Uzbekistan PDL

Law on Personal Data (No. ZRU-547)

Flag of UZ
UzbekistanOpt-inNational
Back to Regulations Guide

Key Facts

Effective Date
July 2, 2019
Enacted
July 2, 2019
Enforcing Authority
State Inspectorate for Control over Informatization and Telecommunication
Consent Model
Opt-in
Applies To
Government and private sector entities processing personal data in Uzbekistan

Overview

Uzbekistan's 2019 Law on Personal Data requires explicit consent for most data processing activities. The April 2025 Presidential Decree (PP-153) marks a significant shift from declarative norms to practical accountability, introducing compulsory breach notifications and legal liability for the financial sector.

What This Means for Your Website

  • Explicit consent is required for data collection, third-party provision, and cross-border transfers
  • Consent is required for distributing advertisements via internet/telecommunications
  • Data localization requirements apply
  • Cross-border transfers are restricted to countries with adequate protection
  • Practical enforcement is increasing following the April 2025 Decree

Key Requirements

The State Inspectorate enforces the law with enforcement shifting toward practical accountability. Specific penalty amounts are not widely documented. The financial sector faces compulsory breach notification under the April 2025 Decree. Parliament is reviewing an AI regulation bill with data protection accountability.

How ConsentStack Handles This

ConsentStack applies explicit consent for Uzbek visitors, meeting the law's consent requirements for data collection and cross-border transfers.

Penalties

Not publicly documented with specific amounts. Trend toward stricter enforcement and practical accountability.

Key Requirements

  • Explicit consent for data collection, third-party provision, and cross-border transfers
  • Consent required for internet advertising distribution
  • Data localization requirements
  • Cross-border transfers restricted to adequate-protection countries
  • Breach notification strengthened by April 2025 Decree for financial sector

Notable Provisions

  • April 2025 Presidential Decree shifts toward practical enforcement
  • Parliament considering AI regulation with data protection accountability
  • One of the stronger Central Asian data protection laws
  • Financial sector breach notification now compulsory

Other Central Asia Regulations

Kazakhstan LPDPKazakhstan
Kazakhstan's LPDP requires written consent before collecting personal data with detailed specifications. Data must be stored within Kazakhstan (data localization). A massive 2025 breach affecting 16 million individuals prompted proposals for criminal liability for mass leaks. Breach notification is required within one business day.
Kyrgyzstan Law 58Kyrgyzstan
Kyrgyzstan's 2008 law provides a basic data protection framework. The May 2025 amendment introducing administrative liability for violations represents a significant step, as previously the law lacked effective penalty mechanisms. Enforcement is still minimal but growing.
Tajikistan Law 1537Tajikistan
Tajikistan's 2018 data protection law provides a framework for personal data processing with consent requirements. Enforcement is in its infancy with very low penalties and minimal practical enforcement activity. The President determines the authorized enforcement body.
Turkmenistan Law 519-VTurkmenistan
Turkmenistan has the weakest data protection framework among Central Asian states. No dedicated data protection authority exists, penalties are very low (120-150 EUR for administrative violations), and practical enforcement is essentially non-existent. No Central Asian state has acceded to Council of Europe Convention 108+.

Frequently Asked Questions

Is Uzbekistan enforcing data protection?

Enforcement is shifting toward practical accountability. The April 2025 Presidential Decree introduced compulsory breach notifications for the financial sector.

Does Uzbekistan have data localization?

Yes. Data localization requirements apply to personal data processed in Uzbekistan.

Is Uzbekistan considering AI regulation?

Yes. Parliament has approved a bill (first reading) to regulate AI and introduce legal accountability for misuse of personal data.

Stay compliant with Uzbekistan PDL

ConsentStack helps you implement Opt-in consent for Uzbekistan automatically.

Get started free