UZBEKISTAN  ·  PRACTICE AREA

Data Protection in Uzbekistan

Bond Stone advises international investors and multinational corporations on data protection compliance in Uzbekistan — the Law on Personal Data No. ZRU-547 dated 2 July 2019, the March 2026 localisation reform (Law No. ZRU-1125), cross-border transfer requirements, the responsible officer, and sector-specific cybersecurity obligations under Presidential Resolution No. PP-153 dated 30 April 2025 for the financial sector. Bond Stone's Tashkent office provides direct engagement with the State Personalization Center.

Since 27 March 2026, under Law No. ZRU-1125, only biometric data, genetic data and data of telecommunications users must be stored in Uzbekistan. Other personal data may be stored and processed abroad if the foreign state is on the list approved by Cabinet of Ministers Resolution No. 415 of 29 July 2026 (49 states and territories, in force 3 August 2026), the operator uses approved standard terms or binding corporate rules, or it follows listed international standards (Article 27-1). A leak during a cross-border transfer must be reported to the authorised body within 24 hours, with details within 72 hours (Resolution No. 415, para. 4). Only bases that must stay in Uzbekistan now need registration (Article 20).

Primary authority: Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 dated 2 July 2019 (as amended by Law No. ZRU-1125 dated 26 March 2026). Authority: lex.uz

Uzbekistan — Data Protection Context 2026

27 Mar 2026

Localisation reform in force — Law No. ZRU-1125

3 categories

Still localised: biometric, genetic, telecom user data

PP-153

Financial sector — IT crime prevention duties

Data Protection Services

Post-Reform Compliance Review

Advising on the implications of Law No. ZRU-1125 (March 2026) for existing data infrastructure — identifying which data categories remain subject to mandatory localisation (biometric, genetic, telecommunications user data) and which may now be transferred and stored abroad. Producing a revised compliance framework tailored to the entity's specific data processing operations.

Data Localisation — Residual Obligations

Advising on the three categories of personal data that remain subject to mandatory localisation within Uzbekistan post-2026: (1) biometric data; (2) genetic data; (3) data of users of telecommunications operators working in Uzbekistan (Article 27-1).

Cross-border Transfer Compliance

Advising on storing and transferring data abroad — adequate states on the Cabinet of Ministers list, approved standard terms or binding corporate rules, listed international standards, and consent or other Article 15 grounds for transfers to non-adequate states. Advising multinational groups on structuring intercompany data sharing compliant with ZRU-547 as amended.

Financial Sector — PP-153 Compliance

Presidential Resolution No. PP-153 dated 30 April 2025, on combating crimes committed using information technology, makes banks, payment system operators and payment organisations strictly responsible for preventing such crimes, and requires measures including anti-fraud systems. Bond Stone advises on PP-153 compliance frameworks, incident procedures, and managing regulatory engagement with the State Personalization Center and financial regulators following a data incident.

Database Registration

Since Law No. ZRU-1125, registration in the State Register of Personal Data Bases applies to bases that must be stored in Uzbekistan (Article 20). Bond Stone advises on whether a base is caught and on the procedure (Cabinet of Ministers Resolution No. 71 of 8 February 2020).

Responsible Officer, Policies & Market Entry

Advising foreign companies entering Uzbekistan on data protection requirements as part of the market entry legal package — naming the responsible officer, privacy policy drafting, employee data processing notices, data processing agreements with third parties, and consent mechanism design aligned with ZRU-547 requirements.

March 2026 Reform — What Changed

Data category Pre-2026 Post-2026 (Law No. ZRU-1125)
All personal data Must be stored in Uzbekistan May be stored abroad if an Article 27-1 condition is met (except 3 restricted categories below)
Biometric data Must be stored in Uzbekistan Still must be stored in Uzbekistan
Genetic data Must be stored in Uzbekistan Still must be stored in Uzbekistan
Telecom user data Must be stored in Uzbekistan Still must be stored in Uzbekistan
Employee / HR data Must be stored in Uzbekistan May be stored abroad if an Article 27-1 condition is met
Customer / commercial data Must be stored in Uzbekistan May be stored abroad if an Article 27-1 condition is met
Digital payment / fintech data Must be stored in Uzbekistan May be stored abroad if an Article 27-1 condition is met; licensing rules still apply

Experience

Bond Stone advises on data protection as part of market entry, fintech licensing, and regulatory compliance mandates in Uzbekistan. Client confidentiality is maintained.

Data Protection · Uzbekistan · Technology

Post-Reform Infrastructure Review

Advising a digital platform on the implications of Law No. 1125 — identifying which of its data processing operations remain subject to localisation and which may now be migrated to offshore infrastructure, reducing operational costs.

Data Protection · Uzbekistan · FinTech

FinTech Market Entry — Data Compliance

Advising an international payment service provider on entering the Uzbek market post-reform — data protection compliance framework, database registration, PP-153 obligations for the financial sector, and data processing architecture.

Data Protection · Uzbekistan · Banking

Bank — PP-153 Compliance

Advising a foreign bank's Uzbek subsidiary on implementing PP-153 cybersecurity obligations — establishing internal data incident response procedures, notification timelines, and regulatory reporting framework aligned with the State Personalization Center requirements.

Data Protection · Uzbekistan · Telecommunications

Telecom Operator — Localisation

Advising a telecommunications operator on continued mandatory localisation obligations for telecommunications user data post-March 2026 — confirming that SIM card data, IMSI/IMEI identifiers, and connection metadata remain subject to Uzbekistan localisation despite the broader reform.

Data Protection · Uzbekistan · Manufacturing

Manufacturing — Market Entry

Advising a foreign manufacturer establishing an Uzbek subsidiary on data protection as part of the market entry package — DPO appointment, employee data processing notices, database registration, and HR data infrastructure post-reform.

Data Protection · Uzbekistan · Corporate

Cross-border Transfer Structure

Advising a multinational group on restructuring its intercompany data sharing post-March 2026 — identifying non-restricted data categories now eligible for offshore storage, and drafting updated intragroup data transfer agreements aligned with the new framework.

Why Bond Stone

Primary authority: lex.uz

Discuss your data protection matter

Contact Bond Stone for a confidential discussion about data protection compliance in Uzbekistan.

info@bondstonelaw.com
+7 (701) 729 76 72 — Almaty

Request a Confidential Consultation Data Localisation in Uzbekistan → Compliance & Registration → Data Protection — Kazakhstan →