On October 5, 2022 the Cabinet of Ministers of the Republic of Uzbekistan approved the “Regulation on the determination of the level of protection of personal data during processing” (Regulation). The full text of the document (in Uzbek) is available here. 

Below, you can find a brief overview of the key changes.

Are the proposed changes applicable to my business?

Yes, if you operate on Uzbekistan market and process personal data (including collection, storage, use, transfer, disclosure or otherwise processing the personal data).

What are the changes about and what can my business do to be in compliance?

The Regulation defines four levels of personal data protection, depending on the type of threats to security, and sets out a list of actions that the business must perform in relation to the given level of protection. Additionally, it approves the requirements for tangible medium containing biometric and genetic information as well as the technologies for storing such information outside the database systems.

At a high-level, by January 7, 2023 you should complete the following:

1) Conduct an inventory of the personal data being processed, in particular, to identify:

a. The categories of personal data you process (special, biometric, genetic and public),

b. The categories of persons authorized to access to the data,

c. The categories and number of data subjects (more/less than 50,000),

d. Undeclared threats to the systemic (e.g., operating systems, drivers, utilities, archivers, etc.) and application software (e.g., Access, Oracle, etc.) used in processing the personal data.

2) Determine the applicable level of protection, based on the results of the inventory.

3) Ensure fulfilment of the requirements prescribed for the applicable level of protection. These can include such measures as:

a. Organizational measures:

i. introduce a security regime for buildings, preventing the access or presence of unauthorized persons;

ii. approve the list of persons authorized to access the personal data for performance of their official (employment) duties;

iii. appoint a person or a department responsible for ensuring the data security.

b. Technical measures:

i. use certified data security tools to neutralize threats; 

ii. automatically record in the electronic security log all changes made to the authorized access rights of employees;

iii. restrict access to the electronic security log’s contents.

c. Lawful measures: 

i. legally implement the above.

If you have any questions, please feel free to contact us.