Among the compliance questions that arise most frequently when foreign companies plan entry into Uzbekistan, data localisation sits at an intersection that practitioners often underestimate: it is simultaneously a personal data question, a regulatory licensing question, and — since the enactment of the Law on Competition (LRU-850, 2023) — a competition law question. For technology platforms, distribution businesses, and any foreign company that processes personal data of Uzbek residents as part of its commercial activity, the obligations are layered in ways that standard market-entry checklists rarely capture. This article maps the current framework as it stands in mid-2027, identifies where LRU-850 creates distinct exposure for foreign investors, and sets out what compliance teams should address before operations begin.
Uzbekistan's data protection and localisation framework is built on a foundation that predates LRU-850 but has been materially shaped by it. The primary instrument governing the processing of personal data of Uzbek residents is the Law on Personal Data, which — under the prevailing interpretation applied by the Agency for Personal Data Protection — requires that databases containing personal data of Uzbek citizens be stored on servers physically located within the territory of Uzbekistan. This obligation applies broadly: it is not limited to companies incorporated in Uzbekistan, but extends to any operator that collects or processes such data in connection with the provision of goods or services to Uzbek residents, or in connection with monitoring the behaviour of persons located in Uzbekistan.
In practice, the localisation obligation means that a foreign company operating in Uzbekistan — whether through a representative office, a wholly owned subsidiary, or a cross-border service arrangement — must either establish or contract for local server infrastructure, or use a local data processor that maintains compliant infrastructure on its behalf. As of mid-2027, the Agency for Personal Data Protection has developed a registry of operators and a notification-based compliance mechanism; the specifics of that mechanism, and the threshold below which notification may not be required, are subject to regulatory guidance that has evolved incrementally since the framework's adoption.
Three categories of data receive particular attention under the Uzbek framework. First, data processed in connection with employment relationships — which is directly relevant to foreign companies with local staff. Second, data held by digital platform operators, including those providing e-commerce, fintech, or logistics services to Uzbek consumers. Third, data processed by entities operating in regulated sectors (banking, insurance, telecommunications), where sector-specific rules layer on top of the general localisation obligation. Foreign investors should map their data processing activities against these categories before structuring their Uzbek operations.
[CTA: If your company processes personal data of Uzbek residents or is planning entry into the Uzbek market, the compliance picture is more layered than a standard market-entry checklist reflects. Make an enquiry: info@vetrovpartners.com | WhatsApp/Telegram: +7 (983) 510-38-76]
The Law on Competition (LRU-850, 2023) is primarily an antitrust statute. It governs the conduct of economic entities in Uzbek markets, addresses abuse of dominance, regulates mergers and acquisitions above certain thresholds, and establishes the institutional framework of the Antimonopoly Committee of Uzbekistan. Its significance for data protection and localisation questions arises from two specific angles that practitioners working on foreign market entry should understand.
The first angle is the treatment of data as a competitive asset. LRU-850 reflects a legislative approach — consistent with regulatory developments in a number of other CIS jurisdictions — under which control over significant volumes of user or consumer data can constitute a basis for market dominance or a material parameter of market power. Under the prevailing interpretation, the Antimonopoly Committee has the competence to assess whether a company's exclusive control over localised data sets constitutes a barrier to entry or creates an asymmetric competitive advantage that distorts competition in a relevant market. For foreign companies with established data assets in their home markets, this creates a novel form of regulatory scrutiny on entry: the question is not only whether the company will comply with localisation obligations, but whether its data position, once localised, may attract dominance analysis.
The second angle is interoperability and data access. LRU-850 contains provisions that allow the Antimonopoly Committee to impose interoperability or data-sharing requirements on dominant operators in digital markets as a remedy for established or threatened dominance. In practice, as of mid-2027, enforcement in this area remains at an early stage, and the Committee's published guidance on what constitutes dominance in data-driven markets is still developing. However, for foreign companies seeking to enter the Uzbek digital, fintech, or e-commerce markets, the possibility of data-access obligations should be factored into platform architecture decisions at the outset — it is structurally more difficult to design interoperability into a platform after deployment than before.
A third, more procedural angle concerns merger control. Where a proposed acquisition in Uzbekistan involves a target that processes significant volumes of personal data, LRU-850 requires that the Antimonopoly Committee assess the transaction not only on traditional market-share criteria but also on the data dimension of the concentration. Foreign acquirers should expect questions about data flows, localisation compliance of the target, and post-merger data integration plans as part of the standard merger review process.
