The Law “On Personal Data” in Uzbekistan has been amended, as to a report from the Ministry of Justice press service. The revised law was signed by President Shavkat Mirziyoyev on March 26 and comes into force on the day of its official publication.
Under the amendments, biometric and genetic data of individuals, as well as data of citizens using services from telecommunications operators operating in Uzbekistan, must be stored within the country. Other categories of personal data may be stored and processed outside Uzbekistan only if at least one of the following conditions is met:
The foreign state is recognized as providing adequate protection for personal data.
The operator has adopted and complies with standard contractual clauses or mandatory corporate rules approved by the authorized government agency.
The operator adheres to international standards for the management and storage of personal data, as listed by the authorized government agency.
The legislative process for these amendments began with the adoption of the bill by the Legislative Chamber in January and the Senate of the Oliy Majlis in February.
The amendments follow earlier initiatives addressing personal data regulation and digital platform integration. During his visit to the United States in November 2025, President Mirziyoyev met with representatives of American companies, investment funds, and financial institutions, raising the issue of personal data use and outlining upcoming legislative changes. He noted that the updates would facilitate the launch of international payment systems, such as Apple Pay and Google Pay, and support the creation of a digital academy and startup hubs in Uzbekistan.
In October 2024, the government approved measures aimed at the effective use of Uzbekistan’s tourism potential, directing the Tourism Committee, the Central Bank, and the Ministry of Digital Development to negotiate with international payment platforms, including Alipay, Apple Pay, Google Pay, PayPal, and Unipay, for integration into Uzbekistan’s financial services.
Experts and business representatives have highlighted challenges in implementing the previous law, particularly regarding storage requirements. Article 27-1 of the 2021 Law “On Personal Data” mandated that personal data be collected, systematized, and stored on technical means physically located in Uzbekistan. Oliver Hughes, Head of International Operations at TBC Bank, noted at the end of 2024 that these strict storage requirements limit scalability and increase costs, particularly in the development of artificial intelligence applications.
President Mirziyoyev supported proposals to allow banks and other operators to store certain data both domestically and abroad, while emphasizing that the state must ensure high standards of security and accuracy in handling personal data. The Ministry of Economy and Finance, the Central Bank, and the Ministry of Justice were tasked with developing corresponding proposals.
