Uzbekistan. Comprehensive data protection. Law

ZRU-547Law of the Republic of Uzbekistan No. ZRU-547 'On Personal Data'

In force

Partly verified

Medium confidence. Requested '2025 fines' amendments not confirmed; penalty figures per DLA Piper (pre-2026). Exact entry-into-force of the March 2026 amendment not confirmed.

§1Summary

Synopsis

Uzbekistan's framework personal data law setting consent-based processing rules, data subject rights, registration of databases and duties for owners and operators. Since 2021 it imposed broad localisation of Uzbek citizens' data, which was narrowed in 2026 to biometric, genetic and telecom subscriber data alongside a list of approved transfer destinations.

Key themes

consent
database registration
localisation
cross-border transfers
responsible person
breach reporting for transfers

Unique features

Register of Infringers can lead to blocking of non-compliant websites; 2026 regime introduces a 49-country whitelist and 24h/72h breach reporting for cross-border transfer incidents.

SaaS relevance

Foreign SaaS processing Uzbek citizens' data over the internet must check whether data falls in the still-localised categories and whether the destination is on the approved list or safeguards are in place.

§2Obligations

Extraterritorial: Limited
Breach notification: Cross-border transfer breaches: authority within 24h, follow-up within 72h; no general duty otherwise
DPO: Yes
Cross-border transfers: Localisation (art 27-1) now limited to biometric, genetic and telecom subscriber data; transfers to 49 listed countries simplified; others require legal/organisational/technical safeguards (SCCs/BCRs to be approved)
Maximum penalty: Administrative ~50 BCV for officials; criminal up to 150 BCV fine or 2 years' correctional labour for repeat; website blocking

§3Dates

Key dates

Adopted 2 July 2019
In force 1 October 2019
Localisation (art 27-1) added by law of 2021-01-15, in force 2021-04-16; amendment signed 2026-03-26 narrowed mandatory local storage to biometric, genetic and telecom subscriber data; Cabinet resolution of 2026-07-29 listed 49 countries for simplified transfers.

§4Text and authority

Text

Authoritative text lex.uz

Authority

Personalization Agency under the Ministry of Justice (formerly State Personalization Centre); State Inspection on Informatization and Telecommunications (Uzcomnazorat)

§5Where it applies

Domestic law of: Uzbekistan

§6Sources and verification

Sources consulted

lex.uz

Verification

Medium confidence.

Partly verified

Medium confidence. Requested '2025 fines' amendments not confirmed; penalty figures per DLA Piper (pre-2026). Exact entry-into-force of the March 2026 amendment not confirmed.