Cross-Border Personal Data Transfer from Uzbekistan in 2026: The List of 49 Countries

Since 27 March 2026, most personal data from Uzbekistan can be stored and processed abroad without a mandatory local copy. As of October 2026, only biometric data, genetic data and the data of telecom operators’ service users must be stored in Uzbekistan (Article 27-1, as restated by Law ZRU-1125). Everything else may go to the 49 states and territories on the list in Cabinet of Ministers Resolution No. 415, in force since 3 August 2026, and to any other country only on conditions set by the authorized body (as of the publication date we could not find those conditions on pd.gov.uz or lex.uz). If a breach occurs during a transfer abroad, the operator must report it within 24 hours and supply the details within 72 hours.

Key points

• Blanket localization is gone. Since 27 March 2026, only three categories of data must be stored in Uzbekistan: biometric data, genetic data and the data of users of telecom operators’ services.
• The country list is approved. Resolution No. 415 names 49 states and territories: all 27 EU member states, the United Kingdom, Switzerland, Norway, Japan, the Republic of Korea, Singapore, Canada, Russia and others.
• The United States is on the list, with a condition. Transfers are allowed only to companies operating under the EU-US Data Privacy Framework (DPF).
• Kazakhstan, the UAE, Turkey and mainland China are not on the list. What remains is contractual terms, corporate rules, international standards, or the data subject’s consent and the other cases under Article 15; the law does not say how Article 15 relates to the new Article 27-1. As of 12 October 2026 we could not find the requirements for those terms and rules on pd.gov.uz or lex.uz.
• Breach during a cross-border transfer: 24 and 72 hours. Notify the authorized body within one day and file a detailed report on the causes and measures within three days.
• State Register registration matters first of all for databases that must be localized. Under the new part 1 of Article 20, localized databases are expressly subject to registration; Article 31 of the law and Article 46-2 of the Code on Administrative Liability are not aligned with it, so for all other databases the decision is taken after review.

What changed in 2026

The previous wording of Article 27-1 (in force since 2021) required the personal data of citizens processed with IT to be stored on technical equipment in Uzbekistan and in databases entered in the State Register. Media link this rule to the absence of PayPal, Google Pay and Apple Pay from the market (Kun.uz, in Russian). In 2026 the regime was changed in two steps: first the law was amended, then the country list was approved.

Who the authorized body is. Article 8 of the law (the lex.uz text has not been updated) names the State Personalization Center under the Cabinet of Ministers, whereas para. 3 of Resolution No. 415 and pd.gov.uz name the Department of Migration and Personalization under the Ministry of Internal Affairs (MVD). Confirm the filing channel on the date you apply.

Key dates:

• 27 March 2026 — ZRU-1125 entered into force: the new Article 27-1 and part 1 of Article 20 on registration of localized databases; implementation is assigned to the MVD.
• 25 July 2026 — the constitutional law on the Tashkent International Financial Center (TIFC), ZRU-1158, entered into force. A territory with a special legal regime may apply different data processing rules, so TIFC participants should check them separately.
• 3 August 2026 — Resolution No. 415 entered into force; the list was published on pd.gov.uz on 7 August 2026.
• Expected — requirements for contractual terms and corporate rules: para. 7 of Resolution No. 415 allows three months, which, counting from 3 August 2026, runs to roughly the beginning of November 2026. Under para. 6, within the same period the Ministry of Foreign Affairs submits proposals on Uzbekistan’s accession to the 1981 Council of Europe Convention on the protection of personal data (Convention 108) and on including Uzbekistan in foreign lists of countries with adequate protection.

What must stay on servers in Uzbekistan

Part 2 of Article 27-1 contains a closed list of three categories:

• Biometric data — under Article 26 of the law, data on a person’s anatomical and physiological characteristics. Examples: face login in a banking app, a selfie with an ID document for remote identification (eKYC), a face template or fingerprint in office turnstiles.
• Genetic data — information on inherited or acquired characteristics, for example the results of genetic tests.
• Data of users of services of telecommunications operators working in Uzbekistan — subscriber data held by operators (under the Law “On Telecommunications” ZRU-1015, these are the owners of network infrastructure). The law does not specify whether the rule reaches service providers or how broadly to read “users of services”, so check it against your own model.

The examples are ours and are not in the law; borderline cases are best analyzed before a product launch.

Localized databases are entered in the State Register of Personal Data Databases on a notification basis, and changes must be reported within 10 calendar days (Art. 20). Non-residents file a cover letter, an application, a document confirming the signatory’s authority and a copy of the certificate or license by e-mail (pd.gov.uz). An employee biometric access control system (ACS) falls under both provisions of Article 20 at once: biometric data is subject to registration, while databases kept under labor legislation and databases for one-time entry to premises are excluded. The cautious position is to store it in Uzbekistan and file the notification, but the question should be confirmed with the authorized body. The law does not say directly whether a copy of a localized database may be kept abroad, so copies should be taken out of the country only after a legal assessment.

