Doing IT Business Guide in Uzbekistan

E-commerce and the cash register rules

E-commerce in Uzbekistan covers the sale of goods and services through internet platforms as part of entrepreneurial activity. Its participants are sellers — legal entities and individuals, individual entrepreneurs and the self-employed — and buyers. E-commerce operators are the legal entities providing services around electronic documents and messages: telecommunications operators, marketplace operators and payment service providers.

Contracts are concluded electronically. Electronic documents confirming a transaction are equivalent to their paper counterparts and can serve as evidence that a contract was concluded; their invalidity cannot follow from the mere fact that an information system was used. An electronic signature and other confirmation methods — SMS, Face-ID and others — give documents legal force. The contract is considered concluded once acceptance is received, and the acceptance itself may be given electronically or by performing the terms of the offer. Electronic documents must be stored for no less time than paper ones, and settlement may be in cash, by transfer or through electronic money.

Cabinet of Ministers Resolution No. 943 of 23 November 2019 governs online cash registers and virtual cash register systems. It requires retail and services businesses to use online cash registers with a fiscal module — the component that records transactions and transmits the data to the tax authorities in real time — and introduces the virtual cash register: software that allows electronic settlement without a traditional cash register. The Resolution sets the technical requirements for all three, including data protection standards and transmission interfaces, the procedure for registering them in the specialised registries, the mechanisms for monitoring their use, and a transitional period for phased implementation.

The “Google tax” on electronic services

Tax legislation defines electronic services as automated services provided over the internet, where provision is carried out automatically using information technologies. The definition covers 14 types of service — among them rights to use software and databases, electronic books and audiovisual works, internet advertising and advertising space, placing offers to buy or sell, trading platforms operating in real time, maintaining an internet presence and users’ electronic resources, remote administration of programmes and websites, storage and processing of information, computing power, domain names and hosting, automatically generated information supplies such as real-time stock reports and machine translation, searching for information about potential buyers, access to search engines, and website statistics.

Four things are expressly outside it: selling goods or services where the order comes over the internet but delivery does not; selling software and databases on physical media; consulting by email; and providing internet access.

A foreign legal entity providing such services to individuals in Uzbekistan must register with the tax authority — as must a foreign intermediary, recognised as a tax agent in those cases. The object of taxation is the turnover from electronic services supplied to individuals; the tax base is the cost of those services including the tax, calculated on actual prices; the tax period is a quarter, and the base for each quarter is determined by the time full or partial payment was received. Where the price is in foreign currency, it is converted at the Central Bank rate at the end of the month in which payment was received. Foreign legal entities calculate the tax themselves where no tax agent is obliged to. Google, Microsoft, Xsolla, Netflix, Apple, Huawei, Samsung, Booking.com, Facebook, Spotify, LinkedIn and Yandex are among the companies already registered as VAT payers in Uzbekistan.

Intellectual property

Protection extends to copyright and related rights, computer programmes and databases, inventions, utility models and industrial designs, undisclosed information including know-how, brand names, trademarks and appellations of origin. Regulation sits with the Intellectual Property Department within the Ministry of Justice, where patent attorneys represent the interests of legal entities and individuals.

Copyright arises automatically and needs no registration — though some state bodies, the Tax Committee among them, ask for registration during integration. It covers text and music, audiovisual materials, works of fine art and design, and computer programmes of every kind, in any programming language and in any form including source text and object code. It protects the author’s interests throughout life and for 70 years after death; the right of authorship and the right to protect the author’s reputation have no time limit. Copyright does not extend to ideas, working methods, interface organisation, algorithms or programming languages.

Trademarks may be registered as images, words, three-dimensional shapes and their combinations in various colours. Registration lasts 10 years and may be extended for the same period; goods bearing a trademark without authorisation, or a confusingly similar designation, are counterfeit. Uzbekistan participates in WIPO, the Paris Convention, the Berne Convention and the Madrid trademark registration system, alongside many bilateral agreements.

Personal data

The framework rests on the Law “On Personal Data” No. ZRU-547 of 2 July 2019 and Cabinet of Ministers Resolution No. 570 of 5 October 2022; the State Center for Personalization acts as the authorised body. Processing is permitted with the data subject’s consent, to perform a contract they are party to or at their request before conclusion, to fulfil the owner’s or operator’s statutory obligations, to protect the legitimate interests of the subject or others, to exercise the rights of the owner, operator or third parties subject to the subject’s rights, for statistical research involving anonymisation, and where the data is available in open sources. Purposes must be fixed in the documents governing the owner’s and operator’s activity and must match those announced at collection; changing them requires fresh consent.

Every personal data database must be registered in the State Register of Personal Data Databases, and any change to the registration details must be reported to the authorised body within 10 days. Personal data of Uzbek citizens processed using information technologies must be collected, systematised and stored on technical means physically located in Uzbekistan. Cross-border transfer is possible only to states guaranteeing an adequate level of protection — and Uzbekistan has not yet drawn up a list of such states. Transfers elsewhere are permissible with the subject’s consent, to protect the constitutional order, public order, citizens’ rights and freedoms or the health and morals of the population, or where a signed international treaty so provides.

