Uzbekistan

Article 7-1, inserted into the Law on Informatization by Law No. ZRU-1115 (21 January 2026), reaches any information resource created using artificial intelligence and any information system that functions on artificial-intelligence technology. Such a resource or system must not harm a person's life, health, freedom, honor, or dignity, or violate the person's other inalienable rights.

A legally significant decision affecting a person's rights or freedoms may not rest exclusively on the conclusions of an information resource or system built on artificial-intelligence technology.

Art. 26 defines biometric data generally as data characterizing anatomical and physiological characteristics, and genetic data as data from analysis of biological material, with no illustrative list naming face, voice, or fingerprint.

Biometric and genetic data used for identification may be processed only with the subject's consent, except for treaty implementation, administration of justice, or enforcement proceedings, and electronic biometric or genetic data stored outside an information system must be kept on media that exclude unauthorized access. No retention or destruction duty specific to biometric data was found in this article or elsewhere in the Act.

Law No. ZRU-547 reaches the owner, operator, and third party generally, with no public and private carve-out found in the articles read. Processing generally requires the subject's consent (Art. 21 sets the procedure for giving and revoking it), subject to statutory exceptions not read article by article.

Art. 15 permits cross-border transfer where the destination state ensures adequate protection, or, where it does not, on subject consent, statutory necessity, or an international treaty; transfer may also be restricted for constitutional-order, morality, health, rights, defense, or state-security reasons.

Art. 27-1, added by a 2021 amendment reported in force April 2021, is narrower and separate: when processing the personal data of citizens of Uzbekistan using information technologies, including the internet, the owner or operator must collect, systematize, and store that data on technical means physically located in Uzbekistan and register the database in the State Register of Personal Data Bases.

Enforcement of Art. 27-1 is documented: the State Inspectorate for Control in the Sphere of Informatization and Telecommunications blocked Twitter, TikTok, VKontakte, Skype, and WeChat in July 2021, and Facebook, Instagram, LinkedIn, Odnoklassniki, Telegram, and YouTube in November 2021, citing failure to store Uzbek users' data domestically; several were later unblocked, and TikTok was reported still restricted as of the most recent secondary reporting located.

Art. 30 gives the subject the right to know that an owner, operator, or third party holds their data, obtain processing information on request, obtain information on access conditions, apply to the authorized state body or a court for protection of rights, give and withdraw consent, consent to inclusion in public sources, and require temporary suspension of processing where data is incomplete, outdated, or unreliable. Most, not all, of the article was extracted for this brief.

Art. 33, the Act's only enforcement provision, is a bare reference clause: persons violating the legislation on personal data are liable in the manner prescribed by law, with no penalty schedule, no named authority, and no private right of action stated in the Act itself. The Act refers to an authorized state body fourteen times but never names it in the text read; substantive penalties and the body's identity live in legislation the Act does not name and that is not identified here.

Art. 25 prohibits processing special personal data by default: racial or social origin, political, religious, or ideological beliefs, political-party or trade-union membership, physical or mental health, private life, and criminal record.

Processing is permitted only for state-security purposes by the authorized state body, on the subject's written or electronic consent, or where the subject has already published the special data in publicly available sources; this is a distinct track from Art. 26's biometric and genetic data, not a category that folds biometric data into it.

Article 29 of the Law on Personal Data defines publicly available personal data as data access to which is free with the subject's consent or which is not subject to a confidentiality requirement.

The Act's general consent and lawful-basis duties, read elsewhere in the Act, are not stated to turn on how the operator collected the data, so a public Uzbek source's data reached by crawling or scraping falls within the same regime as data collected by any other means, unless it independently qualifies as publicly available personal data under Art. 29.

Any legal entity or individual entrepreneur that owns, uses, or disposes of national information resources, or that provides electronic information services using them, is a "cybersecurity subject" under the Law and must prevent unlawful disclosure, theft, loss, corruption, blocking, or falsification of data in its information systems and resources, and act promptly when such a case is detected.

It must comply with the cybersecurity requirements the State Security Service sets for protecting information systems and resources, and must keep a functioning capability to respond to cybersecurity incidents, using an outsourced provider with the State Security Service's authorization if it has none of its own. The Law defines no general standard of "reasonable" security beyond compliance with the requirements the State Security Service itself sets.

State bodies, legal entities, and individuals must protect information resources and information systems that contain state secrets or confidential information; the Cabinet of Ministers sets the procedure for that protection. For any other information resource or system whose improper handling could harm its owner or another party, the owner or holder sets its own protection procedure, and the Law states no external minimum standard for it.

The Law's own general-responsibility clause (Art. 23) refers a violation to liability "in accordance with the established procedure" without naming an authority or a penalty.

A "cybersecurity subject," defined as any legal entity or individual entrepreneur that owns, uses, or disposes of national information resources, or that provides electronic information services using them, must notify the State Security Service of cybersecurity incidents and cybercrimes as they occur, take measures to prevent the loss of digital evidence needed to fully expose the incident, and keep the records needed to analyze it.

The Law sets no numeric reporting deadline and no severity or materiality threshold for this duty. Where the affected resource's owner has the resources and technical means to investigate the incident itself, it may do so, but must then report the results to the State Security Service.

Article 16 defines information harmful to children's health as an information product barred from distribution to children altogether, or one whose distribution to children of certain age categories is restricted.

The categories barred outright include material inciting self-harm or suicide, material capable of inducing children to use alcohol, tobacco, narcotic or psychotropic substances, gamble, engage in prostitution, vagrancy or begging, material justifying violence and cruelty, material denying family values or fostering disrespect toward parents, obscene language, and material of a pornographic character, alongside identifying information about a child victim of an unlawful act.

A second, narrower category restricted by age rather than barred outright covers depictions of cruelty or antisocial acts, material inducing fear or panic, and depictions of sexual relations between a man and a woman, which fall under Article 17's age-tiered classification instead.

Article 4 defines an information product to include material distributed using software or placed in telecommunications networks, including the worldwide information network Internet, so an online service reached by children is covered on the same footing as printed, audiovisual or broadcast media.

Article 17 requires the producer or distributor to determine an information product's age classification, if necessary with expert help, before its circulation begins in Uzbekistan, assigning it one of five categories marked "0+", "7+", "12+", "16+" or "18+" based on its theme, genre, content and artistic design, how a child of the relevant age is likely to perceive it, and the likelihood of harm to a child's health.

Articles 18 and 19 direct the Cabinet of Ministers to set the administrative, organizational, hardware and software measures for protecting children from harmful information, bar its circulation in public places without those measures, require printed material carrying it to be sold only in sealed packaging, and bar its distribution in institutions intended for children.

Article 26 permits, with the author's name and the source of borrowing indicated and provided it does not harm the normal use of the work or infringe the author's legitimate interests, quoting a published work in the original or in translation for scientific, research, polemical, critical or non-promotional information purposes to the extent justified by the purpose of quotation, including reproducing excerpts from newspaper and magazine articles in the form of press reviews.

The same article separately permits reproducing in newspapers, or communicating by broadcast or cable, articles already published in newspapers or magazines on current political, economic, social or religious issues, or broadcast works of the same nature, unless the author has specifically prohibited such use, so the exception is an author opt-out rather than an unconditional licence. Article 26 carries no headline-length or short-extract cap distinct from the purpose-justified test in its own text.