Uzbekistan
Law on Personal Data (2019)
Authority
Personalization Agency under the Ministry of Justice / designated state authority
Overview
Uzbekistan’s personal data regime, anchored in the Law on Personal Data (ZRU-547, in force since October 2019), underwent a significant liberalisation in March 2026 through amendment ZRU-1125. The revised data localisation rule is now category-specific: biometric data, genetic data, and data of users of telecommunications operators active in Uzbekistan must be stored on servers physically located within the country. All other categories of personal data may be stored and processed abroad, provided one of three conditions is met: the destination country is officially recognised as providing adequate protection; the controller adopts approved standard contractual clauses or binding corporate rules; or the controller complies with international data management standards published by the competent authority. This reform was explicitly designed to unblock the launch of international payment services including Apple Pay and Google Pay, which had been hindered by the prior blanket localisation requirement. The competent authority is the Agency for Personal Data Protection, which has intensified enforcement since 2025, conducting inspections and issuing fines to unregistered controllers. Organisations processing Uzbek data should verify registration, audit data flows by category, and reassess transfer mechanisms against the post-2026 framework rather than relying on pre-amendment compliance assumptions.