The date of April 15, 2021 will mark an important moment in the history of personal data protection in Uzbekistan, as it sees changes to the law on personal data protection, adopted at the end of 2020, now come into force.
At the end of last year, the government of Uzbekistan adopted amendments to the Law on Personal Data, providing for the following:
- personal data of citizens of Uzbekistan for processing using technical means physically located on the territory of Uzbekistan and entered in the Register of the State Data Protection Authority (data localization);
- the requirement for data localization in relation to data processing using information technologies, including via the Internet;
- place compliance responsibility on the owner or operator of the database. The owner is the person who owns the database containing the personal data, while the operator is the entity that processes the personal data in some way (gambling operators may fall under each category depending on how they store personal data and manage them);
- expand the requirements for data localization, including the collection, processing and storage of personal data.
Responsibility for failure to comply with the new requirements of the Personal Data Protection Law is defined both in the administrative and criminal codes of the Republic of Uzbekistan. Both of them have provisions related to data protection, which have also been amended and should be published after a round of public comments, which will be completed by the time of publication. This means that the following changes may also take effect soon.
modified article 46(2) of the administrative code imposes fines (approximately 100-200 euros for ordinary citizens and approximately 200-1000 euros for corporate officials) if they are found guilty of unlawfully disclosing, distributing, storing, altering, producing personal data; failure to take the necessary legal, organizational and technical measures established by law to protect personal data on the part of the owner and operator; and failure to notify the authorities if records of personal data are changed.
In cases where the aforementioned offense took place on the Internet, according to the draft rules, which have yet to be adopted, a person found guilty of an offense is subject to a fine of approximately 800 to 1500 euros and subsequent restriction of his activities on the territory of the Republic of Uzbekistan (i.e. service blocking).
modified article 141(2) The Criminal Code of the Republic of Uzbekistan introduces additional liability in the form of a fine (approximately 2000-3000 euros) or deprivation of a certain right (usually in relation to the ability to hold certain positions). positions in enterprises or organizations; or restriction on conducting certain activities in accordance with the decision of the Court) for up to three years or corrective labor for up to two years in cases where the legal entity has been repeatedly found guilty of non-compliance with the requirements of the Personal Data Protection Law and has already been sanctioned in the form of an administrative fine on the allegations in article 46(2).
Currently, online services commonly collect and process personal data from their audience in order to improve customer service and experience, although cases of personal data abuse are not uncommon.
Secure storage
Until recently in Uzbekistan, the service provider had to choose the location and ensure the security of its infrastructure, including measures for the collection, storage and processing of personal data of its users.
For companies operating in the Uzbek market, this could mean infrastructure costs, increased costs associated with running online infrastructure in the local environment, and a lack of network real estate sufficient to meet the requirements set by the authorities.
The State Personalization Center under the Cabinet of Ministers has not yet made public the details of the enforcement procedure, clarify liability and clarify other points for the market in order to better understand the implications of the amended law.
We will be monitoring all further developments in the legislative landscape of the Republic of Uzbekistan to make more updates as the process progresses.
English 
Russian 
German 
Polish 
Azerbaijani