As we reported earlier, the Law “On Personal Data” was amended in January 2021. The amendments prescribe a new obligation on localizing the personal data of Uzbek citizens. These changes came into force on April 16, 2021 (Data Localization Law).

We also reported about the government’s plans to use restriction of access to online resources as a sanction for non-compliance. This proposal has been adopted and entered into force from the date of its publication on April 30, 2021. 

The document introduces a special registry (Registry) to list the data controllers and processors who breach data localization processing rules (Infringers). As a sanction, the access to online resources of the Infringers may be blocked or limited via reducing the connection speed. The key substantial change from the proposed draft is that the regulators are authorized to restrict access to the online resources without a court order.

To restrict the access, regulators take the following sequence of actions:

• The Mass Communications Center monitors the online activities of persons processing the personal data of Uzbekistan citizens. In case of detection of Infringers, within 24 hours it notifies the State Personalization Centre (DPA) and requests its opinion.
• Within 24 hours DPA studies the non-compliance cases, formalizes its opinion on the detected breach and sends it to the State Inspectorate for Control in the Field of Informatization and Telecommunications (UzComSupervisor).
• Within one day UzComSupervisor sends a prescription to the Infringer, requesting them to cure their breach within the period specified in the prescription.
• If the Infringer fails to cure the breach and report back to UzComSupervisor by the prescribed deadline, UzComSupervisor records the Infringer's online resources into the Registry.
• Within 12 hours, UzComSupervisor informs the ICT ministry about the Infringers entered into the Registry and the ICT ministry restricts access to the Infringer’s online resources.

To lift the access restriction, the following steps need to be taken:

The owner of the online resource must either successfully challenge the DPA’s opinion before the local courts or comply with the local regulator’s prescription. The compliance route would involve the following steps:

• The Infringer cures the breach and reports to UzComSupervisor with documents evidencing the compliance. Then, within one day the information is forwarded to the Mass Communication Centre and the DPA.
• Within 24 hours DPA examines the provided information together with the Mass Communication Centre and issues its opinion to UzComSupervisor.
• Within 24 hours UzComSupervisor delists the online resource from the Registry based on the DPA’s opinion.
• Within 12 hours after delisting, the ICT ministry removes access restrictions to the online resource.

The text of the amendments is published in the Uzbek language and is available at the following link.

These changes increase the importance of ensuring compliance in order to prevent adverse implications for your business. We will be happy to answer your questions and assist you in complying with the national data protection requirements.