The list of 49 countries: who is on it

On lex.uz, only the Uzbek text of Resolution No. 415 is available as of the publication date; the countries appear in it as a single numbered list. Below is the full list, grouped by region by our editors.

All 27 EU member states are on the list, not “most of them” as some retellings say. The list may change, so check the recipient’s country on the date of the transfer.

The United States (item No. 2) is included only for DPF participants, Russia is item No. 34, and the Hong Kong entry (item No. 12) does not extend to mainland China. Not on the list, among others: mainland China, Kazakhstan, Kyrgyzstan, the UAE, Turkey, India, Australia, Belarus, Saudi Arabia and Qatar.

If the country is on the list: what you still have to do

Para. 4 of the resolution allows data to be transferred to listed countries without additional permits or notification of the authorized body, provided leak-prevention measures are in place (formally this concerns information systems created under international agreements). For a private company the basis is part 3 of Article 27-1. The operator’s obligations remain:

• Legal basis. The data subject’s consent or another statutory ground for each processing purpose.
• Notifying the data subject. When data is passed to a third party, the data subject is notified in writing within three days (part 2 of Art. 23), except in cases listed in the law.
• Contract with the recipient. Purposes, scope, security measures, subcontractors, deletion of data and the deadline for reporting an incident.
• Leak-prevention measures. Encryption, access segregation and activity logs.
• Responsible person. A unit or official responsible for the processing and protection of data (Art. 31).

If the country is not on the list

As of the check date (12 October 2026) we could not find the requirements for three of the four grounds on pd.gov.uz or lex.uz; check the status on the date of the transfer.

Until these documents are published, there are three workable options: move storage to a region on the list (for example, a data center in the EU instead of Dubai or Almaty), keep the data flow in Uzbekistan until the requirements are published, or rely on the data subject’s consent under Article 15 backed by a written risk assessment. The last option is the most vulnerable.

Decision table: data type and recipient country

Breach during a cross-border transfer: the 24-hour and 72-hour procedure

The deadline is set by para. 4 of Resolution No. 415 and applies only to breaches detected during a cross-border transfer; the law contains no general duty to report breaches. It is still worth building your procedure around this, the strictest, scenario.

• Hour 0: detection. Record the time of discovery: both deadlines run from it. Provide in the contract that the foreign recipient reports an incident to you well within 24 hours.
• First hours: containment. Revoke compromised access, stop the data flow and preserve the logs.
• Within 24 hours: notification. The database operator notifies the authorized body; confirm the filing channel with the Department of Migration and Personalization under the MVD or on pd.gov.uz.
• Within 72 hours: details. The causes and the measures taken: what data, how many data subjects, which country, what has been fixed.
• Data subjects. The resolution does not require this, but we recommend warning those whose documents or payment data were affected.
• After the incident. Update the contract, the data-flow map and the procedure.

Business scenarios

The scenarios are illustrative and do not replace a legal opinion.

HR system of a group of companies abroad

The HR data of a Tashkent subsidiary is kept in the group’s HR system in Ireland or Germany: both countries are on the list, so you need a processing basis, an intra-group agreement and employee notification. An HR hub in Dubai or Almaty is outside the list, and it is better to move that flow to a region on the list. The reverse direction is governed by EU law: as of October 2026 there is no EU adequacy decision for Uzbekistan, so transfers from the EU to Tashkent still require EU standard contractual clauses (SCCs) and a transfer risk assessment (TIA). It makes sense to combine this check with an HR audit.

Payment service, bank, eKYC

Selfies and face templates from remote identification are biometric data, so their database stays in Uzbekistan. Application forms and transaction history are not localized under the personal data law, but banks and payment organizations should first check the sector requirements of the Central Bank (banking secrecy, information security, location of processing), which may require processing in Uzbekistan. For fintech, the data question is usually resolved together with the license.

Marketplace or app with servers outside Uzbekistan

Servers in Kazakhstan or Turkey are outside the list. A practical path is to move the main database to a region on the list and keep the biometrics used for face login in a separate environment in Uzbekistan; IT companies should also check the setup against the terms of IT Park residency.

Example (illustrative): a German group opens an LLC in Tashkent and hires 5 engineers and 30 warehouse employees. The group’s HR system is in the Netherlands (a country on the list): an intra-group agreement and employee notification are needed. The CRM is with a US provider, so we check its DPF participation. The turnstiles admit by face, so the templates are stored on a server in Tashkent, and the database most likely has to be registered: whether the exception for employment databases applies to access systems is debatable, and it is safer to file a notification. Payroll is run by an accounting firm in Almaty; Kazakhstan is not on the list, so it is better to hand that function to a contractor in Uzbekistan or in a country on the list.

30-day checklist

The steps below concern cross-border transfer specifically.