"The Law on Competition (LRU-850, 2023) quietly repositioned data from a compliance subject into a competition subject — a shift that foreign investors planning digital or platform-based entry into Uzbekistan should factor into their regulatory strategy from day one." — Nodira Yusupova, Contributing Regional Analyst — Uzbekistan, Vetrov & Partners
For a foreign company entering Uzbekistan, the data protection and localisation obligations under the Uzbek framework translate into a set of concrete operational requirements. Understanding these in sequence helps compliance teams build a workable programme rather than approaching the framework as a single, undifferentiated obligation.
The first and most immediate requirement is data mapping. Before a foreign company can determine whether it is subject to the localisation obligation, it must identify which of its data processing activities involve personal data of Uzbek residents. This requires an analysis of the company's products, services, and internal processes — including HR data for local employees, customer data collected through Uzbek-facing digital products, and operational data generated by local business activity. For companies entering via a representative office or limited-presence structure, the data processing scope may be narrower than for those establishing a full subsidiary or digital platform.
The second requirement concerns infrastructure or processor arrangements. Once the data processing scope is mapped, the company must either establish compliant local server infrastructure or engage a certified local data processor. The market for compliant data processing services in Uzbekistan has developed considerably since 2023; a number of established local technology providers offer processor arrangements that satisfy the localisation requirement. The commercial terms and technical specifications of such arrangements should be reviewed by counsel familiar with the Uzbek regulatory framework, since not all offerings in the market provide the same level of compliance assurance.
The third requirement is notification to the Agency for Personal Data Protection. Under the prevailing regulatory position, operators processing personal data of Uzbek residents are generally required to register with the Agency and to notify it of the categories of data processed, the legal basis for processing, and the location of the relevant databases. For foreign companies operating through a local subsidiary or representative office, the notification obligation typically falls on that local entity. For companies providing cross-border services without a local presence, the regulatory position on the notification obligation is less clearly settled, and legal advice specific to the company's operational model is advisable.
The fourth requirement, which arises from LRU-850 specifically, is the potential obligation to assess dominance before establishing a data-intensive operation. Foreign companies that will hold, process, or aggregate significant volumes of market-relevant data in Uzbekistan — whether through a distribution platform, a fintech service, or a data analytics operation — should conduct a preliminary dominance assessment under LRU-850 before their market entry is complete. This assessment serves two purposes: it establishes a documented baseline position for regulatory purposes, and it allows the company to structure its operations and data architecture with the Committee's potential scrutiny in mind.
For in-house counsel at multinational companies planning Uzbekistan operations, the regulatory timeline for completing these steps before launch is typically underestimated. The notification process, infrastructure arrangements, and any dominance assessment together represent a compliance workstream that in practice commonly extends across several months. Starting the process after the decision to enter has been made — rather than as part of the entry planning — materially increases both the cost and the risk of the programme.
[CTA: For in-house counsel managing a multi-jurisdiction entry programme that includes Uzbekistan, establishing a reliable regulatory compliance workstream early avoids the structural delays that commonly arise when data localisation is addressed after other entry steps have been completed. Make an enquiry: info@vetrovpartners.com | WhatsApp/Telegram: +7 (983) 510-38-76]
For many foreign companies approaching the Uzbek market, Uzbekistan does not stand alone as a target jurisdiction. It sits within a commercial and operational context that frequently includes Russia, Kazakhstan, and other CIS states. This regional context creates specific questions about cross-border data flows that are worth addressing separately from the general localisation framework.
Uzbekistan is a member of the Commonwealth of Independent States (CIS) but is not a member of the Eurasian Economic Union (EAEU). This distinction matters for data flows: EAEU member states benefit from a framework of mutual recognition of data protection standards that does not extend to Uzbekistan. A foreign company operating across both Russia and Uzbekistan cannot assume that data flows between its Russian and Uzbek operations are subject to a harmonised regulatory treatment. Under the Uzbek framework, transfers of personal data outside Uzbekistan are generally permitted only where the recipient country provides an adequate level of personal data protection, or where the data subject has given explicit consent, or where a recognised exception applies. Russia is not on a published list of countries providing adequate protection under the Uzbek framework as it was understood at the time of this writing, which means that a Russian entity receiving personal data of Uzbek residents from a related Uzbek operation must have a compliant legal basis for that transfer — typically consent or a contractual necessity ground.
From a competition law perspective under LRU-850, cross-border data flows also present the question of whether a data-sharing arrangement between a foreign parent and its Uzbek operation constitutes a form of data transfer that could affect competitive conditions in the Uzbek market. Where a foreign company's business model involves systematic data aggregation across multiple jurisdictions — feeding Uzbek consumer or market data into a centralised analytics platform operated from another jurisdiction — the Antimonopoly Committee may, under the prevailing interpretation of LRU-850, have an interest in whether that arrangement affects data availability within the Uzbek market or creates the conditions for market power through extra-territorial data concentration.
