Uzbekistan Approves List of Countries with Adequate Personal Data Protection
Tashkent, Uzbekistan (UzDaily.uz) — Uzbekistan's Cabinet of Ministers has approved a list of 49 foreign countries and territories recognised as providing an adequate level of personal data protection, creating a legal basis for the cross-border transfer and processing of personal data under national legislation.
The list includes countries whose personal data protection standards have been deemed to meet Uzbekistan's legal requirements.
A special condition applies to the United States, which is recognised as providing an adequate level of protection only with respect to companies participating in the EU–US Data Privacy Framework.
The approved list also includes several territories with special legal status, including Hong Kong, as well as the British Crown Dependencies of Jersey, Guernsey and the Isle of Man.
The countries and territories included in the list are: Andorra, Argentina, Austria, Belgium, Brazil, Bulgaria, Canada, Croatia, Cyprus, Czechia, Denmark, Estonia, the Faroe Islands, Finland, France, Germany, Greece, Guernsey, Hong Kong, Hungary, Iceland, Ireland, Israel, Italy, Japan, Jersey, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, the Isle of Man, the Netherlands, New Zealand, Norway, Poland, Portugal, Romania, Russia, Singapore, Slovakia, Slovenia, South Korea, Spain, Sweden, Switzerland, the United Kingdom, the United States and Uruguay.
In March this year, President Shavkat Mirziyoyev signed amendments to the Law on Personal Data allowing personal data to be processed outside Uzbekistan, provided that the established security requirements are met.
At the same time, certain categories of information must continue to be stored within Uzbekistan, including biometric and genetic data of individuals, as well as data relating to users of telecommunications operators operating in the country.
Other categories of personal data may be stored and processed abroad, provided that all legal requirements are met, including the condition that the receiving country ensures an adequate level of personal data protection.
