Uzbekistan Law on Personal Data (No. ZRU-547)
Uzbekistan's Law on Personal Data (ZRU-547, in force 1 October 2019, amended to September 2026) governs processing by state bodies, legal entities and individuals. It requires a lawful ground and purpose-bound, proportionate processing, written consent for special data and minors, written notices to subjects (within three days of a transfer to a third party), correction within three days and 10-day refusals of access requests, and legal, organisational and technical protection. Since 27 March 2026 only biometric, genetic and telecom subscriber data must be stored in Uzbekistan, other data may be stored abroad under adequacy, SCCs or BCRs or approved standards, and only those localised databases must be registered. The State Personalisation Centre supervises.
Uzbekistan Law on Personal Data (No. ZRU-547) is a compliance framework from Uzbekistan with 6 domains and 19 controls that map to 1 other frameworks. The largest domains are Grounds, consent and processing rules (Chapters 3 and 4) – Uzbekistan Law on Personal Data (No. ZRU-547) (4 controls), Protection, confidentiality and accountability (Articles 27, 28, 31) – Uzbekistan Law on Personal Data (No. ZRU-547) (4 controls), Subject information, notices and rights (Articles 11, 22 to 24, 30) – Uzbekistan Law on Personal Data (No. ZRU-547) (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Grounds, consent and processing rules (Chapters 3 and 4) – Uzbekistan Law on Personal Data (No. ZRU-547)
| Code | Title |
|---|---|
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-16 | Depersonalise data used for research and destroy data when a destruction trigger occurs |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-18 | Process personal data only on a lawful ground |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-19 | Keep processing to stated purposes, proportionate volume and the consent period, and get new consent for a new purpose |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-21 | Obtain consent in a provable form, written for special data and for minors, and accept withdrawal |
Model Procedure for processing personal data (Minister of Justice, 2023) – Uzbekistan Law on Personal Data (No. ZRU-547)
| Code | Title |
|---|---|
| uzbekistan-law-on-personal-data-no-zru-547::MP-CONSENT | Record consent with the required details and destroy data on the Model Procedure timelines |
| uzbekistan-law-on-personal-data-no-zru-547::MP-SECURITY | Apply the Model Procedure's protection measures: access roles, logging, integrity checks, encryption and authentication |
Protection, confidentiality and accountability (Articles 27, 28, 31) – Uzbekistan Law on Personal Data (No. ZRU-547)
| Code | Title |
|---|---|
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-27 | Take legal, organisational and technical measures to protect personal data and keep it confidential |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-29 | Include data in public directories only with written consent, and remove it on request |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-31-THIRD | Entrust processing to a third party only with written consent, for contract performance or where legislation allows |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-31-UNIT | Designate a responsible unit or official for personal data and follow the model processing procedure |
Special, biometric and genetic data (Articles 25, 26) – Uzbekistan Law on Personal Data (No. ZRU-547)
| Code | Title |
|---|---|
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-25 | Do not process special data unless a listed exception applies, usually written consent |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-26 | Use biometric and genetic data for identification only with consent, and store it outside systems only on secured media |
Storage in Uzbekistan, transfers and registration (Articles 15, 20, 27-1) – Uzbekistan Law on Personal Data (No. ZRU-547)
| Code | Title |
|---|---|
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-15 | Transfer personal data abroad only to equally protective states or on a listed ground, and respect any transfer bans |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-20 | Register databases that must be kept in Uzbekistan and report changes within 10 calendar days |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-27-1 | Store biometric, genetic and telecom subscriber data of individuals in Uzbekistan; store other data abroad only under a recognised safeguard |
Subject information, notices and rights (Articles 11, 22 to 24, 30) – Uzbekistan Law on Personal Data (No. ZRU-547)
| Code | Title |
|---|---|
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-11 | Correct or complete data within 3 days of a request, fix known inaccuracies at once and suspend processing on demand |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-22 | Answer subjects' requests for information about processing, and send any refusal in writing within 10 days |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-23 | Tell subjects in writing of purposes and rights when data enters a database, and within 3 days of any transfer to a third party |
| uzbekistan-law-on-personal-data-no-zru-547::ZRU547-24 | Do not take solely automated decisions with legal effects unless an exception applies, and let subjects object |
Maps to 1 other framework
Coverage is not the same as your position
This page shows what Uzbekistan Law on Personal Data (No. ZRU-547) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Uzbekistan Law on Personal Data (No. ZRU-547) and who does it apply to?
Uzbekistan Law on Personal Data (No. ZRU-547) is a compliance framework from Uzbekistan with 6 domains and 19 controls. Uzbekistan's Law on Personal Data (ZRU-547, in force 1 October 2019, amended to September 2026) governs processing by state bodies, legal entities and individuals. It requires a lawful ground and purpose-bound, proportionate processing, written consent for special data and minors, written notices to subjects (within three days of a transfer to a third party), correction within three days and 10-day refusals of access requests, and legal, organisational and technical protection. Since 27 March 2026 only biometric, genetic and telecom subscriber data must be stored in Uzbekistan, other data may be stored abroad under adequacy, SCCs or BCRs or approved standards, and only those localised databases must be registered. The State Personalisation Centre supervises. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Uzbekistan Law on Personal Data (No. ZRU-547) actually require?
Uzbekistan Law on Personal Data (No. ZRU-547) has 19 controls organised across 6 domains. The largest domains are Grounds, consent and processing rules (Chapters 3 and 4) – Uzbekistan Law on Personal Data (No. ZRU-547) (4 controls), Protection, confidentiality and accountability (Articles 27, 28, 31) – Uzbekistan Law on Personal Data (No. ZRU-547) (4 controls), Subject information, notices and rights (Articles 11, 22 to 24, 30) – Uzbekistan Law on Personal Data (No. ZRU-547) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Uzbekistan Law on Personal Data (No. ZRU-547) do I already cover?
Uzbekistan Law on Personal Data (No. ZRU-547) maps to 1 other compliance frameworks. The top mapping partners are GDPR (33% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Uzbekistan Law on Personal Data (No. ZRU-547)?
Start your Uzbekistan Law on Personal Data (No. ZRU-547) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Uzbekistan Law on Personal Data (No. ZRU-547) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 19 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required