Uzbekistan approves 49 countries for simplified personal data transfers
The Cabinet of Ministers has approved a list of 49 countries and territories deemed to provide an adequate level of personal data protection, allowing certain categories of personal data to be transferred to those jurisdictions under a simplified procedure.
Uzbekistan has greenlit 49 nations for streamlined personal data transfers, a move detailed in a resolution adopted on July 29 and published on Lex.uz. This resolution enacts changes to Uzbekistan's "On Personal Data" Law, which were approved in March of this year. The revised legislation permits certain types of personal data to be stored outside Uzbekistan in countries officially recognized for their adequate personal data protection measures.
The Ministry of Internal Affairs' Department for Migration and Personalization will be responsible for proposing additions to or removals from this approved list.
The list encompasses 49 countries and territories, including the United States, the United Kingdom, Canada, Japan, South Korea, Singapore, Russia, Germany, France, Italy, Spain, the Netherlands, Switzerland, Norway, Sweden, Finland, Brazil, Argentina, Israel, and New Zealand, along with several British Crown Dependencies and territories.
Under these new regulations, personal and anonymized data can be automatically transferred through information systems established under international agreements to jurisdictions on the list without requiring notification to the authorized state body. However, database operators are mandated to implement measures to prevent data leaks.
Should a personal data breach occur during a cross-border transfer, the database operator must inform the competent authority within 24 hours. A subsequent report, detailing the cause of the breach and the corrective actions taken, must be submitted within 72 hours.
Transfers of personal data to countries not on the approved list will still be allowed, provided that database owners and operators adhere to the necessary legal, organizational, and technical safeguards. Concurrently, the Ministry of Internal Affairs, the Ministry of Digital Technologies, the State Security Service, and the National Agency for Prospective Projects are tasked with approving standard contractual clauses and corporate rules governing such transfers.
**Part of Broader Digital Reforms**
This latest decision follows legislative amendments signed by President Shavkat Mirziyoyev on March 26, which eased Uzbekistan's data localization requirements. Under the amended law, mandatory storage on servers within Uzbekistan now applies solely to biometric and genetic data, as well as subscriber data held by telecommunications operators. Other categories of personal data may be processed abroad, provided specific conditions are met.
During a November 2025 meeting with representatives from American companies, investment funds, and financial institutions in the United States, Mirziyoyev stated that the government was updating legislation governing personal data and digital platforms. He noted that these reforms would facilitate the launch of global payment systems like Apple Pay and Google Pay in Uzbekistan, while also supporting the establishment of a digital academy and a network of startup hubs.
The government has been working for several years to attract international payment platforms. In 2024, authorities directed the Tourism Committee, the Central Bank, and the Ministry of Digital Technologies to engage in negotiations with Alipay, Apple Pay, Google Pay, PayPal, and UnionPay regarding the integration of their services into Uzbekistan's payment infrastructure.
Most recently, Central Bank official Jamshid Usmanov announced that the regulator, in collaboration with Humo, Uzcard, and commercial banks, had initiated negotiations to launch Apple Pay and Google Pay following the legislative amendments. According to Usmanov, positive developments are anticipated in the coming months, with the potential for one or more commercial banks or one of the national payment operators to be the first to introduce these services.