Listen to the article
Uzbekistan’s Cabinet of Ministers has approved a list of 49 countries and territories deemed to provide adequate personal data protection, enabling certain categories of personal data to be transferred to those jurisdictions under a simplified procedure. The resolution, adopted on July 29 and published on Lex.uz, gives regulatory shape to amendments to the Law “On Personal Data” that President Shavkat Mirziyoyev signed on March 26.
The approved list spans major economies and data-processing hubs across several continents. It includes the United States, the United Kingdom, Canada, Japan, South Korea, Singapore, Russia, Germany, France, Italy, Spain, the Netherlands, Switzerland, Norway, Sweden, Finland, Brazil, Argentina, Israel and New Zealand, along with several British Crown Dependencies and overseas territories.
What the simplified procedure allows
Under the new rules, personal and anonymised data may be transferred automatically through information systems established under international agreements to any jurisdiction on the list, without the database operator first notifying the authorised state body. Operators are nonetheless required to take measures to prevent data leaks. If a breach occurs during a cross-border transfer, the operator must notify the competent authority within 24 hours and submit a follow-up report detailing the cause and remedial steps taken within 72 hours.
Transfers to countries not on the approved list remain permissible, but only if database owners and operators comply with the full set of legal, organisational and technical safeguards prescribed by law. The Ministry of Internal Affairs, the Ministry of Digital Technologies, the State Security Service and the National Agency for Prospective Projects are jointly tasked with approving the standard contractual clauses and corporate rules that will govern such transfers.
Narrowed localisation requirement
The March legislative amendments significantly narrowed Uzbekistan’s data localisation obligations. Mandatory storage on servers physically located within the country now applies only to biometric and genetic data and to subscriber data held by telecommunications operators. All other categories of personal data may be processed abroad provided the applicable conditions are satisfied — a notable relaxation of the previously broader localisation requirement.
The Ministry of Internal Affairs’ Department for Migration and Personalization has been designated as the body responsible for proposing future additions to or removals from the approved country list, giving the framework a mechanism for adjustment as other jurisdictions’ data-protection standards evolve.