The Cabinet of Ministers of Uzbekistan has decided to approve a list of foreign states that guarantee a level of personal data protection comparable to that established in Uzbekistan. This list includes 49 countries and territories, among which are Russia, the USA, Germany, the United Kingdom, Japan, Singapore, and South Korea.
The adopted resolution aims to create a unified procedure for the cross-border transfer of personal data. Now, personal and anonymized information can be automatically transferred to states included in the approved list using information systems based on international agreements. In this case, the operator is not required to obtain additional permits or notify the authorized body, but they must guarantee the protection of data against any leaks.
For data transfers to jurisdictions not included in this list, stricter requirements will apply. Such transfers are permissible only if the legal, organizational, and technical conditions established by the authorized body are met.
In the event of a personal data leak during cross-border transfer, the database operator must notify the authorized body within one day of discovering the incident. Furthermore, detailed information about the causes of the incident and the measures taken must be provided within the following 72 hours.
Additionally, the Ministry of Internal Affairs, together with other agencies, must develop requirements for standard contractual terms and corporate data protection rules when sending data to countries not included in the list. Concurrently, the Ministry of Foreign Affairs has been instructed to prepare proposals for Uzbekistan's accession to the Council of Europe Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data, as well as for including the country in relevant international registries.
The approved list includes states such as Austria, Andorra, Argentina, Belgium, Bulgaria, Brazil, Hungary, Hong Kong, Greece, Denmark, Spain, Iceland, Italy, Canada, Cyprus, Latvia, Lithuania, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Slovakia, Slovenia, Uruguay, Faroe Islands, Finland, France, Croatia, Czechia, Switzerland, Sweden, Estonia, New Zealand, as well as the previously mentioned countries.
It is important to note that for the USA, this decision applies exclusively to companies participating in the EU–US Data Privacy Framework program. Previously, in February, the Senate of the Oliy Majlis approved amendments to the 'Personal Data Law,' which removed major obstacles to the functioning of PayPal and other global digital payment systems in Uzbekistan, laying the foundation for freelancers to legally earn income and for the country to integrate into the global digital economy.
