Uzbekistan approves 49 countries for cross-border personal data transfers
Uzbekistan has approved 49 countries and territories as providing an adequate level of personal data protection, establishing a legal basis for certain cross-border transfers and processing of personal data.
Uzbekistan’s Cabinet of Ministers has approved a list of 49 countries and territories recognised as providing an adequate level of personal data protection under Uzbek legislation. The decision establishes a legal basis for the cross-border transfer and processing of certain personal data to those jurisdictions.
The list includes countries across Europe, Asia, the Americas and Oceania, including the United Kingdom, Japan, South Korea, Singapore, Brazil, Canada and Switzerland. The United States is included subject to a specific condition: the adequacy recognition applies only to companies participating in the EU–US Data Privacy Framework. The list also covers Hong Kong and the British Crown Dependencies of Jersey, Guernsey and the Isle of Man.
The decision follows amendments to Uzbekistan’s Personal Data Law signed by President Shavkat Mirziyoyev in March 2026. The amendments allow personal data to be processed outside Uzbekistan when applicable security requirements are met.
However, some categories of data remain subject to domestic storage requirements. These include biometric and genetic data, as well as data concerning users of telecommunications operators in Uzbekistan.
Other personal data can be stored and processed abroad if the applicable legal requirements are fulfilled, including the requirement that the receiving country provides an adequate level of personal data protection.