Cybersecurity

The Law “On Cybersecurity”, adopted in April 2022, introduced definitions that had no statutory basis before: critical information infrastructure, its facilities — the informatisation systems used in public administration and public services, defence, state security, law and order, the fuel and energy complex including nuclear energy, chemicals and petrochemicals, metallurgy, water supply, agriculture, healthcare, housing and communal services, the banking and financial system, transport, ICT, ecology, extraction of strategic minerals and the production sector — and the subjects that own or operate them.

The President sets unified state policy; the State Security Service is the main executive body, with powers to use technical means and services free of charge for rapid response, to inspect public and private institutions and access documents connected with cybersecurity incidents, to issue mandatory prescriptions, and to enter premises to suppress or investigate crimes related to information technology — with subsequent notification of the prosecutor’s office and mandatory compensation for damage.

Cybersecurity subjects must report incidents and crimes to the authorised body immediately, preserve the data needed for a full analysis and store it long term, exchange information with the authority, comply strictly with the established norms and standards, and give access to monitoring systems and facilities. The state, for its part, commits to improving the legislative framework, offering tax and customs benefits, attracting investment, using public procurement to bring in the newest products, and supporting training and retraining of specialists.

Cyber Park and IT Park

Cyber Park is an IT cluster for research and high-technology production in information technology and cybersecurity. It works on the principle of extraterritoriality, so residents may be located anywhere in the republic. Until 1 January 2028, residents are fully exempt from all types of taxes, mandatory deductions and the single social payment; exempt from customs duties on imported technological equipment and components; and apply a fixed personal income tax rate of 7.5% for their employees. Resident status is open to legal entities registered in Uzbekistan working in IT and cybersecurity — software development, computer programming and related services — provided income from those activities is at least 50% of total sales.

IT Park is an extraterritorial free economic zone for IT enterprises, built around a multifunctional complex of academic institutions, offices, coworking centres and recreation areas constructed to BREEAM environmental standards. Its residents must be registered in Uzbekistan and carry out activities from the approved List of priority areas — and, unlike Cyber Park, those activities must make up 100% of their sales. The List runs to 22 types of activity, from software design, development and modification through database creation, data processing, automated control systems, information systems audit, business process outsourcing for non-residents, micro-, opto- and nanoelectronics, radar and radio communication equipment, technical and cryptographic protection of information including electronic digital signatures, the Internet of Things, IT education, export of information services over the internet, multimedia and design, animation, venture financing and acceleration programmes, to cybersports.

Two documents are required for resident status: proof of registration of the legal entity, and a detailed business plan describing the activities, the volume and types of services, the justification for them, the profitability model and projected financial results, in the format set by the IT Park Directorate.

Residents are fully exempt from taxes, mandatory contributions to state funds and social taxes; exempt from customs payments (other than customs duties) on equipment, components and software imported for their own needs and not produced in Uzbekistan; may pay dividends and salaries to foreign founders and specialists in foreign currency through international payment cards; may use the virtual office service; may bring in foreign specialists without confirming their right to work in Uzbekistan; and may export through online stores without an export contract. Monthly contributions to the IT Park Directorate fall by 25% once service exports exceed 10 million US dollars a year and by 50% above 20 million. Employees’ income is taxed at 7.5% and is left out of the annual tax liability calculation.

On 1 February 2024, Presidential Decree No. 25 created the International Center for Digital Technologies inside the IT Park, aiming to raise IT service exports to 5 billion US dollars, create 100,000 jobs and increase the number of foreign resident companies to 1,000. It offers a regulatory sandbox, intellectual property protection, services around labour relations, government and banking services, help with customs and tax matters, and resolution of commercial and civil disputes. The centre started work on 1 June 2024 in pilot mode, with an experimental special legal regime running for five years.

Practical advice from the guide

Register transfers of intellectual property rights and licensing agreements with the designated state bodies — failure to do so may render the transaction invalid. Authors of works made for hire keep their personal non-property rights even where the work was done at the employer’s request; exclusive rights to commercial use belong to the employer unless the contract says otherwise. Before filing a trademark application, analyse the trademarks already registered in the relevant classes of the International Classification of Goods and Services, and specify each product and service precisely. Software protected by copyright needs no patent — but a state body may ask for one when the software is integrated with the tax system, which is worth anticipating.

On data and cybersecurity: register the personal data database, appoint someone responsible for its control and processing, obtain separate consent for any cross-border transfer, and keep the server inside Uzbekistan. Establish a cybersecurity unit as a staff position — a cybersecurity subject must provide mechanisms for incident response, and without an in-house unit the enterprise may only outsource after obtaining permission from the relevant state body.

On the two parks: in Cyber Park, at least 51% of activity must conform to the business plan, leaving 49% for other directions, while in IT Park all 100% must match it. The Cyber Park business plan is also the more detailed document of the two, including various reports and information about the company and its activities.

The full guide sets out each of these areas at length, with the underlying legislation cited in full.