Uzbekistan's Personal Data Law and AI: What Is Allowed and What Is Not

In Uzbekistan, personal data processing is governed by the Law "On Personal Data" (No. ZRU-547 of 2 July 2019). From 2021 it contained a strict localisation requirement: all personal data of citizens processed over the internet had to be collected and stored on servers in the country. Law No. ZRU-1125 of 26 March 2026 relaxed this: mandatory localisation now covers biometric and genetic data and data of subscribers of local telecom operators, while other personal data may be stored and transferred abroad if the law's conditions are met. For AI the takeaway stays practical: anonymised and public data is fine to send, while personal data should go to foreign AI services only if you know where it ends up and have a lawful basis.

Note: this article is a practical overview as of October 2026, not legal advice. For specific decisions, check the current text of the law on lex.uz and consult a lawyer.

What counts as personal data

Personal data is any information that directly or indirectly identifies a specific person. In practice, that includes:

• full name, date of birth, personal ID number (PINFL), passport details;
• phone number, address, email;
• photos and voice recordings that identify a person;
• information on health, income, loans and purchases;
• correspondence that mentions specific people.

An important nuance: even without a name, a combination of details ("branch manager at a bank in Karshi, aged 34") can point to one person.

The law's key requirements in plain words

1. Consent. As a rule, data may be processed with the data subject's consent, except in cases expressly set out in law.
2. Purpose. Data is processed for a stated purpose, not "just in case".
3. Protection. The owner and operator must take measures to protect the data.
4. Individual rights. People have the right to know what data about them is processed and to request correction or deletion.
5. Targeted localisation. Biometric and genetic data, as well as data of subscribers of local telecom operators, must still be stored in Uzbekistan.
6. Cross-border transfer. Other data may be stored and transferred abroad if at least one condition is met: the recipient country is recognised as ensuring an adequate level of protection; the operator uses standard contractual clauses or binding corporate rules that meet the requirements of the authorised body; or the operator complies with international standards.

What changed in 2026

• 2021. Law No. ZRU-666 of 14 January 2021 added Article 27-1: from April 2021, personal data of citizens processed via IT and the internet had to be collected and stored on technical means physically located in Uzbekistan, with databases registered in the State register of personal data bases. Many articles still describe this rule as current.
• 26 March 2026. Law No. ZRU-1125 narrowed mandatory localisation to biometric and genetic data and data of subscribers of local telecom operators. Other data gained lawful routes for storage and transfer abroad — via an adequate country, contractual clauses or international standards.
• 29 July 2026. A Cabinet of Ministers resolution approved a list of 49 countries and territories with an adequate level of personal data protection. The text is published on lex.uz.

What this means in practice: foreign hosting, CRMs and AI services are no longer prohibited by default, but they are not automatically allowed either. Check which country the provider's servers are physically in and whether it is on the list, whether the contract includes standard contractual clauses, and whether your data falls into a category with mandatory localisation. Government bodies are also bound by internal information security rules beyond this law: official information, restricted information and citizens' sensitive data should not end up in public foreign AI services — the relaxed localisation rule does not change that.

How this applies to AI services

When an employee pastes a customer list, the text of a citizen's request or a candidate's CV into ChatGPT or another cloud AI, the data is transferred to servers abroad. That is a cross-border transfer: it is lawful only if one of the law's conditions is met (a country on the adequacy list, contractual clauses with the provider, international standards) and the data is not in a category with mandatory localisation. A free public chatbot that an employee uses on their own initiative usually comes with no vetted contract or agreed terms — so the risk remains even if the service is reputable and the purpose harmless.

The question is not whether an AI service is "good", but where the personal data physically ends up and whether you have a lawful basis to send it there.

Who is responsible for what: owner, operator, third parties

The law distinguishes between the owner of a personal database, the operator who processes the data and third parties to whom data is transferred. When a company sends customer data to an external AI service, that service effectively becomes another participant in processing. Responsibility for whether this was done lawfully stays with the company that collected the data. So choosing an AI tool is not only about convenience; it is a legal decision worth agreeing with a lawyer and the security team.

What is fine and what is risky

Fine

• Using AI with public information: published texts, public statistics.
• Sending anonymised data — without names, numbers or details that identify a person.
• Using AI for templates, document structure and marketing copy.
• Processing personal data in a local model on servers in Uzbekistan — see "On-premise AI for organizations".

