Data Localisation in Uzbekistan

Pre-reform — all data required to be localised

Before 27 March 2026, Uzbekistan required all personal data of Uzbek citizens to be stored exclusively on servers located within Uzbekistan under Law No. ZRU-547 dated 2 July 2019. In practice this meant local server infrastructure for Uzbek personal data.

Post-reform — three categories remain localised

Law No. ZRU-1125, in force on publication on 27 March 2026, limits mandatory local storage to three categories (Article 27-1): (1) biometric data, meaning data on a person's anatomical and physiological features; (2) genetic data; (3) data of users of telecommunications operators working in Uzbekistan. In our view these cover items such as fingerprints and facial images, DNA profiles, and SIM and subscriber data. The Law gives no detailed list, so test doubtful cases.

Non-restricted data — conditions for offshore storage

Personal data outside those three categories may be stored and processed abroad if one condition is met: the foreign state is recognised as giving adequate protection (Cabinet of Ministers list); the operator adopts and follows standard contractual terms or binding corporate rules meeting the authorised body's requirements; or the operator follows international standards on the authorised body's list (Article 27-1). Article 15 still governs cross-border transfers: to adequate states, and to others with the data subject's consent, under a treaty, or on the public-interest grounds it lists. The list was approved by Cabinet of Ministers Resolution No. 415 of 29 July 2026, in force on 3 August 2026: 49 states and territories, including all EU member states, the United Kingdom, Switzerland, Norway, Russia, Singapore, Hong Kong, Japan, the Republic of Korea and Canada, and the United States only for companies participating in the EU-US Data Privacy Framework. Mainland China, Kazakhstan, Türkiye and the UAE are not on it. If personal data leaks during a cross-border transfer, the operator must inform the authorised body within 24 hours of discovering it and give details of the causes and remedial steps within 72 hours (Resolution No. 415, para. 4). For this Resolution the authorised body is the Department of Migration and Personalisation under the Ministry of Internal Affairs (para. 3).

Practical impact — who benefits from the reform

If an Article 27-1 condition is met, the reform helps: (1) payment businesses, which still need any Uzbek licence for their activity; (2) SaaS and cloud providers serving Uzbek customers from global infrastructure; (3) multinational employers using global HR platforms, excluding biometric access control data; (4) e-commerce platforms. Bases that must stay in Uzbekistan must also be registered in the State Register (Article 20).

Who remains affected by localisation

The following entities remain subject to mandatory localisation obligations: telecommunications operators working in Uzbekistan, for user data; and any owner or operator holding biometric or genetic data, such as medical institutions, banks using biometric authentication, and digital identity platforms.