Uzbekistan imposes mandatory data localisation requirements on all operators — including foreign companies — that collect and process personal data of Uzbek residents. Under Uzbekistan's personal data legislation, databases containing personal data of Uzbek citizens must be stored on servers physically located within Uzbekistan. Foreign companies operating in the country, whether through a subsidiary, representative office, or digital platform, are subject to these obligations regardless of where their parent entity is incorporated.
Uzbekistan's personal data regime is governed principally by its Law on Personal Data, which establishes the concepts of personal data operators, data subjects, and the conditions under which data may be collected, stored, and transferred. The law is supplemented by implementing regulations that set out registration obligations, the conditions for cross-border data transfers, and the duties of operators to protect data against unauthorised access.
The core localisation obligation requires that the primary database — or a mirrored copy — of any personal data relating to Uzbek residents be maintained within Uzbekistan. Cross-border transfers of personal data are permitted but subject to prior authorisation requirements and, in certain categories, to the existence of adequate protection standards in the recipient country. Operators must also register with the authorised state body responsible for personal data protection.
Failure to comply can result in administrative liability, suspension of data processing activities, and — in more serious cases — restrictions on the operator's ability to continue commercial activity in Uzbekistan.
For a foreign company entering the Uzbekistan market, data localisation is not a back-office compliance matter — it is an infrastructure decision that must be taken at or before market entry. Contracts with local IT hosting providers, cloud service arrangements with Uzbekistan-based nodes, and internal data architecture must all reflect the localisation requirement. Companies that rely on centralised global data platforms will typically need to configure Uzbekistan-specific data flows before commencing operations.
Data protection and localisation requirements in Uzbekistan have become a more active area of regulatory scrutiny as the country's digital economy continues to develop. Foreign investors should treat compliance with Uzbekistan's data regulation not as a one-time registration step but as an ongoing operational obligation — requiring periodic review as the regulatory framework continues to evolve.
For structuring cross-border data flows that involve both Uzbekistan and Russia — a common configuration for CIS-facing businesses — additional considerations arise under Russian data protection law as well.
[CTA: If your company is entering the Uzbekistan market or reviewing its data compliance position, make an enquiry: info@vetrovpartners.com | WhatsApp/Telegram: +7 (983) 510-38-76]
— Nodira Yusupova Contributing Regional Analyst — Uzbekistan, Vetrov & Partners vetrovpartners.com/contributions/
Nodira Yusupova advises on Uzbekistan regulatory and market entry matters as a contributing regional analyst for Vetrov & Partners. For Russian-law aspects of cross-border CIS matters, she works alongside the firm's Novosibirsk-based team.
This publication is provided for informational purposes only and does not constitute legal advice under Russian or any other applicable law. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Vetrov & Partners is a Russian-qualified law firm. For matters governed by foreign law or requiring local admission in another jurisdiction, we collaborate with trusted counsel in the relevant jurisdiction. For advice regarding your particular situation, please contact info@vetrovpartners.com.