Employee Personal Data in Uzbekistan: What Employers Must Do to Comply

An employee’s passport, PINFL (personal identification number), phone number, pension account number, medical certificate and salary are all personal data. In a small company, this information is usually scattered across different places: some of it sits in the HR officer’s folder, some with the accountant, passport scans in a work chat, and candidates’ CVs in the director’s personal inbox. As long as nothing goes wrong, this feels convenient. Problems start when data is sent to the wrong place, an employee asks to see what the company holds about them, or the company moves to a foreign cloud service.

The rules changed in 2026. Since 27 March, a new version of the article on storing personal data has been in force: mandatory localisation now applies only to certain categories of data. Since 3 August, a list of countries to which data may be transferred without additional conditions has been in effect. Below we explain what employers must ensure under the Labour Code and the Law on Personal Data, when an employee’s consent is required and when it is not, and what to check if your company keeps HR data in the cloud.

What Counts as Employee Personal Data in Uzbekistan

Personal data is information recorded on paper, electronically or on any other medium that relates to a specific individual or allows that individual to be identified (the Law on Personal Data No. ZRU-547 of 2 July 2019, hereinafter the “Law”, Art. 4). The individual to whom the data relates is called the data subject. The company that processes the data is called the operator. In relation to its own employees, an employer always acts as an operator.

The Labour Code refines this concept for employment relationships. An employee’s personal data is information about facts, events and circumstances in the life of the employee and their family members that the employee has provided to the employer in connection with their work. The Code expressly lists: full name, date and place of birth, PINFL, education, employment history, address, passport details, personal phone number and email address, military registration details, taxpayer identification number (TIN, referred to in Russian as INN), individual accumulative pension account (INPS) number, results of mandatory medical examinations, grounds for dismissal, marital status and details of close relatives. This information is confidential (Labour Code, Art. 175).

Where this data typically appears in a company:

Special Categories: Special Personal Data and Biometric Data

The Law singles out two groups of data that are subject to a stricter regime. Special data is information on racial or social origin, political and religious beliefs, membership of political parties and trade unions, physical and mental health, private life and criminal record. As a general rule, processing it is prohibited except in the cases listed in the Law. One of these exceptions is the exercise of rights and the performance of obligations in the field of employment relations (Law, Art. 25). Biometric data describes a person’s anatomical and physiological characteristics, such as fingerprints, facial images and voice (Law, Art. 26).

This results in two restrictions for employers. Health information may be requested only insofar as it relates to the employee’s ability to perform their job function (Labour Code, Art. 178). An employer may not obtain or process data on an employee’s membership of public associations or trade union activities unless the Code or a law provides otherwise (Labour Code, Art. 176).

Processing Starts Before Hiring: Job Applicant Data

The Labour Code’s rules on personal data refer to employees. But a person who has sent in a CV is not yet an employee, so their data is governed by the Law on Personal Data. The legal ground here is the steps the operator takes at the data subject’s request before a contract is concluded (Law, Art. 18): the candidate applied for the vacancy and provided their information in order to be considered.

This legal ground also defines its own limits:

• Collect only what you need for the assessment. The volume of data must match the purposes of processing (Law, Art. 19). If marital status or a photo is irrelevant to the role, the application form should not ask for them. Even at the point of hiring itself, employers may not require documents that the law does not provide for (Labour Code, Art. 124).
• Do not keep CVs indefinitely. The retention period is determined by when the purpose is achieved (Law, Art. 10). If a candidate has been rejected and the vacancy is closed, the purpose has been achieved. It makes sense to keep a CV in your talent pool only with the candidate’s separate consent specifying the retention period.
• References from a previous employer are information obtained from a third party. The Labour Code’s specific rule requiring written consent to obtain data from third parties is worded for employees (Labour Code, Art. 176), but we recommend obtaining a candidate’s consent to such an enquiry in advance as well.
• Automated screening. A person has the right not to be subject to a decision based solely on automated processing of their data where that decision produces legal consequences. The exceptions are written consent, performance of a contract and cases established by law (Law, Art. 24). If a system filters CVs, the final decision is best left to a human.
• If a recruitment agency handles hiring, candidates’ data is processed by a third party. The legal ground for this processing, confidentiality and what happens to CVs once the search is complete should be set out in the contract with the agency, and candidates should be informed accordingly.

