the author's legitimate interests, quoting a published work in the original or in translation for scientific, research, polemical, critical or non-promotional information purposes to the extent justified by the purpose of quotation, including reproducing excerpts from newspaper and magazine articles in the form of press reviews.

The same article separately permits reproducing in newspapers, or communicating by broadcast or cable, articles already published in newspapers or magazines on current political, economic, social or religious issues, or broadcast works of the same nature, unless the author has specifically prohibited such use, so the exception is an author opt-out rather than an unconditional licence. Article 26 carries no headline-length or short-extract cap distinct from the purpose-justified test in its own text.