Risky

• Uploading customer databases and CRM exports to foreign AI services.
• Sending citizen requests, medical or financial records in full.
• Screening candidates' CVs in a public chatbot.
• Storing chatbot conversations with customers on a foreign server without checking the storage country and contractual terms.

Typical situations: what to do

• A marketer wants to segment the customer base with ChatGPT. Instead of an export with names and phone numbers, use an anonymised table: age group, region, purchase category, spend in ranges. The segments are then applied to the real database inside the CRM.
• An HR manager needs to sort a hundred applications quickly. A public chatbot is not suitable. You can ask AI to draft assessment criteria and a table template, while the CVs themselves are processed in an internal system.
• The support team analyses complaints to find recurring problems. Names, order numbers and phone numbers are removed from the texts; only the problem descriptions go to the model.
• An agency wants to speed up replies to citizen requests. Processing happens in a model deployed on servers in Uzbekistan, with access limited to responsible staff and an activity log.

Common misconceptions

• "It is a paid service, so it is fine." The plan does not change where the data is physically stored.
• "The customer consented, so everything is in order." Consent to processing does not automatically mean the data may be stored or transferred abroad: one of the law's cross-border transfer conditions is also needed. Check this point separately with a lawyer.
• "Localisation was abolished, so anything goes." The 2026 relaxation does not cover biometric and genetic data or telecom subscriber data, and other data still needs an adequate country, contractual clauses or international standards.
• "We removed the name, so the data is anonymised." A phone number, an address or a unique combination of facts can still identify a person.
• "It is only for internal use." The law applies to data processing regardless of whether anyone outside the company sees the result.

Chatbots and websites: how to stay compliant

If your website or AI chatbot collects names and phone numbers, plan the architecture:

1. A clear storage location. Lead database, CRM and chat logs on servers in Uzbekistan (the simplest route) or with a foreign provider in a listed country or under contractual clauses. Biometric and other data with mandatory localisation stay in Uzbekistan only.
2. Data minimisation. Only the text of the question goes to an external model, without phone number or name.
3. Consent. Clear consent wording in the form or bot.
4. A privacy policy on the website: which data, why, how long it is kept and how to delete it.
5. Access control. Only the staff who need it see personal data; actions are logged.

How to anonymise data properly

Anonymisation is the main practical tool that lets you use AI without transferring personal data. The core techniques:

• Removal. Strip out full names, personal ID numbers, document numbers, phone numbers and addresses.
• Substitution. "Applicant 1", "Client B" instead of names; placeholder amounts instead of real ones.
• Generalisation. "Resident of Tashkent region, aged 30–40" instead of an exact address and date of birth.
• Aggregation. Send summary figures — counts, averages, shares — instead of a customer list.

An important nuance: if you keep a "key" that easily links "Client B" back to a real person, the data is often still considered personal. So only send the AI what the task genuinely requires.

HR data and CVs

HR is a separate risk area. Candidate CVs, application forms, references and salary data contain a lot of personal information. Analysing them in a public chatbot is risky both legally and in terms of employee trust. Internal systems on servers in Uzbekistan or anonymised samples are better suited to such tasks.

Liability

Uzbek legislation provides for liability for breaching personal data processing rules. Specific measures depend on the nature of the breach, so involve a lawyer when designing processes rather than relying on general overviews.

Where to start: a data map in one week

Before deciding which AI tools to allow, it helps to understand what personal data the company holds in the first place. A simple sequence:

1. List the sources. Website forms, chatbots, the CRM, accounting, HR files, spreadsheets in shared folders, messenger conversations.
2. For each source, answer: what data is collected, why, where it is physically stored and who has access.
3. Flag foreign services. Cloud spreadsheets, email, form builders, AI tools — anything where data may end up outside the country.
4. Set priorities. Start with the most sensitive and largest datasets: customer databases, HR and medical data.
5. Write down the rules. Which data may be processed in which tools — this becomes the basis of your internal AI policy.

Such a map often shows that the risks come not only from AI models but also from familiar cloud services.

A checklist for companies and agencies

• Do you know what personal data you collect and where it is stored?
• If data is stored abroad, is the country on the approved list or are contractual clauses in place? Are biometric and other data with mandatory localisation stored in Uzbekistan?
• Do you obtain consent where required?
• Is there an internal rule against pasting personal data into public AI tools?
• Are staff trained in anonymisation?
• Is a privacy policy published on your website?

For public bodies these questions are particularly sensitive — see "AI in government organizations: is it safe?".

If you are building a website, chatbot or internal service and want the right data storage architecture from day one, the Dasta Creative team takes these requirements into account in our web development work.