As we reported earlier, the Law “On Personal Data” was amended in January 2021. The amendments prescribe a new obligation related to localizing the personal data of Uzbek citizens. These changes will come into force on April 16, 2021 (“Data Localization Law”).

Recently, the government has published two draft regulations, to set out the mechanics of monitoring compliance with data protection requirements on the Internet (in particular, compliance with the data localization requirement). In addition, it is proposed to use restriction of access to online resources as a remedy for non-compliance.

The document proposes to introduce a special registry (Registry) to list the infringers who breach personal data storage and processing rules (Infringers). As a sanction, the access to online resources of the Infringers may be blocked or limited via reducing the speed.

To restrict the access, regulators take the following sequence of actions:

• State Personalization Centre (“DPA”) studies the non-compliance cases, formalizes its opinion on the detected breach and sends it to the State Inspectorate for Control in the Field of Informatization and Telecommunications (UzComSupervisor);
• UzComSupervisor sends a prescription to the Infringer, requesting them to cure their breach within the period specified in the prescription;
• If the Infringer fails to cure the breach and report back to UzComSupervisor by the prescribed deadline, the case shall be referred to the court within three days;
• Once the court confirms the breach, UzComSupervisor records the Infringer's online resource into the Registry and the ICT ministry takes measures to restrict access to the online resource within 12 hours.

To lift the access restriction, the following need to be done:

• The Infringer cures the breach and reports to UzComSupervisor with documents evidencing the compliance. Then, the information is forwarded to the Mass Communication Centre and the DPA;
• DPA examines the provided information and issues its opinion;
• Based on the DPA’s opinion, the online resource is delisted from the Registry;
• After delisting, the ICT ministry removes access restrictions to the online resource.

Please note that the proposed changes may be supplemented, amended or not adopted at all.

These changes increase the importance of ensuring compliance in order to prevent adverse implications for your business. We will be happy to answer your questions and assist you in complying with the national data protection requirements.