LexLint

Know the law where your app runs.

Law / Uzbekistan

Law on Cybersecurity, cybersecurity incident notification duty

Law No. O'RQ-764 (15 April 2022) "On Cybersecurity," Arts. 3, 16, 22-24

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 17 July 2022.

A vulnerability and incident reporting rule binding private bodies.

As of 18 September 2026.

What it requires

  • Notify the State Security Service of any cybersecurity incident or cybercrime affecting your information systems or resources as soon as it occurs; the statute sets no numeric deadline or severity threshold.
  • Take steps to prevent the loss of digital evidence needed to fully investigate the incident, and keep the records needed to analyze it.
  • If you investigate the incident yourself because you hold the resources and technical means to do so, report the results to the State Security Service.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Article 37 refers a violation of the cybersecurity legislation generically to liability "in the established manner," which the statute's own official commentary at that article identifies as the Code of Administrative Liability (Arts. 155, 202-2) and the Criminal Code (Ch. XX-1); the Law itself states no maximum penalty for either track.

Who enforces it

Enforcement body

State Security Service of the Republic of Uzbekistan

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A "cybersecurity subject," defined as any legal entity or individual entrepreneur that owns, uses, or disposes of national information resources, or that provides electronic information services using them, must notify the State Security Service of cybersecurity incidents and cybercrimes as they occur, take measures to prevent the loss of digital evidence needed to fully expose the incident, and keep the records needed to analyze it.

The Law sets no numeric reporting deadline and no severity or materiality threshold for this duty. Where the affected resource's owner has the resources and technical means to investigate the incident itself, it may do so, but must then report the results to the State Security Service.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
  • serves_minors
  • operates_social_platform
  • ships_mobile_app
  • distributes_software_product

Read the law

official statute text, lex.uz, Uzbekistan's national legislation database

Back to the example  ·  Lint your app