In Uzbekistan, the concept of "personal data" has been legally established relatively recently with the adoption of the Law "On Personal Data" in 2019. This law serves as the fundamental document regulating the collection, processing, storage, and transfer of personal data. Personal data refers to any information related to a specific individual (data subject), including biometric, genetic, and special personal data.
Nowadays, almost everyone encounters the processing of their personal data. For example, when installing a mobile application or registering on a website, users are asked to agree to the user agreement. By clicking "I accept" or "I agree," the user consents to the processing of their personal data. This consent allows the operator, i.e., the organization or individual processing the data, to act in accordance with the law.
The Сonsent to Process Personal Data in Uzbekistan
The consent of the data subject is a key requirement of the Law "On Personal Data" in Uzbekistan. According to the law, such consent can be given in any form that allows the confirmation of the fact of its receipt. For special personal data, the law requires written consent, which can also be provided in the form of an electronic document. The absence of proper consent excludes the possibility of lawful processing of personal data, which is especially relevant for commercial organizations. Therefore, all companies working with personal data are required to ensure compliance with this requirement.
Operators of Personal Data Processing in Uzbekistan
Operators of personal data can be state bodies, legal entities, and individuals. In modern business, the processing of personal data has become an integral part, especially with the growth of mobile applications, social networks, and online platforms. These services actively collect and process the personal data of their users. In this regard, the law imposes additional obligations on operators to ensure data security. The state body responsible for monitoring the enforcement of the law has the authority to block the activities of operators who do not comply with the law's requirements.
Database Registration in Uzbekistan
According to the Law "On Personal Data" in Uzbekistan, operators processing personal data are required to register their databases. Registration is carried out in the State Register of Personal Data Bases, which is managed by the State Personalization Center under the Cabinet of Ministers of the Republic of Uzbekistan. The registration procedure involves submitting a specific set of documents confirming the existence and volume of the database, as well as ensuring compliance with security requirements. Without completing this procedure, any activity related to personal data processing will be considered illegal. This requirement applies to all organizations working with the data of Uzbek citizens, and its non-compliance can lead to serious consequences, including the restriction of the operator's activities.
Server Location Requirement for Storing Personal Data in Uzbekistan
The Law "On Personal Data" in Uzbekistan stipulates that operators processing personal data of citizens must store this data on servers located within the territory of Uzbekistan. Article 271 of the Law establishes that the collection, systematization, and storage of personal data must be carried out on technical means located in Uzbekistan and registered in the State Register of Personal Data Bases. This requirement applies to all types of operators, including social networks, online platforms, and other services working with the data of Uzbek citizens. Non-compliance with this requirement may lead to the restriction or blocking of the operator's activities within the country.
Blocking Tiktok in Uzbekistan
There is an opinion that the real reason for restricting Tiktok's activities in Uzbekistan is related to other factors, not just personal data issues. However, formally, the activities of this popular social network were restricted in early 2022 due to non-compliance with the Law "On Personal Data." Tiktok did not place its servers in Uzbekistan, which is a mandatory requirement of the law. Violation of this requirement served as the basis for restricting its activities in Uzbekistan.
Conclusion
The adoption of the Law "On Personal Data" in Uzbekistan is an important step in protecting citizens' rights and contributes to raising the level of legal awareness. However, despite the positive changes, there are still questions regarding the practical implementation of this law. It is necessary to continue working on improving the personal data protection mechanism to ensure it meets global standards and trends.