For companies with Russian operating entities, there is an additional layer of practical consideration. Where a Russian entity is the regional hub through which Uzbek operations are coordinated — receiving data, providing services, or serving as the contracting party for Uzbek customers — the compliance programme must address both Russian personal data law (which itself imposes localisation requirements for Russian residents) and Uzbek data localisation requirements for Uzbek residents. These obligations do not simply overlap: they impose requirements that must be engineered separately, since the data of Russian and Uzbek residents cannot, under a compliant architecture, be consolidated in a single database located in one country without violating the requirements of the other.
The combined framework of the Uzbek personal data rules and LRU-850 is manageable, but it requires structured attention. The following steps reflect the approach that, in practice, tends to produce a more robust compliance outcome for inbound foreign investors.
The first step is a regulatory mapping exercise conducted before the entry structure is finalised. This means identifying, at the point of structuring, which data processing activities will be associated with the Uzbek operation, which of those activities involve personal data of Uzbek residents, and whether any of the data processing activities may attract dominance analysis under LRU-850. The output of this mapping exercise should directly inform the choice of entry vehicle and the design of the company's data architecture.
The second step is counsel engagement that covers both data protection and competition law. In the Uzbek context, these two regulatory streams are not independent — as the analysis above illustrates, LRU-850 creates a competition-law overlay on what would otherwise be a straightforward data compliance exercise. Counsel unfamiliar with the competition dimension of LRU-850 may produce a data compliance programme that satisfies the personal data rules but fails to account for the Antimonopoly Committee's potential interest in the company's data position.
The third step is infrastructure planning. Data localisation compliance requires physical infrastructure or a processor arrangement. This is not a legal-advice item that can be completed at the last minute; it requires lead time for procurement, technical integration, and — where a certified processor is used — due diligence on that processor's own compliance status. Infrastructure and processor arrangements should be in place and tested before the company begins processing personal data of Uzbek residents at operational scale.
The fourth step is ongoing monitoring. The Uzbek regulatory framework for data protection and competition in digital markets was still developing as of mid-2027. Regulatory guidance from both the Agency for Personal Data Protection and the Antimonopoly Committee has been issued incrementally, and further developments — including implementing regulations under LRU-850 governing digital market dominance assessments — were anticipated. A foreign company that establishes a compliant programme at the point of entry should build into its compliance structure a mechanism for monitoring regulatory updates and assessing their impact on its existing operations.
For foreign law firms instructing Uzbek or regional counsel on behalf of clients entering the Uzbek market, the practical value of co-counsel with an established understanding of both the personal data framework and LRU-850 is significant. The regulatory landscape in Uzbekistan is developing at a pace that makes reliance on standard CIS-market templates — or on compliance programmes designed for EAEU jurisdictions — genuinely risky. Uzbekistan's framework has its own institutional logic, its own enforcement priorities, and, with LRU-850, its own statutory innovation in the intersection of data and competition law.
[CTA: Vetrov & Partners advises foreign companies and their counsel on Uzbek regulatory entry, data protection compliance, and competition law under LRU-850. If you are planning entry into Uzbekistan or reviewing an existing operation's compliance position, request our practice review or make an enquiry: info@vetrovpartners.com | WhatsApp/Telegram: +7 (983) 510-38-76]
Q: Does the data localisation requirement under Uzbek law apply to foreign companies with no physical presence in Uzbekistan?
A: Under the prevailing regulatory position, the localisation obligation is not limited to companies incorporated or physically present in Uzbekistan. It applies to any operator that collects or processes personal data of Uzbek residents in connection with the provision of goods or services to those residents, or in connection with monitoring behaviour of persons located in Uzbekistan — regardless of where the operator is incorporated or where its servers are currently located. A foreign company providing e-commerce, fintech, or digital services to Uzbek consumers from outside Uzbekistan should therefore assess whether it is within scope of the localisation obligation and, if so, establish a compliant data infrastructure or processor arrangement. The threshold below which the obligation may not practically apply is not clearly codified, and legal advice calibrated to the company's specific data processing activities is advisable before assuming an exemption applies.
Q: What does the Law on Competition (LRU-850, 2023) specifically add to the data compliance picture for foreign investors?
