In a regulatory environment that has moved with unusual speed over recent years, Uzbekistan's treatment of data localisation for foreign investors has emerged as one of the more consequential — and least anticipated — compliance obligations under the Law on Investments and Investment Activity. Foreign companies entering the Uzbek market frequently encounter data protection requirements late in the market-entry process, at the point where operational systems are already configured and vendor contracts already signed. This case comment analyses the data localisation framework as it applies to foreign investors, draws on a representative enforcement scenario, and identifies the practical steps that in-house counsel and market-entry advisers should take before operations commence.
The Law on Investments and Investment Activity establishes the foundational framework governing the rights and obligations of foreign investors operating in Uzbekistan. Within that framework, the law intersects with Uzbekistan's broader data protection legislation — which imposes requirements on entities that collect, process, or store personal data relating to Uzbek residents. The result is a layered compliance picture: the investment law governs investor protections and operational conditions at the macro level, while data protection legislation governs how investor-operated systems must handle personal information at the operational level.
What makes this intersection particularly relevant for foreign companies is the concept of data localisation — the requirement that personal data relating to Uzbek residents be stored on servers physically located within Uzbekistan. This requirement is not unique to Uzbekistan: analogous obligations exist across several CIS jurisdictions, including Russia and Kazakhstan. However, the Uzbek framework applies to foreign investors specifically in a manner that interacts with the investment registration and licensing process, meaning that data-handling arrangements can become a condition of, or obstacle to, obtaining operational clearances.
Foreign companies in sectors that are data-intensive by nature — technology platforms, financial services, healthcare, logistics and retail — are disproportionately exposed. A European software-as-a-service provider operating a subsidiary in Tashkent, for example, may find that its standard cloud-architecture model, designed for EU data flows, requires material modification before it is compliant with Uzbek localisation requirements. The Law on Investments and Investment Activity does not itself set out detailed data-handling rules, but it establishes the framework within which sector-specific and cross-cutting regulatory obligations — including data localisation — apply to foreign investors.
In a matter that illustrates the practical application of this framework, a foreign-owned entity engaged in retail operations in Uzbekistan was subject to a regulatory review initiated by the competent data protection authority. The entity had operated for approximately eighteen months using a cloud-based customer data management system hosted on servers located outside Uzbekistan. The arrangement was typical for international retail operators and reflected the parent company's group-wide IT infrastructure.
The regulatory review found that the entity's data-processing arrangements did not satisfy Uzbekistan's localisation requirements in respect of personal data relating to Uzbek customers. The authority noted that the entity's operations — conducted under the regulatory conditions attached to its investment registration — generated ongoing obligations under data protection legislation that could not be discharged by relying on offshore infrastructure, regardless of the contractual arrangements in place with the cloud provider.
The outcome of the review included a requirement to bring infrastructure into compliance within a defined remediation period, together with ongoing monitoring of the entity's data-handling practices. No criminal liability arose in this instance, but the regulatory interaction created material disruption to the entity's operations during the remediation period and required engagement with both local technical providers and the competent authority over several months.
"The Uzbek data localisation framework does not operate in isolation from the investment law conditions under which a foreign entity receives its operating permissions — this is the aspect that most frequently surprises in-house counsel encountering Uzbekistan for the first time." — Nodira Yusupova, Contributing Regional Analyst — Uzbekistan, Vetrov & Partners
What this scenario reveals is not simply that Uzbekistan enforces data localisation — it is that enforcement occurs within the broader context of investment regulation. An entity's failure to comply with data-handling obligations is not treated purely as a data protection matter; it can affect the regulatory standing of the investment itself. This connection between data compliance and investment status is the aspect of Uzbek law that is most consistently underestimated by foreign companies entering the market.
[CTA: If your company is entering the Uzbek market or reviewing compliance for an existing Uzbek operation, make an enquiry: info@vetrovpartners.com | WhatsApp/Telegram: +7 (983) 510-38-76]
For in-house counsel advising a company with Uzbek market ambitions, the implications of this framework are concrete and front-loaded. Data architecture decisions made during the market-entry phase — choices about where customer data will be stored, what cloud providers will be engaged, and how group-level data flows will be managed — have direct regulatory consequences that are difficult and costly to reverse once operations are live.
Several categories of foreign company face heightened exposure. Technology businesses whose core product involves processing user data at scale must assess localisation obligations before launching Uzbek-facing services. Financial services companies, which typically operate under sector-specific regulatory regimes that sit alongside the investment framework, face a compound compliance picture. Companies in healthcare, insurance, and any sector that handles sensitive personal data face the most acute version of the compliance burden, since the localisation requirement applies with particular force to sensitive data categories.
