UZBEKISTAN \u00a0\u00b7\u00a0 DATA PROTECTION<\/p>\n
Bond Stone advises foreign companies and digital businesses on data localisation compliance in Uzbekistan following the landmark March 2026 reform \u2014 Law No. 1125 dated 26 March 2026 fundamentally relaxed Uzbekistan’s strict localisation requirement, retaining mandatory local storage only for biometric data, genetic data, and personal data of telecommunications service users.<\/p>\n
Primary authority: Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 dated 2 July 2019 (as amended by Law No. 1125 dated 26 March 2026). Verify at lex.uz<\/a><\/p>\n \u26a0\ufe0f March 2026 Reform<\/p>\n Law No. 1125 dated 26 March 2026 fundamentally changed Uzbekistan’s data localisation rules. Only biometric, genetic, and telecommunications user data must now be stored in Uzbekistan. All other personal data may be stored abroad subject to security requirements.<\/p>\n<\/div>\n Pre-reform \u2014 all data required to be localised<\/p>\n Before 27 March 2026, Uzbekistan required all personal data of Uzbek citizens to be stored exclusively on servers located within Uzbekistan under Law No. ZRU-547 dated 2 July 2019. This blanket localisation requirement effectively prevented international payment platforms (PayPal, Apple Pay, Google Pay) from fully operating in Uzbekistan and forced all foreign companies to maintain local server infrastructure for any Uzbek personal data.<\/p>\n<\/div>\n Post-reform \u2014 three categories remain localised<\/p>\n Law No. 1125 dated 26 March 2026, effective immediately upon publication, replaced blanket localisation with targeted mandatory localisation for three categories only: (1) biometric personal data \u2014 fingerprints, facial images (including Face ID), iris data, voice samples; (2) genetic data \u2014 DNA profiles, results of medical and genetic research and tests; (3) personal data of telecommunications service users \u2014 mobile and internet user data, passport details linked to SIM registration, SIM card numbers, IMSI\/IMEI device identifiers, network connection metadata. All other personal data may now be stored abroad.<\/p>\n<\/div>\n Non-restricted data \u2014 conditions for offshore storage<\/p>\n Personal data not falling within the three restricted categories may be transferred to and stored on servers outside Uzbekistan, provided that defined information security protocols are observed. The Cabinet of Ministers is authorised to approve a list of countries deemed to provide adequate personal data protection \u2014 transfers to adequate countries are permissible without additional conditions. For countries not on the adequate list, transfers must satisfy the cross-border transfer requirements of Article 15 of ZRU-547 \u2014 consent or treaty\/legal basis.<\/p>\n<\/div>\n Practical impact \u2014 who benefits from the reform<\/p>\n The 2026 reform materially benefits: (1) international payment platforms \u2014 PayPal, Apple Pay, Google Pay, Stripe, and similar services may now operate in Uzbekistan without full server localisation; (2) international SaaS and cloud providers \u2014 may serve Uzbek customers from global infrastructure for non-restricted data; (3) multinational employers \u2014 may consolidate Uzbek employee HR data (excluding biometric access control data) on global HR platforms; (4) e-commerce platforms and digital marketplaces \u2014 may process Uzbek customer data on offshore servers.<\/p>\n<\/div>\n Who remains affected by localisation<\/p>\n The following entities remain subject to mandatory localisation obligations: telecommunications operators \u2014 must continue to store SIM registration data, subscriber details, IMSI\/IMEI, and connection metadata in Uzbekistan; medical institutions processing biometric data \u2014 facial images used for patient identification; financial institutions collecting biometric authentication data \u2014 fingerprint or Face ID data used for banking app authentication; digital identity platforms collecting biometric or genetic data.