With the integration of modern technologies into all spheres of life, the issue of personal data security is becoming increasingly relevant. Uzbekistan is not exempt from this global trend. In recent years, the country has been paying increased attention to the preservation of citizens’ personal information. One of the key points was the inclusion in the new version of the Constitution of the right to protect the personal data of each individual. In this article, we will examine the current practice of personal data processing in Uzbekistan and the measures taken to ensure the confidentiality and security of citizens’ personal information.
The Law of the Republic of Uzbekistan “On Personal Data” defines private information as information recorded in electronic, paper, and/or other material media related to a specific individual or providing the possibility to identify them. Interpretations of key terms such as “personal data subject” (an individual to whom the private information relates) and “operator of personal data” (a government body, individual, and/or legal entity engaged in the processing of private information) are also provided.
The owner of the personal data and/or the operator independently establish the procedure and principles for collecting and systematizing personal data. However, storage is carried out in a form that allows identifying an individual to the extent necessary to achieve the purposes stated during the collection of personal data. Moreover, the use of personal data is permitted only for the previously stated purposes of their collection, while ensuring the necessary level of security. Employees of the owner and/or operator involved in the processing of personal data are obliged not to disclose the personal data entrusted to them or made known to them in the course of performing professional, official, or labor duties.
Special attention is also given to the cross-border transfer of personal data (PD). This includes the transfer of personal data by the owner and/or operator beyond the territory of the Republic of Uzbekistan. Such transfer is possible only with the individual consent of the data subject for the cross-border transfer of their PD. Individual consent is given for the processing of their PD in any form confirmed by the fact of its receipt. For minors, consent for the processing of their PD in written form is provided by parents (guardians, custodians), and in the absence of them, by the guardianship and trusteeship authorities. The data subject has the right to withdraw consent for the processing of PD in the form in which such consent was provided, and the owner and/or operator undertake to destroy such PD.
It is important to note that all private database registrations are subject to mandatory state registration in the State Register of Private Databases of the Personalization Agency under the Ministry of Justice of the Republic of Uzbekistan. Database registration is done by the owner and/or operator by submitting an application on the official website of the State Register, filling in the necessary information, and subsequently obtaining a certificate.
Black Swan Consulting provides a wide range of services in the field of personal data, such as developing corporate documents on personal data protection, registering databases with the authorized state authority, drafting non-disclosure agreements, and much more.