The resolution, adopted on July 29 and published on Lex.uz, implements amendments to Uzbekistan's Law "On Personal Data" approved in March this year. Under the revised legislation, specific categories of personal data may be stored outside Uzbekistan in countries that have been officially recognized as providing adequate safeguards for personal data protection.

The Ministry of Internal Affairs' Department for Migration and Personalization will be responsible for proposing additions to or removals from the approved list.

The list includes 49 countries and territories, among them the United States, the United Kingdom, Canada, Japan, South Korea, Singapore, Russia, Germany, France, Italy, Spain, the Netherlands, Switzerland, Norway, Sweden, Finland, Brazil, Argentina, Israel and New Zealand, as well as several British Crown Dependencies and territories.

Under the new rules, personal and anonymized data may be transferred automatically through information systems established under international agreements to jurisdictions included on the list without notifying the authorized state body. Database operators, however, must take measures to prevent data leaks.

If a personal data breach occurs during a cross-border transfer, the database operator must notify the competent authority within 24 hours. A follow-up report explaining the cause of the breach and the measures taken to address it must be submitted within 72 hours.

Transfers of personal data to countries that are not included on the approved list will remain permissible only if database owners and operators comply with the required legal, organizational and technical safeguards. Meanwhile, the Ministry of Internal Affairs, the Ministry of Digital Technologies, the State Security Service and the National Agency for Prospective Projects are tasked with approving standard contractual clauses and corporate rules governing such transfers.

Linked to broader digital reforms

The latest decision follows legislative changes signed by President Shavkat Mirziyoyev on March 26, which relaxed Uzbekistan's data localization requirements. Under the amended law, mandatory storage on servers located within Uzbekistan now applies only to biometric and genetic data, as well as subscriber data held by telecommunications operators. Other categories of personal data may be processed abroad, provided certain conditions are met.