Protecting candidate data depends largely on how hiring itself is organised: where applications are stored, who can see them and what happens to CVs once a vacancy is closed. If CVs arrive in personal inboxes and are forwarded in chats, start with the recruitment process as a whole. Our colleagues at SPECTRE HR Consulting handle recruitment and help companies build recruitment systems.

What Employee Data Employers May Collect, and Why

The Law requires the operator to approve a list of personal data that is necessary and sufficient for performing its tasks (Law, Art. 31). The database is formed from information that is necessary and sufficient for those tasks (Law, Art. 10). Put simply, every field on a form should serve a clear purpose.

The Labour Code adds rules on collection (Labour Code, Art. 176):

• the employer obtains all data from the employee themselves;
• if information can only be obtained from third parties, the employee must be notified of this in writing in advance and must give written consent. The exception is data from persons to whom the employer has referred the employee as required by law, such as medical examination reports and the results of qualification assessments;
• the employee is informed of the purposes, intended sources and methods of obtaining the data, its nature and the consequences of refusing to give written consent.

The minimum data set is determined by the list of documents required at hiring (Labour Code, Art. 124) and the employee details that the employment contract must contain (Labour Code, Art. 107). We walk through the hiring process step by step in our article on how to hire an employee in Uzbekistan.

If data is needed for a new purpose that was not stated when it was collected, the employee’s consent to processing for the changed purpose is required (Law, Art. 19). For example, a phone number obtained for work-related communication may not be passed to a business partner for marketing messages without consent. Moreover, the Labour Code expressly prohibits disclosing an employee’s data for commercial purposes without their written consent (Labour Code, Art. 178).

Legal Grounds for Processing Employee Data: Consent Is Not the Only Option

A common mistake is to assume either that an employer can do nothing with data without signed consent or, conversely, that a single consent obtained at hiring permits everything. The Law lists several legal grounds for processing, all of equal standing (Law, Art. 18). For employers, the main ones are:

At the same time, in a number of situations consent is required even though the underlying processing is lawful:

Where consent is required, the Standard Procedure for Processing Personal Data approved by order of the Minister of Justice (registration No. 3478 of 15 November 2023) lists what it must contain: the operator’s name and TIN; the data subject’s full name and identity document details; the purposes of processing; the list of data; the period of validity of the consent; consent to transfer to third parties and to cross-border transfer; and consent to dissemination in publicly available sources (Standard Procedure, para. 11). Consent to the processing of special data is given in writing or in the form of an electronic document (Law, Art. 21).

Employer Obligations: From Collection to Destruction

Data protection obligations arise from the moment data is collected and continue until it is destroyed or depersonalised (Law, Art. 31). The main obligations are summarised in the table below.

Employees who have access to colleagues’ data by virtue of their position are required by law to use it only in accordance with their job duties and to prevent its disclosure (Law, Art. 12; Labour Code, Art. 176). It is useful to reflect this obligation in job descriptions.

Who May Access HR Data

The Labour Code allows access to employee data only for specially authorised persons, and only to the information they need to perform specific job functions. Data is transferred within the organisation in accordance with an internal policy that employees have acknowledged by signing. Employee representatives receive only the information they need to perform their functions (Labour Code, Art. 178).

The law does not specify how access should be allocated, so the table below sets out our recommendation for a small company:

The Standard Procedure for Processing Personal Data requires the operator to designate the persons entitled to process and access data, to keep a log of database management system events and to record the actions of users who have access to restricted data (Standard Procedure, para. 30).

How to Store Paper Files, Spreadsheets, Scans and Backups

The retention period for personal data is determined by the date on which the purposes of collection and processing are achieved (Law, Art. 10). If no period is set by law or by contract, data is kept no longer than the purposes of processing require (Standard Procedure, para. 5).

