The Central Bank of Uzbekistan has expanded information security requirements for organizations engaged in guaranteeing and factoring, and has also introduced an obligation to store clients' biometric personal data within the country. This was done according to the Central Bank's resolution of July 22, which was registered by the Ministry of Justice on August 5.
This document made amendments to the Regulation on minimum information security requirements for microfinance organizations, pawnshops, and mortgage refinancing organizations. The resolution came into force on August 6.
As a result of the amendments, the Regulation now applies not only to microfinance organizations, pawnshops, and mortgage refinancing organizations but also to guaranteeing and factoring organizations. All these structures are referred to as 'non-bank credit institutions' in the document.
The Regulation was supplemented with clause 4-1, which establishes rules for storing citizens' biometric personal data. Such data, used by non-bank credit institutions for client identification and authentication, must be stored exclusively within Uzbekistan.
Other personal data of clients that is not biometric may be processed and stored outside the country provided that the requirements of Part Three, Article 27-1 of the Personal Data Law are met.
Furthermore, the resolution unified the terminology used in the Regulation, bringing it into compliance with current legislation. In particular, the term 'secret' was replaced with 'confidential' throughout the text of the document.
According to the Personal Data Law, genetic data of people, as well as data of persons using services of telecommunications operators operating in Uzbekistan, must also be stored within the country.
The Council of the Central Bank of Uzbekistan has introduced amendments and additions to the regulatory act that establishes minimum requirements for commercial banks when interacting with consumers of banking services. The relevant resolution dated July 15, 2026, number 19/16, was registered by the Ministry of Justice on August 1, 2026, under number 3030-12 and will come into force one month after official publication.
The document introduces a legal definition of 'systemic defect' for the first time. It is defined as a deficiency in a specific financial product, business process, network of banking service branches, information system, or internal control system, as well as in contracts, operations, service processes, or the activities of structural units of a similar nature, which is not limited to an isolated case and leads to the violation of consumer rights.
According to the adopted amendment, when reviewing client appeals, banks are now obliged to eliminate not only the violations and negative situations described in the appeals themselves but also the root causes that led to the violation of consumers' rights and legitimate interests.
Banks must summarize and analyze received appeals at the end of each quarter and year. Based on this analysis, reports must be prepared reflecting overall performance in handling appeals, their types, quantity, identified root causes, frequently occurring problems, as well as the distribution of appeals by region and type of banking service.
These reports must also contain analytical information on the compliance of banking services with consumer requirements and whether fair contact with clients was established, as well as details on key identified shortcomings, violations, and measures taken to eliminate their causes.
Quarterly reports must be published on the bank's official website by the 20th day of the month following the reporting quarter, while annual reports must be published by February 15th.
The bank's Board of Directors is obliged, during its meetings at the end of the quarter and at the end of the year, to review the status of appeal processing, including the results of synthesis and analysis, identified systemic defects and characteristic risks, and to approve action plans to eliminate systemic defects leading to the violation of consumer rights.
These decisions of the Board of Directors and analytical reports are transferred to the internal audit department, which uses them when preparing audit plans and monitoring the bank's activities.
The regulatory act also lists circumstances under which measures to eliminate systemic defects are considered not taken. These include, in particular, the absence of an approved action plan, failure to comply with deadlines set in the plan, persistence of defects despite measures taken, and the inability of the internal audit department to timely provide assessments of task completion and an annual assessment of the effectiveness of the system for handling appeals from individuals and legal entities.
The bank must send copies of the Board of Directors' decisions regarding appeals to the Central Bank within three working days from their approval, and information on the elimination of each systemic defect within five working days after its remediation.
Furthermore, information about the bank's work with client appeals must be reflected in the annual report approved at the general meeting of shareholders.
The regulation has been supplemented with a new appendix containing a standard form for an action plan to eliminate systemic defects that lead to the violation of consumer rights.
The Cabinet of Ministers of Uzbekistan has decided to approve a list of foreign states that guarantee a level of personal data protection comparable to that established in Uzbekistan. This list includes 49 countries and territories, among which are Russia, the USA, Germany, the United Kingdom, Japan, Singapore, and South Korea.
The adopted resolution aims to create a unified procedure for the cross-border transfer of personal data. Now, personal and anonymized information can be automatically transferred to states included in the approved list using information systems based on international agreements. In this case, the operator is not required to obtain additional permits or notify the authorized body, but they must guarantee the protection of data against any leaks.
For data transfers to jurisdictions not included in this list, stricter requirements will apply. Such transfers are permissible only if the legal, organizational, and technical conditions established by the authorized body are met.
In the event of a personal data leak during cross-border transfer, the database operator must notify the authorized body within one day of discovering the incident. Furthermore, detailed information about the causes of the incident and the measures taken must be provided within the following 72 hours.
Additionally, the Ministry of Internal Affairs, together with other agencies, must develop requirements for standard contractual terms and corporate data protection rules when sending data to countries not included in the list. Concurrently, the Ministry of Foreign Affairs has been instructed to prepare proposals for Uzbekistan's accession to the Council of Europe Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data, as well as for including the country in relevant international registries.
The approved list includes states such as Austria, Andorra, Argentina, Belgium, Bulgaria, Brazil, Hungary, Hong Kong, Greece, Denmark, Spain, Iceland, Italy, Canada, Cyprus, Latvia, Lithuania, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Slovakia, Slovenia, Uruguay, Faroe Islands, Finland, France, Croatia, Czechia, Switzerland, Sweden, Estonia, New Zealand, as well as the previously mentioned countries.
It is important to note that for the USA, this decision applies exclusively to companies participating in the EU–US Data Privacy Framework program. Previously, in February, the Senate of the Oliy Majlis approved amendments to the 'Personal Data Law,' which removed major obstacles to the functioning of PayPal and other global digital payment systems in Uzbekistan, laying the foundation for freelancers to legally earn income and for the country to integrate into the global digital economy.
