Amendments to Article 27¹ of the Law “On Personal Data” are coming into effect in the Republic of Uzbekistan, establishing an updated approach to the localization and cross-border storage of personal information. The adopted amendments are aimed at achieving a balance between ensuring a high level of protection for citizens’ personal data and creating favorable conditions for the activities of international technology companies, digital platforms, and services.
Updated Approach to Personal Data Storage
Previously, the existing regulations stipulated the mandatory physical storage of personal data of citizens of the Republic of Uzbekistan exclusively on servers located within the country. This model significantly limited the possibility of cross-border data processing and effectively hindered the full entry of international IT companies, social networks, and marketplaces into the Uzbek market. As a result of the amendments, the requirements were revised. The law no longer requires all servers to be located in Uzbekistan. The storage and processing of personal data outside the country is permitted provided the following conditions are met simultaneously:
- ensuring established information security requirements;
- compliance with international personal data protection standards;
- oversight by authorized state bodies of the Republic of Uzbekistan.
List of Personal Data Subject to Mandatory Local Storage
At the same time, the legislator has defined categories of personal data that are subject to exclusive local storage within the territory of the Republic of Uzbekistan and cannot be placed on foreign servers. The specified data categories are subject to storage exclusively on servers located within the territory of the Republic of Uzbekistan and cannot be placed outside of it. These data are categorized into three key groups.
Biometric personal data → Subject to mandatory storage in Uzbekistan fingerprints; facial images (including Face ID technology); iris data; voice samples.
Genetic Data → Localization is mandatory for DNA profiles; results of medical and genetic research and tests.
Data of individuals – telecommunications service users → This category includes information about mobile and internet service users; passport details and personal identification number (PIN); SIM card numbers and device technical identifiers (IMSI, IMEI); network connection metadata, including connection time, base station data, and communication sessions.
Practical Implications for Market Participants
The adopted changes have a significant impact on various categories of entities. (i) For international companies – the amendments open up the possibility of legally providing digital, financial, and technological services within Uzbekistan without the need to completely relocate server infrastructure to the country. The only exceptions are strictly defined categories of sensitive personal data. (ii) For telecommunications operators and medical institutions – The obligation to store biometric, genetic, and telecommunications data locally is established. Any processing of such data outside the country is permitted only in compliance with enhanced control measures and international information security standards. (iii) For citizens of the Republic of Uzbekistan – The protection of personal data is being strengthened legislatively, with the most sensitive information such as biometric, genetic, and telecommunications data guaranteed to be stored within the country, which reduces the risks of unauthorized access and leaks.
Conclusion
The amendments to Article 27¹ of the Personal Data Law create a more balanced and pragmatic regulatory model that combines the protection of citizens’ fundamental rights to the security of personal data. It creates conditions for the development of the digital economy and the attraction of international services. Only strictly defined categories of personal data are subject to mandatory local storage, while all other data can be processed and stored on international servers, provided that security requirements and government control are met. This brings Uzbekistan’s legal regulation closer to international standards and contributes to the formation of a more open and competitive digital environment.