Law note · Uzbekistan
Law on Personal Data, cross-border transfer and citizen data localization
What it requires
- An app transferring the personal data of an Uzbek data subject outside Uzbekistan must rely on the destination state's adequate protection, or on consent, statutory necessity, or a treaty where adequacy is absent. Separately, an app processing the personal data of Uzbek citizens, including a voiceprint or other biometric identifier, over the internet must collect, systematize, and store that data on technical means physically located in Uzbekistan and register the database in the State Register of Personal Data Bases. Several major platforms have been blocked in Uzbekistan for noncompliance with this storage duty.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotprocesses_biometricsprocesses_voice
What we found
Art. 15 permits cross-border transfer where the destination state ensures adequate protection, or, where it does not, on subject consent, statutory necessity, or an international treaty; transfer may also be restricted for constitutional-order, morality, health, rights, defense, or state-security reasons.
Art. 27-1, added by a 2021 amendment reported in force April 2021, is narrower and separate: when processing the personal data of citizens of Uzbekistan using information technologies, including the internet, the owner or operator must collect, systematize, and store that data on technical means physically located in Uzbekistan and register the database in the State Register of Personal Data Bases.
Enforcement of Art. 27-1 is documented: the State Inspectorate for Control in the Sphere of Informatization and Telecommunications blocked Twitter, TikTok, VKontakte, Skype, and WeChat in July 2021, and Facebook, Instagram, LinkedIn, Odnoklassniki, Telegram, and YouTube in November 2021, citing failure to store Uzbek users' data domestically; several were later unblocked, and TikTok was reported still restricted as of the most recent secondary reporting located.