Pre-reform — all data required to be localised

Before 27 March 2026, Uzbekistan required all personal data of Uzbek citizens to be stored exclusively on servers located within Uzbekistan under Law No. ZRU-547 dated 2 July 2019. This blanket localisation requirement effectively prevented international payment platforms (PayPal, Apple Pay, Google Pay) from fully operating in Uzbekistan and forced all foreign companies to maintain local server infrastructure for any Uzbek personal data.

Post-reform — three categories remain localised

Law No. 1125 dated 26 March 2026, effective immediately upon publication, replaced blanket localisation with targeted mandatory localisation for three categories only: (1) biometric personal data — fingerprints, facial images (including Face ID), iris data, voice samples; (2) genetic data — DNA profiles, results of medical and genetic research and tests; (3) personal data of telecommunications service users — mobile and internet user data, passport details linked to SIM registration, SIM card numbers, IMSI/IMEI device identifiers, network connection metadata. All other personal data may now be stored abroad.

Non-restricted data — conditions for offshore storage

Personal data not falling within the three restricted categories may be transferred to and stored on servers outside Uzbekistan, provided that defined information security protocols are observed. The Cabinet of Ministers is authorised to approve a list of countries deemed to provide adequate personal data protection — transfers to adequate countries are permissible without additional conditions. For countries not on the adequate list, transfers must satisfy the cross-border transfer requirements of Article 15 of ZRU-547 — consent or treaty/legal basis.

Practical impact — who benefits from the reform

The 2026 reform materially benefits: (1) international payment platforms — PayPal, Apple Pay, Google Pay, Stripe, and similar services may now operate in Uzbekistan without full server localisation; (2) international SaaS and cloud providers — may serve Uzbek customers from global infrastructure for non-restricted data; (3) multinational employers — may consolidate Uzbek employee HR data (excluding biometric access control data) on global HR platforms; (4) e-commerce platforms and digital marketplaces — may process Uzbek customer data on offshore servers.

Who remains affected by localisation

The following entities remain subject to mandatory localisation obligations: telecommunications operators — must continue to store SIM registration data, subscriber details, IMSI/IMEI, and connection metadata in Uzbekistan; medical institutions processing biometric data — facial images used for patient identification; financial institutions collecting biometric authentication data — fingerprint or Face ID data used for banking app authentication; digital identity platforms collecting biometric or genetic data.

SaaS Platform — Infrastructure Migration

Data Localisation · Uzbekistan · Technology

Advising an international SaaS provider on migrating its Uzbek customer data from local Uzbek servers to global cloud infrastructure post-March 2026 — confirming the data categories eligible for migration, security protocol requirements, and updating terms of service.

Payment Platform — Market Entry

Data Localisation · Uzbekistan · FinTech

Advising an international payment platform on entering the Uzbek market post-reform — confirming that payment transaction data and customer identity data (non-biometric) may now be stored offshore, and structuring the technical architecture for Uzbekistan compliance.

Telecom Operator — Continued Compliance

Data Localisation · Uzbekistan · Telecommunications

Advising a telecommunications operator on continued localisation obligations post-reform — confirming that subscriber data, SIM registration data, and network metadata remain subject to mandatory Uzbekistan storage, and reviewing existing infrastructure for ongoing compliance.

Bank — Biometric Authentication Data

Data Localisation · Uzbekistan · Banking

Advising a bank on the localisation status of biometric authentication data (fingerprint and Face ID) used in its Uzbek mobile banking app — confirming mandatory localisation applies and reviewing the bank’s data architecture for biometric data segregation from non-restricted data.

HR Platform — Employee Data

Data Localisation · Uzbekistan · Corporate

Advising a multinational on migrating Uzbek employee HR data (name, contact, payroll, contract data — excluding biometric access control data) to a global HR platform post-reform — confirming eligible data categories and updating data processing agreements.

M&A — Localisation Risk Assessment

Data Localisation · Uzbekistan · M&A

Reviewing a Uzbek target’s data localisation compliance as part of M&A legal due diligence — mapping data categories, identifying any remaining mandatory localisation obligations, and assessing whether the target’s infrastructure satisfies post-reform requirements.