For data that is not publicly available, the Standard Procedure lists the following technical measures: information security tools and software updates, an event log, data integrity monitoring, transfer over secure channels or with encryption, cryptographic protection in storage, and user identification and authentication (Standard Procedure, para. 30). The operator determines the required level of protection under the Regulation approved by Cabinet of Ministers Resolution No. 570 of 5 October 2022 (Standard Procedure, para. 32). In practice, this looks as follows:

A backup is also a form of data storage. If it sits on a server outside Uzbekistan, the rules on storage and processing outside Uzbekistan, discussed below, apply to it.

Sharing Employee Data: Government Authorities, Third Parties and Contractors

The Law and the Labour Code distinguish between several situations, each governed by its own rules. It is worth telling them apart before any data leaves the company.

 Government authorities. The employer submits information that it is required by law to submit on the basis of its legal obligations (Law, Art. 18). The requirement for written consent to disclosure to third parties does not apply in cases provided for by the Labour Code and other laws (Labour Code, Art. 178). No written notice is given to the employee when government authorities are exercising their powers (Law, Art. 23). The Standard Procedure, however, provides for the data subject to be notified when a government authority requests their data, except for restricted-access information (Standard Procedure, para. 18). Because these provisions are worded differently, it is advisable to set out the notification procedure for government requests in an internal policy after consulting a lawyer.

Third parties. An employee’s data may be disclosed to a third party only with the employee’s written consent. The exceptions are a threat to the employee’s life or health and other cases provided for by the Labour Code and other laws. The recipient must be warned that the data may be used only for the purposes for which it was disclosed, and the employer must require confirmation that this rule is being observed (Labour Code, Art. 178). The employee must be notified of the transfer in writing within three days, unless the law exempts the employer from notification (Law, Art. 23).

Outsourced Accountants, HR Outsourcing Providers and HR Platforms

The Law on Personal Data allows an operator to engage a third party to process data in three cases: with the data subject’s written consent, including in the form of an electronic document; where the decision is taken in performance of a contract between the owner of the personal database and the data subject, or to fulfil the terms of a previously concluded contract; and in cases provided for by law (Law, Art. 31).

The Labour Code contains no separate rule on engaging a contractor to process data. It addresses the disclosure of an employee’s data to a third party and requires written consent for this unless a statutory exception applies (Labour Code, Art. 178). Within the meaning of the Law, a contractor that runs payroll is a third party: a person who is neither the employee nor the employer-operator but is connected with them through data processing relations (Law, Art. 4).

 We explain in detail how to hand over records, databases and system access when your provider changes in our article on how to change your accountant in Uzbekistan and hand over records and system access.

Data Localisation and Cross-Border Transfers in Uzbekistan: What Changed in 2026

This is the most confusing issue. Many people still believe that all employee data must be stored only on servers in Uzbekistan. Since the 2026 changes, this is no longer the case, but “store it wherever you like” is not correct either. Let’s start with the key concepts.

Five Concepts Not to Confuse

For example, uploading an employee spreadsheet to cloud storage with servers in Germany is storage and processing abroad and, at the same time, a cross-border transfer. If the cloud belongs to a foreign company, that company will usually also be processing the data on your instructions. Several rules apply to a single action: the general data protection obligations always apply, the localisation requirement applies only to certain categories of data, and the conditions for storage abroad and the rules on cross-border transfer apply when the data actually ends up outside Uzbekistan.

What Must Be Stored in Uzbekistan

Law No. ZRU-1125 of 26 March 2026, which entered into force on 27 March 2026, set out Article 27¹ in a new wording. Now only the following data must be stored within the territory of Uzbekistan:

• biometric data of individuals;
• genetic data of individuals;
• data of individuals who use the services of telecommunications operators operating in Uzbekistan.

The third category concerns subscribers of telecom operators and is irrelevant to an ordinary employer. Genetic data is practically never encountered in HR work. Biometrics, however, are common: turnstiles and time-tracking terminals that use fingerprints or facial recognition.

