By the Law of the Republic of Uzbekistan No. 1125 dated March 26, 2026, significant amendments have been introduced to the Law of the Republic of Uzbekistan “On Personal Data” No. 547 dated July 2, 2019.
Instead of a unified requirement for mandatory localization of all personal data of citizens of the Republic of Uzbekistan, a differentiated approach has been introduced.
Mandatory localization is retained for:
— biometric data of individuals;
— genetic data of individuals;
— data of subscribers of telecommunications operators operating in the Republic of Uzbekistan.
Cross-border transfer of other personal data is now permitted subject to compliance with one of the following conditions:
— the foreign state is recognized as ensuring an adequate level of personal data protection;
— the operator has adopted standard contractual clauses or binding corporate rules approved by the authorized body;
— the operator complies with international personal data protection standards approved by the authorized body.
Whereas previously all personal data databases were subject to registration, going forward only those databases that are required to be stored within the territory of the Republic of Uzbekistan shall be subject to registration.
Companies processing personal data of citizens of the Republic of Uzbekistan are granted significantly greater flexibility in selecting data storage infrastructure. At the same time, operators processing biometric or genetic data, as well as telecommunications operators, continue to be subject to enhanced obligations regarding localization and registration of personal data databases.