The interaction between the Law on Investments and Investment Activity and data protection obligations creates a sequencing challenge. Investment registration — including the conditions attached to an investment approval or a company formation under the investment law framework — typically precedes the detailed operational design of a business. This means that a company may have formal investment status before it has addressed the data-handling conditions that attach to its sector. Regulators do not always draw this sequencing distinction; from an enforcement perspective, the obligation exists from the point at which the entity begins processing personal data relating to Uzbek residents, regardless of the stage of the investment process.
Practical steps that in-house counsel should take before Uzbek operations commence include: conducting a pre-entry data mapping exercise to identify what categories of personal data the business will process and in what volumes; assessing whether existing IT infrastructure can satisfy localisation requirements or whether dedicated Uzbek-hosted solutions are required; engaging with local technical providers at the market-entry stage rather than after go-live; and ensuring that investment registration documents and sector licences are reviewed for any data-handling conditions embedded in the approval terms.
The cross-border dimension — particularly for companies that already operate in Russia or Kazakhstan and have encountered localisation requirements in those jurisdictions — is worth addressing directly. Uzbekistan's localisation framework shares structural similarities with its CIS neighbours but is not identical. Companies that have achieved localisation compliance in Russia or Kazakhstan cannot assume that the same technical solution will satisfy Uzbek requirements. A tailored compliance assessment for the Uzbek jurisdiction remains necessary. The firm's Regulatory & Licensing practice for Uzbekistan (/jurisdictions/uzbekistan/regulatory-licensing/) provides exactly this analysis for clients entering the market.
For companies with existing Uzbek operations that have not yet conducted a data localisation audit, the enforcement scenario described above suggests that regulatory review can occur well into the operational lifecycle — eighteen months after market entry, in the matter referenced. The remediation burden at that stage is significantly higher than a pre-entry assessment would have been. For advisers at foreign law firms coordinating market-entry mandates in Uzbekistan, confirming that local data compliance counsel has been engaged alongside corporate and licensing counsel is the single most straightforward risk-reduction step available.
[CTA: To discuss data protection compliance for an Uzbek market-entry or an existing Uzbek operation, make an enquiry: info@vetrovpartners.com | WhatsApp/Telegram: +7 (983) 510-38-76]
Q: What does this ruling change for foreign companies with existing Uzbek operations?
A: The enforcement scenario confirms that Uzbekistan's data localisation requirements are actively enforced against foreign-invested entities and that non-compliance is assessed in the context of the entity's investment status — not merely as a standalone data protection matter. For companies already operating in Uzbekistan without a completed localisation assessment, the practical implication is that a regulatory review could arise at any point in the operational lifecycle. The recommended response is to conduct a data mapping and infrastructure audit without waiting for a regulatory trigger, and to engage with local counsel to assess remediation options before any formal interaction with the competent authority.
Q: What should foreign companies do in light of this decision?
A: Foreign companies — whether entering Uzbekistan or reviewing an existing operation — should treat data localisation as a component of the investment compliance framework, not as a separate technical matter to be addressed after regulatory approvals are secured. Concretely: map what personal data the business processes relating to Uzbek residents; assess whether current infrastructure satisfies localisation requirements; identify local hosting solutions if offshore infrastructure is being used; and review investment registration and sector licence conditions for any data-handling obligations embedded in approval terms. Companies with operations across multiple CIS jurisdictions should conduct a jurisdiction-specific assessment for Uzbekistan rather than relying on compliance solutions designed for Russia or Kazakhstan.
Vetrov & Partners is a Russian boutique law firm established in 2009, recognised by Pravo-300 for eight consecutive years and listed as a trusted adviser by the German Consulate General in Novosibirsk. The firm advises foreign investors, creditors, and in-house legal teams on regulatory compliance, market entry, and disputes across Russia and CIS jurisdictions including Uzbekistan. Regional matters are handled in collaboration with trusted local counsel in each jurisdiction. We are a Russian-qualified law firm; for matters governed by Uzbek law, we collaborate with qualified Uzbek counsel.
Enquiries: info@vetrovpartners.com | WhatsApp / Telegram: +7 (983) 510-38-76 | t.me/vitvetcom
This publication is provided for informational purposes only and does not constitute legal advice under Russian or any other applicable law. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Vetrov & Partners is a Russian-qualified law firm. For matters governed by foreign law or requiring local admission in another jurisdiction, we collaborate with trusted counsel in the relevant jurisdiction. For advice regarding your particular situation, please contact info@vetrovpartners.com.
— Nodira Yusupova Contributing Regional Analyst — Uzbekistan, Vetrov & Partners vetrovpartners.com/contributions/