Experts urge Uzbekistan to revise data localization rules to support innovation

On 18 July, stakeholders gathered in Tashkent to discuss the legal implications of personal data regulation and its impact on digital innovation in Uzbekistan. The meeting was attended by representatives of the Presidential Administration, the Ministry of Digital Technologies, the National Agency for Perspective Projects (NAPP), the Central Bank, and global companies including Google, Visa, and Mastercard, as well as legal experts, fintech firms, and industry associations.

The central issue was Article 27–1 of the Personal Data Law, which requires that servers processing the personal data of Uzbek citizens be physically located within Uzbekistan. According to Hikmatilla Ubaydullaev, Acting Executive Director of the Central Asian Association for Artificial Intelligence (AICA), this provision is creating uncertainty for businesses due to its vague interpretation.

“Key questions remain unresolved. In digital payments, who qualifies as the ‘data operator’ – the bank or the tech platform? Is a user’s checked consent box enough for cross-border data transfers? And which authority is responsible for issuing legally binding clarifications?” Ubaydullaev asked.

He stressed that the core issue lies not in the rule itself, but in the absence of clear guidelines, which “creates legal risks and slows down innovation,” including the launch of modern digital services like Google Pay and Apple Pay, the development of cloud technologies, and the rollout of AI-powered solutions.

Shukhrat Kurbanov, blogger at Kurbanoff.net and a participant in the meeting, also pointed to the ambiguity of the law’s language.

“The problem preventing global players like Google Pay and Apple Pay from entering our market stems from how the law is written. It’s so vague that, depending on who interprets it, it could mean anything. And there’s no clarity on who should provide official explanations,” he noted.

As an example, Kurbanov cited the issue of whether Google becomes a data operator – and thus subject to localization – when it receives card details from a user to tokenize them.

“We already provide Google and Apple with our data – geolocation, card numbers, names, and CVV codes – when buying things like Telegram Premium or ChatGPT subscriptions. And no one bans it – everyone understands how it works,” he wrote.

According to Ubaydullaev, some participants advocated for a full repeal of the data localization clause. Others favored a compromise approach: retaining the requirement only for government agencies and companies with more than 20% state ownership, while allowing flexible rules for commercial organizations as long as user consent is obtained for cross-border data transfers.

Suggestions were also made to establish a dedicated body that could officially review cases and issue legal opinions to eliminate legal uncertainty. Special attention was given to adopting a Cloud First policy, as has already been done by Uzbekistan’s peer economies in Asia and the Caucasus.

“Such steps would reduce uncertainty, foster innovation, and still ensure data protection without overregulating. No one is calling for the law’s repeal – the discussion was about its reasonable implementation,” said the AICA head.

As a result of the meeting, it was agreed to jointly draft proposals for legislative amendments. The Presidential Administration, the Ministry of Digital Technologies, NAPP, and the Central Bank expressed their willingness to collaborate with private sector representatives, Ubaydullaev noted.

A follow-up meeting is expected soon, with a focus on specific legal formulations.