Data Protection Compliance in Uzbekistan

Database registration — State Register

Since Law No. ZRU-1125, registration in the State Register of Personal Data Bases applies to bases that must be stored in Uzbekistan under Article 27-1: biometric, genetic and telecommunications user data (Article 20). The Register is governed by Resolution No. 71 of the Cabinet of Ministers of 8 February 2020, which should be read with the amended Law. The State Personalization Center under the Cabinet of Ministers is the authorised body (Article 8). Bond Stone advises on the registration procedure, required documentation, registration timeline, and the categories of databases that are exempt from registration.

DPO appointment

An owner or operator must name a structural unit or official responsible for processing and protecting personal data (Article 31 of ZRU-547), which serves as the DPO function. The responsible person oversees compliance with the Law, handles data subject rights requests, manages consent mechanisms, and liaises with the State Personalization Center. Bond Stone advises on DPO appointment, role definition, and minimum competency requirements.

Financial sector — PP-153 obligations

Presidential Resolution No. PP-153 dated 30 April 2025, on combating crimes committed using information technology, makes banks, payment system operators and payment organisations strictly responsible for preventing such crimes. It requires measures including anti-fraud systems and antivirus protection in mobile applications, with users notified where malware is detected. It is not a personal data breach notification rule. Bond Stone advises financial sector clients on PP-153 compliance frameworks.

Cross-border transfer compliance — post-reform

Personal data outside those three categories may be stored and processed abroad if one condition is met: the foreign state is recognised as giving adequate protection (Cabinet of Ministers list); the operator adopts and follows standard contractual terms or binding corporate rules meeting the authorised body's requirements; or the operator follows international standards on the authorised body's list (Article 27-1). Article 15 still governs cross-border transfers: to adequate states, and to others with the data subject's consent, under a treaty, or on the public-interest grounds it lists. The list was approved by Cabinet of Ministers Resolution No. 415 of 29 July 2026, in force on 3 August 2026: 49 states and territories, including all EU member states, the United Kingdom, Switzerland, Norway, Russia, Singapore, Hong Kong, Japan, the Republic of Korea and Canada, and the United States only for companies participating in the EU-US Data Privacy Framework. Mainland China, Kazakhstan, Türkiye and the UAE are not on it. If personal data leaks during a cross-border transfer, the operator must inform the authorised body within 24 hours of discovering it and give details of the causes and remedial steps within 72 hours (Resolution No. 415, para. 4). For this Resolution the authorised body is the Department of Migration and Personalisation under the Ministry of Internal Affairs (para. 3). Bond Stone advises on structuring cross-border data transfers within the new framework and drafting data transfer agreements for intercompany data sharing.

Internal compliance programme

A complete data protection compliance programme under ZRU-547 includes: data mapping — identifying all processing activities; database registration where required; lawful basis analysis; privacy notices for employees and customers; consent management; data processing agreements with processors; data subject rights procedures; breach response plan; DPO function; and post-March 2026 localisation assessment. Bond Stone advises on building and implementing compliance programmes for foreign-invested entities operating in Uzbekistan.