The resolution, adopted on July 29 and published on Lex.uz, implements amendments to Uzbekistan's Law "On Personal Data" approved in March this year. Under the revised legislation, specific categories of personal data may be stored outside Uzbekistan in countries that have been officially recognized as providing adequate safeguards for personal data protection.
The Ministry of Internal Affairs' Department for Migration and Personalization will be responsible for proposing additions to or removals from the approved list.
The list includes 49 countries and territories, among them the United States, the United Kingdom, Canada, Japan, South Korea, Singapore, Russia, Germany, France, Italy, Spain, the Netherlands, Switzerland, Norway, Sweden, Finland, Brazil, Argentina, Israel and New Zealand, as well as several British Crown Dependencies and territories.
Under the new rules, personal and anonymized data may be transferred automatically through information systems established under international agreements to jurisdictions included on the list without notifying the authorized state body. Database operators, however, must take measures to prevent data leaks.
If a personal data breach occurs during a cross-border transfer, the database operator must notify the competent authority within 24 hours. A follow-up report explaining the cause of the breach and the measures taken to address it must be submitted within 72 hours.
Transfers of personal data to countries that are not included on the approved list will remain permissible only if database owners and operators comply with the required legal, organizational and technical safeguards. Meanwhile, the Ministry of Internal Affairs, the Ministry of Digital Technologies, the State Security Service and the National Agency for Prospective Projects are tasked with approving standard contractual clauses and corporate rules governing such transfers.
Linked to broader digital reforms
The latest decision follows legislative changes signed by President Shavkat Mirziyoyev on March 26, which relaxed Uzbekistan's data localization requirements. Under the amended law, mandatory storage on servers located within Uzbekistan now applies only to biometric and genetic data, as well as subscriber data held by telecommunications operators. Other categories of personal data may be processed abroad, provided certain conditions are met.
During a meeting with representatives of American companies, investment funds and financial institutions in the United States in November 2025, Mirziyoyev said the government was updating legislation regulating personal data and digital platforms. He noted that the reforms would create opportunities for launching global payment systems such as Apple Pay and Google Pay in Uzbekistan, while also supporting the establishment of a digital academy and a network of startup hubs.
The government has been working to attract international payment platforms for several years. In 2024, authorities instructed the Tourism Committee, the Central Bank and the Ministry of Digital Technologies to negotiate with Alipay, Apple Pay, Google Pay, PayPal and UnionPay on integrating their services into Uzbekistan's payment infrastructure.
Most recently, Central Bank official Jamshid Usmanov said the regulator, together with Humo, Uzcard and commercial banks, had begun negotiations on launching Apple Pay and Google Pay following the legislative amendments. According to Usmanov, positive developments are expected in the coming months, with either one or more commercial banks or one of the national payment operators potentially becoming the first to introduce the services.
