On 18 July, stakeholders gathered in Tashkent to discuss the legal implications of personal data regulation and its impact on digital innovation in Uzbekistan. The meeting was attended by representatives of the Presidential Administration, the Ministry of Digital Technologies, the National Agency for Perspective Projects (NAPP), the Central Bank, and global companies including Google, Visa, and Mastercard, as well as legal experts, fintech firms, and industry associations.
The central issue was Article 27–1 of the Personal Data Law, which requires that servers processing the personal data of Uzbek citizens be physically located within Uzbekistan. According to Hikmatilla Ubaydullaev, Acting Executive Director of the Central Asian Association for Artificial Intelligence (AICA), this provision is creating uncertainty for businesses due to its vague interpretation.
“Key questions remain unresolved. In digital payments, who qualifies as the ‘data operator’ – the bank or the tech platform? Is a user’s checked consent box enough for cross-border data transfers? And which authority is responsible for issuing legally binding clarifications?” Ubaydullaev asked.
He stressed that the core issue lies not in the rule itself, but in the absence of clear guidelines, which “creates legal risks and slows down innovation,” including the launch of modern digital services like Google Pay and Apple Pay, the development of cloud technologies, and the rollout of AI-powered solutions.
Shukhrat Kurbanov, blogger at Kurbanoff.net and a participant in the meeting, also pointed to the ambiguity of the law’s language.
“The problem preventing global players like Google Pay and Apple Pay from entering our market stems from how the law is written. It’s so vague that, depending on who interprets it, it could mean anything. And there’s no clarity on who should provide official explanations,” he noted.
As an example, Kurbanov cited the issue of whether Google becomes a data operator – and thus subject to localization – when it receives card details from a user to tokenize them.
“We already provide Google and Apple with our data – geolocation, card numbers, names, and CVV codes – when buying things like Telegram Premium or ChatGPT subscriptions. And no one bans it – everyone understands how it works,” he wrote.
According to Ubaydullaev, some participants advocated for a full repeal of the data localization clause. Others favored a compromise approach: retaining the requirement only for government agencies and companies with more than 20% state ownership, while allowing flexible rules for commercial organizations as long as user consent is obtained for cross-border data transfers.
