Uzbekistan Personal Data Law: What Websites and Apps Must Do

The short answer

The core document is the Law of the Republic of Uzbekistan "On Personal Data" (No. ZRU-547 of 2 July 2019). For websites and apps it boils down to four key obligations:

1. Obtain consent from people to process their data (except in cases the law explicitly provides for).
2. Store Uzbek citizens' data on servers in Uzbekistan — the data localization requirement.
3. Register the personal database in the State Register of Personal Databases.
4. Protect the data with legal, organizational and technical measures.

Violations lead to administrative and, in some cases, criminal liability. This article is an overview, not legal advice: wording and enforcement practice get refined over time, so check the current version of the law and related regulations.

What counts as personal data

Any information that directly or indirectly identifies a person: full name, phone number, email, address, passport details, photo, geolocation, device identifiers linked to an account. For a website this usually means data from lead forms, sign-ups and orders, plus CRM, mailing lists and analytics tied to a user.

The law distinguishes the database owner (who decides why and which data is processed) from the operator (who processes it on the owner's behalf). A company with a website is usually the owner; the hosting provider, CRM service or contractor are operators.

Data localization

Since April 2021, Article 27-1 applies: when personal data of Uzbek citizens is processed using information technologies, including over the internet, its collection, systematization and storage must take place in databases on technical means physically located in Uzbekistan and registered in the State Register.

In practice this means:

• The primary database with citizens' data lives on a server in an Uzbek data center or with a local cloud provider.
• Foreign services (CRM, email marketing, forms, chatbots, analytics with user data) need a separate assessment: where the data is physically stored and whether that setup is acceptable.
• Questions such as copies abroad or cross-border transfers are open to interpretation — agree on them with a lawyer.

Consent

• Consent must be explicit: a separate checkbox that is not pre-ticked, not a line in small print.
• The user should understand what data, for what purposes and for how long you process it, and who you share it with.
• Consent can be withdrawn — provide a way to do that and a procedure for deleting data.
• Collect only what the purpose needs: a contact form does not need passport details.
• Keep proof of consent: date, text version, source.

Database registration

Personal databases must be registered in the State Register of Personal Databases, maintained by the authorized state body. It is best to register before you start collecting data and to update the details when they change. Check the current submission procedure with the authorized body or a lawyer, as it can change.

Practical steps for an online business

1. Inventory: list every place where data is collected and stored (forms, CRM, 1C, email, spreadsheets, bots, analytics).
2. Hosting: move databases with citizens' data to servers in Uzbekistan.
3. External services: for each one, find out where it stores data and decide whether to keep it.
4. Documents: a personal data processing policy on the site, consent text, an internal data protection regulation.
5. Forms: a consent checkbox that is not pre-ticked and a link to the policy.
6. Responsibility: appoint an employee or unit responsible for data processing.
7. Register the database in the State Register.
8. Security: HTTPS, access control, access logs, backups, encryption of sensitive data.
9. Data subject requests: a process for handling requests to access, correct and delete data.