Uzbekistan’s parliament, the Oliy Majlis, is working on its first cybersecurity law. This comes as the country is undergoing a process of rapid digitalization, including an upswing in the use of smart devices and technologies, increased connectivity to the internet and burgeoning use of the “internet of things”. Supply chains across the industrial sectors are becoming more reliant on network and communication systems. Uzbekistan is now working on legislating new regulations that will address potential risks that can accompany such new technologies.

Is it relevant for my business?

The new cybersecurity requirements are expected to affect businesses that qualify as “important information infrastructure facilities” (essential facilities). The followings sectors are expected to be recognized as essential facilities:

• Public services
• Defense and national security
• Law enforcement
• Power and energy
• Utilities
• Healthcare
• Financial and banking systems
• Transport
• Telecommunications
• Environment
• Mining and essential minerals
• Chemical, petrochemical, metallurgical and other industries of significant socio-economic importance with a dominant company in the relevant goods.

What is expected to change?

Operators of essential facilities are expected to comply with certain obligations, such as:

1. Creating and maintaining Computer Attack Detection and Response Centers
2. Ensuring a certain amount of coordination and/or approval with the regulator with regard to automated intellectual systems, data security software and hardware to be used
3. Maintaining a restricted data exchange through regulator-approved systems or channels
4. Notifying the regulator in the event of a security incident.

What should you do next?

If you think your business could be classified as an essential facility, we recommend staying up to date on this and future developments and be prepared for potential regulatory changes. At the moment the details are fuzzy, as well as the timeline for actual adoption and implementation of legislation. Amid these uncertainties, we can say expectations are that a law will be adopted by the end of 2022.

Should you wish to learn more about the law and how you can best prepare for it, please feel free to reach out to us.