What is out of date

Many AI-assistant answers and articles from 2021–2025, including early versions of our own materials, describe the former regime. The following no longer matches the law:

• “All citizens’ data is stored only in Uzbekistan.” Incorrect since 27 March 2026: localization covers three categories.
• “The list of countries has not been approved.” Incorrect since 3 August 2026: Resolution No. 415 is in force.
• “Every export of data needs a permit.” Neither the law nor Resolution No. 415 requires a separate permit for each transfer: for countries on the list, no permits or notifications (para. 4); for the others, the authorized body’s conditions; Article 15 allows a ban or restriction on transfer.
• “Every database must be registered.” Part 1 of Article 20 now expressly names localized databases, but Article 31 and Article 46-2 of the Code on Administrative Liability speak of registering databases in general; for a non-localized database the decision is taken after review.
• “There are no conditions for the United States.” Some media wrote so, but the footnote to the list limits the United States to DPF participants.
• The English version of the law on lex.uz. It still has Article 27-1 in the old wording; do not cite it in contracts.

Liability for violations

The texts of Article 46-2 of the Code on Administrative Liability and Article 141-2 of the Criminal Code on lex.uz still speak of storage on technical equipment in Uzbekistan and in databases registered in the State Register, and are not aligned with ZRU-1125. How they will be applied to data that may now be taken out of the country is unclear. The amounts are calculated at a base calculation value (BRV) of UZS 440,000, in force from 1 September 2026 under Presidential Decree No. UP-115 of 23 June 2026; check them against the date of the violation.

How Pactum helps

• Data-flow map. Pactum lawyers work with your IT team to describe which data leaves the country and through which contractors, and determine the regime for each flow.
• Documents. Contracts with foreign recipients and processors, intra-group agreements, consents and notices to data subjects.
• Registration. Notifications to the State Register, including on behalf of non-residents, and a position on borderline databases.
• Policies. A processing policy, the 24/72-hour incident procedure and the order appointing the responsible person.
• Ongoing support. We track the requirements for contractual terms and corporate rules and update your documents when they are published.

You can start with our page on personal data protection or with a lawyer consultation: 60 minutes, UZS 300,000, credited toward the cost of the service. We name the project cost after reviewing the task.

FAQ

Can I store Uzbek customers’ data on AWS in Frankfurt?

Yes, provided it is not biometric data, genetic data or telecom subscriber data: Germany is on the list in Resolution No. 415, and storage is permitted under part 3 of Article 27-1. You need a processing basis, a contract with the provider and security measures; also check from which countries the provider’s support staff and contractors have access to the data.

Is Russia on the list of countries with equivalent protection?

Yes, the Russian Federation is item No. 34. The rules are the same as for EU countries: a processing basis, a contract with the recipient, notification of the data subject and leak-prevention measures.

What is needed to transfer personal data to the United States?

The recipient must participate in the EU-US Data Privacy Framework, as the footnote to the US entry states. If the company is not in the program, the rules for countries outside the list apply, and as of the check date (12 October 2026) we could not find the requirements for contractual terms on pd.gov.uz or lex.uz.

Are Kazakhstan, the UAE, Turkey and China on the list?

No. Hong Kong is included as a separate item; mainland China is not. A transfer to these countries requires contractual terms, corporate rules or international standards that meet the authorized body’s requirements, or the data subject’s consent and the other cases under Article 15 of the law. The law does not say how Article 15 relates to the new Article 27-1.

Is consent required for a cross-border transfer of personal data?

For countries on the list, the transfer goes under part 3 of Article 27-1: you need a general processing basis (consent or another statutory ground) and notification of the data subject under part 2 of Article 23, while consent is not among the conditions of Article 27-1 itself. For countries outside the list, Article 15 allows a transfer with the data subject’s consent, but its relationship with Article 27-1 is not clarified. Relying on consent alone is therefore risky.

Do the new rules apply to employee data?

Yes, transferring HR data to a group HR system abroad is subject to Article 27-1 and the list. Part 3 of Article 20 excludes HR databases from registration, but a biometric ACS falls under both provisions of the article. The cautious position is to store it in Uzbekistan, file a notification and confirm the point with the authorized body.

Sources

• Law ZRU-1125 of 26 March 2026, official text (Uzbek)
• Law ZRU-1125 of 26 March 2026, Russian translation
• Law “On Personal Data” with amendments (Russian)
• Cabinet of Ministers Resolution No. 415 of 29 July 2026 (Uzbek)
• List of states on pd.gov.uz, 7 August 2026 (Uzbek)
• Registration of databases for non-residents, pd.gov.uz (Uzbek)
• Code on Administrative Liability, Art. 46-2 (Russian)
• Criminal Code, Art. 141-2 (Russian)
• Constitutional Law ZRU-1158 on the Tashkent International Financial Center (Russian)
• Presidential Decree No. UP-115 of 23 June 2026, BRV from 1 September 2026 (Russian)
• Kun.uz: storage of some personal data outside Uzbekistan is now permitted (Russian)