Post-Reform Compliance Review

Advising on the implications of Law No. 1125 (March 2026) for existing data infrastructure — identifying which data categories remain subject to mandatory localisation (biometric, genetic, telecommunications user data) and which may now be transferred and stored abroad. Producing a revised compliance framework tailored to the entity’s specific data processing operations.

Data Localisation — Residual Obligations

Advising on the three categories of personal data that remain subject to mandatory localisation within Uzbekistan post-2026: (1) biometric personal data — fingerprints, facial images, iris data, voice samples; (2) genetic data — DNA profiles, medical genetic research results; (3) personal data of telecommunications service users — mobile/internet user data, SIM card numbers, IMSI/IMEI identifiers, connection metadata.

Cross-border Transfer Compliance

Advising on the conditions for transferring non-localisation-required personal data outside Uzbekistan — transfers to adequate jurisdictions (as determined by the Cabinet of Ministers), obtaining data subject consent for transfers to non-adequate jurisdictions, and contractual safeguards. Advising multinational groups on structuring intercompany data sharing compliant with ZRU-547 as amended.

Financial Sector — PP-153 Compliance

Presidential Decree No. PP-153 dated 30 April 2025 introduced compulsory breach notification obligations and legal liability for data incidents specifically for the financial sector — banks, payment organisations, and financial institutions. Bond Stone advises on PP-153 compliance frameworks, breach notification procedures, and managing regulatory engagement with the State Personalization Center and financial regulators following a data incident.

Database Registration

Advising on the obligation to register personal data databases with the State Register of Personal Data Bases under Resolution No. 71 of the Cabinet of Ministers dated 8 February 2020. Bond Stone advises on the registration procedure, timeline, responsible authority engagement, and exemptions from registration applicable to specific database categories.

DPO, Policies & Market Entry

Advising foreign companies entering Uzbekistan on data protection requirements as part of the market entry legal package — DPO appointment, privacy policy drafting, employee data processing notices, data processing agreements with third parties, and consent mechanism design aligned with ZRU-547 requirements.

Post-Reform Infrastructure Review

Data Protection · Uzbekistan · Technology

Advising a digital platform on the implications of Law No. 1125 — identifying which of its data processing operations remain subject to localisation and which may now be migrated to offshore infrastructure, reducing operational costs.

FinTech Market Entry — Data Compliance

Data Protection · Uzbekistan · FinTech

Advising an international payment service provider on entering the Uzbek market post-reform — data protection compliance framework, database registration, PP-153 obligations for the financial sector, and data processing architecture.

Bank — PP-153 Compliance

Data Protection · Uzbekistan · Banking

Advising a foreign bank’s Uzbek subsidiary on implementing PP-153 breach notification obligations — establishing internal data incident response procedures, notification timelines, and regulatory reporting framework aligned with the State Personalization Center requirements.

Telecom Operator — Localisation

Data Protection · Uzbekistan · Telecommunications

Advising a telecommunications operator on continued mandatory localisation obligations for telecommunications user data post-March 2026 — confirming that SIM card data, IMSI/IMEI identifiers, and connection metadata remain subject to Uzbekistan localisation despite the broader reform.

Manufacturing — Market Entry

Data Protection · Uzbekistan · Manufacturing

Advising a foreign manufacturer establishing a Uzbek subsidiary on data protection as part of the market entry package — DPO appointment, employee data processing notices, database registration, and HR data infrastructure post-reform.

Cross-border Transfer Structure

Data Protection · Uzbekistan · Corporate

Advising a multinational group on restructuring its intercompany data sharing post-March 2026 — identifying non-restricted data categories now eligible for offshore storage, and drafting updated intragroup data transfer agreements aligned with the new framework.