Uzbekistan amends personal data law to facilitate global payment systems

The updated legislation is expected to clear technical hurdles for major international platforms such as PayPal, Apple Pay, and Google Pay to operate more effectively within the country.

Under the new regulations, the strict requirement for localizing data storage has been narrowed. While the majority of personal data can now be stored on international servers under specific conditions, the law maintains a firm mandate for the domestic storage of sensitive information. Specifically, biometric and genetic data of individuals, as well as the personal data of citizens using telecommunications operators active within Uzbekistan, must continue to be stored and processed exclusively on servers located within the national territory.

For other categories of personal data, storage outside of Uzbekistan is now permitted provided that at least one of three key criteria is met. First, the data may be stored in foreign states recognized as providing an adequate level of protection for personal information. Alternatively, the data operator must adopt and comply with standard contractual clauses or binding corporate rules that meet the requirements approved by the authorized state body. Finally, compliance with international standards for the management and storage of personal data, as listed by the state authorities, will also satisfy the legal requirements for overseas processing.

The Ministry of Justice confirmed that these changes are designed to align national legislation with global digital standards while ensuring a high level of security for the most sensitive types of citizen information. The law entered into force immediately upon its official publication. By modernizing these data protocols, Uzbekistan aims to attract more global financial technology providers and enhance the digital economy for its residents.