<\/p>\n<\/div>\n<\/div>\n SaaS Platform \u2014 Infrastructure Migration<\/p>\n Data Localisation \u00b7 Uzbekistan \u00b7 Technology<\/p>\n Advising an international SaaS provider on migrating its Uzbek customer data from local Uzbek servers to global cloud infrastructure post-March 2026 \u2014 confirming the data categories eligible for migration, security protocol requirements, and updating terms of service.<\/p>\n<\/div>\n Payment Platform \u2014 Market Entry<\/p>\n Data Localisation \u00b7 Uzbekistan \u00b7 FinTech<\/p>\n Advising an international payment platform on entering the Uzbek market post-reform \u2014 confirming that payment transaction data and customer identity data (non-biometric) may now be stored offshore, and structuring the technical architecture for Uzbekistan compliance.<\/p>\n<\/div>\n Telecom Operator \u2014 Continued Compliance<\/p>\n Data Localisation \u00b7 Uzbekistan \u00b7 Telecommunications<\/p>\n Advising a telecommunications operator on continued localisation obligations post-reform \u2014 confirming that subscriber data, SIM registration data, and network metadata remain subject to mandatory Uzbekistan storage, and reviewing existing infrastructure for ongoing compliance.<\/p>\n<\/div>\n Bank \u2014 Biometric Authentication Data<\/p>\n Data Localisation \u00b7 Uzbekistan \u00b7 Banking<\/p>\n Advising a bank on the localisation status of biometric authentication data (fingerprint and Face ID) used in its Uzbek mobile banking app \u2014 confirming mandatory localisation applies and reviewing the bank’s data architecture for biometric data segregation from non-restricted data.<\/p>\n<\/div>\n HR Platform \u2014 Employee Data<\/p>\n Data Localisation \u00b7 Uzbekistan \u00b7 Corporate<\/p>\n Advising a multinational on migrating Uzbek employee HR data (name, contact, payroll, contract data \u2014 excluding biometric access control data) to a global HR platform post-reform \u2014 confirming eligible data categories and updating data processing agreements.<\/p>\n<\/div>\n M&A \u2014 Localisation Risk Assessment<\/p>\n Data Localisation \u00b7 Uzbekistan \u00b7 M&A<\/p>\n Reviewing a Uzbek target’s data localisation compliance as part of M&A legal due diligence \u2014 mapping data categories, identifying any remaining mandatory localisation obligations, and assessing whether the target’s infrastructure satisfies post-reform requirements.<\/p>\n<\/div>\n<\/div>\n Why Bond Stone<\/p>\n \u2726 \u00a0Tashkent office \u2014 direct engagement with the State Personalization Center<\/p>\n \u2726 \u00a0Ranked Legal 500 EMEA and IFLR1000<\/p>\n<\/div>\n Primary authority: lex.uz<\/a><\/p>\n Contact Bond Stone for a confidential discussion about Data Localisation in Uzbekistan.<\/p>\n \ud83d\udce7 info@bondstonelaw.com<\/a> Request a Confidential Consultation<\/a> UZBEKISTAN \u00a0\u00b7\u00a0 DATA PROTECTION Data Localisation in Uzbekistan Bond Stone advises foreign companies and digital businesses on data localisation compliance in Uzbekistan following the landmark March 2026 reform \u2014 Law No. 1125 dated 26 March 2026 fundamentally relaxed Uzbekistan’s strict localisation requirement, retaining mandatory local storage only for biometric data, genetic data, and personal data […]<\/p>\n","protected":false},"author":4,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-4847","page","type-page","status-publish","hentry"],"translation":{"provider":"WPGlobus","version":"3.0.5","language":"ru","enabled_languages":["en","ru"],"languages":{"en":{"title":true,"content":true,"excerpt":false},"ru":{"title":false,"content":false,"excerpt":false}}},"_links":{"self":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages\/4847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/comments?post=4847"}],"version-history":[{"count":3,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages\/4847\/revisions"}],"predecessor-version":[{"id":4851,"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/pages\/4847\/revisions\/4851"}],"wp:attachment":[{"href":"https:\/\/bondstonelaw.com\/ru\/wp-json\/wp\/v2\/media?parent=4847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nKey Framework<\/h2>\n
\nExperience<\/h2>\n
\nDiscuss your data protection matter<\/h2>\n
\n\ud83d\udcde +7 (701) 729 76 72<\/a><\/p>\n
\n\u2190 Data Protection Hub<\/a>
\nCompliance & Registration \u2192<\/a>
\n\u2190 Data Protection Hub<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"