When HR Data May Be Stored Abroad

Data outside the three categories listed above may be stored and processed outside Uzbekistan if one of the following conditions is met (Law, Art. 27¹):

1. the foreign country is recognised as ensuring adequate protection of personal data;
2. the operator has adopted and complies with standard contractual clauses or binding corporate rules that meet the requirements of the authorised government body;
3. the operator complies with international standards for the management and storage of personal data included in a list approved by the authorised body.

The list of countries ensuring adequate protection was approved by Cabinet of Ministers Resolution No. 415 of 29 July 2026, which entered into force on 3 August 2026. It includes 49 countries and territories, among them EU member states, the United Kingdom, Switzerland, Norway, Russia, Singapore, the Republic of Korea, Japan, Canada and Israel. The United States is included with a caveat: only for companies operating under the EU-US Data Privacy Framework. Kazakhstan, Turkey, the UAE and mainland China, for example, are not on the list; Hong Kong is listed separately.

The Resolution also provides that if a leak is detected during a cross-border transfer, the database operator must report it to the authorised body within 24 hours and, within 72 hours, send detailed information on its causes and the measures taken (Resolution No. 415, para. 4). The Resolution names the Department of Migration and Personalisation under the Ministry of Internal Affairs as the authorised body.

Biometric Time and Attendance Systems

If a company uses fingerprints or facial recognition to let employees into the office or to record their working time, it is processing biometric data. This requires:

• the employee’s consent: biometric data used for identification is processed only with the data subject’s consent, except in cases provided for by law (Law, Art. 26);
• storage of this data within Uzbekistan, including on the system vendor’s server and in backups (Law, Art. 27¹);
• where the data is stored electronically outside information systems, the use only of media that prevent unauthorised access (Law, Art. 26).

It is sensible to offer an employee who does not consent to biometrics an alternative method of time recording, such as an access card.

Cloud HR Services, Corporate Email and Foreign Platforms

Foreign corporate email, a cloud drive with document scans, a foreign HR platform, an online payroll service: in all of these cases, the data is most likely stored and processed abroad. Before connecting such a service, or when reviewing one you already use, answer the following questions:

1. Where is the main database physically located, and where are the backups stored? This should be stated in the contract or in the provider’s documentation.
2. Are these countries on the list in Resolution No. 415? If the country is the United States, does the provider participate in the EU-US Data Privacy Framework? You can check this in the programme’s official list of participants.
3. Do the provider’s staff, such as the support team, have access to the data from other countries? Does the provider use subcontractors, and where are they located?
4. Is the data passed to other systems, such as integrations with foreign services, exports or analytics?
5. Does any biometric data go into the service? If so, it must be stored in Uzbekistan.
6. What does the contract with the provider cover: confidentiality, security measures, incident notification, deletion of data after termination?
7. Which of the company’s employees have access to the service, and are their accounts deactivated when they leave?
8. Do employees know where their data is stored? An employee is entitled to receive information about an intended cross-border transfer on request (Law, Art. 22).

If the service’s main database is located in Uzbekistan, this significantly reduces the risks but does not in itself rule out cross-border transfer. Data may end up abroad through backups, foreign subcontractors or exchanges with information systems in other countries. The Law defines cross-border transfer as the transfer of data outside the territory of Uzbekistan (Law, Art. 15). The Law does not expressly clarify how remote access by foreign staff to a database that physically remains in Uzbekistan should be classified. The answer depends on whether, and where, the data is copied, so assess both the contract and the service’s actual architecture.

The general obligations apply under any arrangement: a legal ground for processing, restricted access, security measures and a contract with the provider.