A: LRU-850 adds three distinct layers beyond the personal data rules. First, it establishes a basis for the Antimonopoly Committee of Uzbekistan to assess a company's data position as part of a market dominance analysis — meaning that a foreign company entering with a data-intensive business model may face regulatory scrutiny not only from the Agency for Personal Data Protection but also from the competition regulator. Second, LRU-850 includes provisions under which the Committee may impose data access or interoperability obligations on dominant operators in digital markets. Third, in the context of merger control, the statute requires the Committee to consider the data dimension of concentrations above the applicable thresholds. Taken together, these provisions mean that data compliance in Uzbekistan is not a single-regulator exercise; it requires a coordinated approach covering both the personal data framework and the competition law dimension introduced by LRU-850.
Q: How do cross-border data flows between a Russian entity and a related Uzbek operation need to be structured?
A: Uzbekistan and Russia are both CIS members, but Uzbekistan is not part of the EAEU. The EAEU framework for data protection mutual recognition does not extend to Uzbekistan. Under the Uzbek personal data rules, transfers of personal data of Uzbek residents to a Russian entity require either an adequate-protection determination (which, as of the time of writing, does not cover Russia under the Uzbek framework), explicit consent from the data subjects, or a recognised contractual or statutory exception. In practice, the most commonly used basis for such transfers is data subject consent, combined with contractual arrangements between the Uzbek operator and the Russian recipient that specify the data processing purposes, retention periods, and security obligations. The architecture of such arrangements should be reviewed by counsel familiar with both Uzbek data protection law and Russian personal data law, since both jurisdictions impose localisation requirements that must be satisfied independently.
Q: Is there a notification or registration obligation for foreign companies processing personal data of Uzbek residents, and what are the consequences of non-compliance?
A: Under the Uzbek framework, operators of personal data databases are generally required to notify the Agency for Personal Data Protection of their processing activities before those activities commence at scale. For a foreign company operating through a local subsidiary or representative office, the notification obligation typically falls on that local entity. The consequences of non-compliance with the notification obligation, and with the underlying localisation requirement, can include administrative measures, orders to bring processing into compliance, and — in cases involving repeated or serious violations — restrictions on the operator's ability to process personal data in Uzbekistan. The specific enforcement posture of the Agency has developed since the framework's adoption, and the current enforcement priorities should be verified with counsel at the time of any compliance programme design.
Q: How does the LRU-850 dominance analysis apply to a foreign company that holds significant data assets in its home market but is a new entrant in Uzbekistan?
A: This is a question that, as of mid-2027, does not have a fully settled answer in Uzbek regulatory practice. Under LRU-850, dominance analysis is conducted with reference to the relevant market in Uzbekistan — meaning that a company's global data position does not automatically translate into a dominance finding in the Uzbek market. However, where a foreign entrant's business model involves deploying in Uzbekistan data-driven products or platforms that are already established in other markets, and where that deployment would give the company a data advantage over local competitors who do not have equivalent access to historical training data or user-behaviour datasets, the Antimonopoly Committee may, under the prevailing interpretation of LRU-850, have a basis to examine whether competitive conditions in the relevant Uzbek market are distorted. Foreign companies with data-intensive business models entering Uzbekistan should include a preliminary LRU-850 dominance assessment in their market-entry planning, even where they do not currently hold a dominant position in any Uzbek market.
Vetrov & Partners is a Russian boutique law firm established in 2009, recognised by Pravo-300 for eight consecutive years and listed as a trusted adviser by the German Consulate General in Novosibirsk. The firm advises foreign companies on market entry and regulatory compliance across Russia and CIS jurisdictions, including Uzbekistan.
The firm's regulatory and licensing practice assists foreign investors navigating the intersection of personal data law, competition regulation, and market-entry licensing requirements in Uzbekistan and across the CIS region. With over 1,000 matters handled since inception, the team combines regional regulatory knowledge with direct partner involvement on every engagement. For matters governed by Uzbek law, the firm works with trusted Uzbek-qualified counsel.
Enquiries: info@vetrovpartners.com | WhatsApp / Telegram: +7 (983) 510-38-76 | t.me/vitvetcom
This publication is provided for informational purposes only and does not constitute legal advice under Russian or any other applicable law. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Vetrov & Partners is a Russian-qualified law firm. For matters governed by foreign law or requiring local admission in another jurisdiction, we collaborate with trusted counsel in the relevant jurisdiction. For advice regarding your particular situation, please contact info@vetrovpartners.com.
— Nodira Yusupova Contributing Regional Analyst — Uzbekistan, Vetrov & Partners vetrovpartners.com/contributions/
Nodira Yusupova is a contributing regional analyst for Uzbekistan, advising foreign companies and investors on regulatory entry, licensing, and compliance under Uzbek law. She holds a degree from Tashkent State University of Law and has advised on matters across the technology, distribution, and manufacturing sectors in Uzbekistan. Languages: Uzbek, Russian, English.