Uzbekistan Tightens Rules on Biometric Data Storage
Tashkent, Uzbekistan (UzDaily.uz) — The Central Bank of Uzbekistan has required payment system operators, payment service providers, electronic factoring platforms and credit bureaus to store customers' biometric data exclusively within the country.
The relevant resolution of the Central Bank's Board was registered by the Ministry of Justice on 1 August 2026 under No. 3914 and entered into force on the date of its official publication.
The document introduces amendments to three existing regulatory acts. The changes affect the regulation on information and cybersecurity in the payment systems of payment system operators and payment service providers, approved by the Central Bank's Board on 24 April 2024; the regulation on minimum information and cybersecurity requirements for the information systems of electronic factoring platforms, approved on 16 July 2025; and the regulation on minimum information and cybersecurity requirements for credit bureaus, approved on 19 August 2025.
Under the new rules, biometric data of individuals used for customer identification and authentication must be stored within the territory of Uzbekistan.
Other customer personal data that is not classified as biometric data may be stored and processed outside Uzbekistan in accordance with Part Three of Article 27¹ of the Law on Personal Data.