Employer Liability for Violating Personal Data Rules

Liability can take several forms:

• Liability to the employee. If a breach of the procedure for processing and protecting data unlawfully deprived the employee of the opportunity to work or reduced their earnings, the employer must compensate the lost earnings. If the employer disseminated defamatory and false information, it must retract it (Labour Code, Art. 180). The employee may challenge the employer’s unlawful actions, including in court (Labour Code, Art. 179).
• Administrative liability. Article 46² of the Code on Administrative Liability provides for a fine on individuals and officials for violating personal data legislation.
• Criminal liability. The same acts committed after an administrative penalty has been imposed give rise to liability under Article 141² of the Criminal Code.
• Binding orders. The authorised body may issue binding orders to eliminate violations (Law, Art. 8).

What to Review After the 2026 Changes

1. Map your data. Identify which systems, spreadsheets and services contain information about employees and candidates, and where their servers and backups are physically located.
2. Find any biometric data. If you have it, make sure the data, including backups, is stored in Uzbekistan and that employees’ consent has been obtained (Law, Arts. 26, 27¹).
3. Check the countries. For each service, find out where the main database, backups and subcontractors are located, and check those countries against the list in Resolution No. 415.
4. Review your contracts with providers and contractors, and the legal grounds for sharing data with them: employee consent (taking Art. 178 of the Labour Code into account), confidentiality, security measures, data deletion procedure and incident reporting.
5. Update your internal policy and notices. State where and how data is stored and to whom it is transferred. Have employees acknowledge the policy by signing.
6. Check registration. If your database was registered in the State Register under the previous rules, reassess it: the registration requirement now applies only to databases containing data subject to localisation.
7. Include personal data in your regular review of HR processes. We describe how to carry out such a review in general in our article on the HR compliance audit.

Employer Checklist: Employee Personal Data Compliance in Uzbekistan

A “no” answer is a reason to look into the matter more closely. It does not mean that a violation has been established.

Collection and legal grounds

• A list of the data collected, with purposes and legal grounds, has been approved
  
• Candidate and employee forms contain no unnecessary fields
  
• Data is obtained from the employee themselves; where it is obtained from third parties, the employee has been notified in writing and has given written consent (except referrals for medical examinations and assessments)
  
• A legal ground has been identified for obtaining data from third parties, disclosing it to third parties, using it for commercial purposes and processing biometrics: written consent or a statutory exception
  
• CVs of rejected candidates are not kept indefinitely
  

Organisation

• A person responsible for processing and protecting personal data has been appointed
  
• An internal policy on the processing procedure has been adopted, and employees have acknowledged it by signing
  
• Employees have been notified in writing of the purposes of processing and of their rights
  
• The duty not to disclose data is reflected in job descriptions
  

Access and storage

• The persons with access to HR data have been designated
  
• Each system user has their own account, and access is revoked on termination
  
• Document scans are not kept in messaging apps or personal mailboxes
  
• Paper personnel files are kept under lock and key
  
• Backups are encrypted, and their location is known
  

Transfers and foreign services

• Employees are notified of transfers of their data to third parties within three days, except where the law does not require notification
  
• Before data is transferred to a contractor, a legal ground has been identified taking into account Art. 31 of the Law and Art. 178 of the Labour Code, and employees’ written consent has been obtained where necessary
  
• Contracts with contractors cover confidentiality, security measures, subcontractors and destruction of data
  
• For each service, you know the country where the main database and backups are stored, and whether there is remote access from abroad and any subcontractors
  
• Foreign storage countries are on the list in Resolution No. 415; for any others, a legal assessment has been carried out
  
• Biometric data is stored in Uzbekistan
  

Employee rights

• A procedure for responding to employees’ requests about their data has been established
  
• Corrections requested by employees are made within three days at the latest
  
• Data whose processing purpose has been achieved is destroyed
  

Conclusion

Protecting employee personal data is not a single document in a personnel file but a set of interrelated questions: why you collect information, on what legal ground, who can see it, where it is stored and to whom it is transferred. The 2026 changes removed the requirement to store all citizens’ data in Uzbekistan but added a new task: knowing which country your services are located in and being able to confirm that storing data abroad is lawful. Biometric data must still be stored in Uzbekistan.

Start with a data map and the checklist. If your company uses foreign services, biometrics or contractors, discuss them with a lawyer.