Uzbekistan Information Security and Personal Data Requirements: What to Consider in Development and AppSec Procurement

In Uzbekistan, personal data is governed by Law No. ZRU-547 dated 2 July 2019, and information security requirements for banks are set by Regulation No. 19/1 of the Central Bank of Uzbekistan (CBU), in force since 20 November 2025. Since 27 March 2026, mandatory localization has been retained for biometric and genetic data and for data of telecom operator users, while other data may be processed abroad if three conditions are met. For development, this means a data map, an on-premise environment for code, and built-in security testing.

Key acts

• Law "On Personal Data" dated 2 July 2019 No. ZRU-547, in force since 1 October 2019. Article 27-1 governs the special conditions for processing personal data of citizens of Uzbekistan.
• Law dated 26 March 2026 No. ZRU-1125 amending the personal data law; in force since 27 March 2026, the day of official publication.
• Law "On Cybersecurity", signed on 15 April 2022; in force since 15 July 2022. The authorized body is the State Security Service. Owners of information resources subjected to a cyberattack must report it to the authorized body. The law classifies the banking sector as critical information infrastructure.
• Central Bank Board Regulation No. 19/1, "Regulation on Minimum Requirements for Information Security and Cybersecurity of Commercial Banks", registered by the Ministry of Justice on 18 August 2025 under No. 3669, in force since 20 November 2025.

Localization of personal data after the 2026 amendments

In the 2021 wording, Article 27-1 required that personal data of citizens of Uzbekistan be collected, systematized and stored on technical means physically located in the country and registered in the State Register of Personal Data Databases. After Law No. ZRU-1125 the picture changed (according to texts retold by Kun.uz and the ITTS analysis):

• Must be stored in Uzbekistan: three categories: biometric data, genetic data, and data of users of telecom operators operating in the country.
• Other data may be stored and processed abroad if one of three conditions is met: the state is recognized as providing equivalent protection; the operator has adopted standard contractual terms or binding corporate rules meeting the requirements of the authorized body; or the operator follows international standards for managing and storing personal data from a list approved by the authorized body.
• The list of countries with equivalent protection is determined by the Cabinet of Ministers.

Lawyers point to open questions: there is no direct prohibition on transferring localized categories abroad, though it is implied; Article 15 on cross-border transfer has not changed and still allows consent as a basis; and at the time of the reviews, subordinate acts and lists were still being prepared. Check the current status on lex.uz.

A separate example of an industry rule: according to Spot.uz, a CBU resolution dated 22 July 2026 (registered with the Ministry of Justice on 5 August, effective 6 August) requires non-bank credit organizations to store clients' biometric data used for identification and authentication within the territory of Uzbekistan.

CBU requirements for bank IS: Regulation No. 19/1

The regulation consists of 24 chapters. The following elements directly affect development and AppSec:

• Information and cybersecurity service in banks and branches, internal IS policy, risk management system.
• Prohibition of outsourcing of management, control and ensuring continuous operation of IT infrastructure and information security systems (para. 16).
• System lifecycle (Chapter 21). For in-house development, compliance with security requirements is verified at each stage (para. 159); systems are designed with cyber risks in mind (para. 161). Paragraph 163 requires security requirements to be included in technical specifications, prohibits the use of banking secrecy and confidential data in development and testing, and permits DevOps platforms only inside the perimeter (for example, GitLab) with automatic code analysis (SAST/DAST), without internet connection; remote access only via a secure VPN.
• Pre-launch testing (para. 164): systems are checked for vulnerabilities, identified vulnerabilities are fixed before launch, and protective measures are documented.
• Vulnerability management (paras. 156–157): regular scanning of IT assets, classification by CVE, severity assessment by CVSS, installation of fixes, baseline security configurations.
• SIEM, monitoring and incidents: deployment of SIEM or an equivalent, plus SOAR, 24/7 monitoring and connection to the CBU monitoring center CERT-CBU (para. 36); abnormal events must be reported without delay to the Central Bank and the authorized state body (para. 35).
• Penetration testing: an explicit requirement was found for data processing centers: vulnerability analysis and penetration tests at least once a year (para. 168). We could not confirm the general frequency of penetration tests for banks themselves in the text.

Note that the regulation does not replace the law: in 2024 the Senate approved a law expanding the CBU's powers to identify and prevent IS threats from credit organizations, payment organizations and other market participants, and classifying violations of IS requirements in banking systems as serious violations.

What this means for development and AppSec procurement

1. On-premise as a requirement, not a preference. Paragraph 163 implies that for banks the DevOps platform runs in a closed environment. A cloud SaaS scanner that needs source code over the internet does not fit this scheme. Read more in the article on on-premise or cloud for AppSec.
2. SAST and DAST in the pipeline. Automatic code analysis and dynamic testing should be part of CI/CD, not a manual check before release. See DevSecOps: where to start.
3. Data in development. The ban on using confidential data in development and testing means masking and synthetic datasets.
4. Data classification. Determine which of your data is biometric, genetic, or relates to telecom service users: mandatory localization applies to it regardless of your cloud strategy.
5. Procurement. Record the following in the technical specification for an AppSec tool: installation in a closed environment, operation without mandatory internet access, storage of results on your side, and licensing support for a local company. Confirm licensing and Uzbekistan-specific documentation with the vendor.
6. Security assessment. Independent analysis of critical systems helps prepare evidence for CBU inspections. See the security assessment page.

Cybersecurity law and critical infrastructure

The Law "On Cybersecurity" (signed 15 April 2022) classifies as critical information infrastructure the systems in public administration, defense, law enforcement, energy, banking, transport, healthcare, communications and water supply. According to the description by Anhor.uz, such systems undergo mandatory cybersecurity expertise, information protection tools for state bodies must be certified, and data must be backed up and retained for at least three months. If you develop software for critical infrastructure facilities, ask the customer in advance for the facility category and the list of applicable requirements.

In 2024, as the Central Bank reported, the Senate approved amendments expanding the CBU's cybersecurity powers: it can identify and prevent IS threats from credit organizations, payment organizations, payment system operators, currency exchange points and credit bureaus. For vendors this means that bank inspections will cover the systems that contractors develop too.

Checklist for procuring an AppSec solution

• Deployment: support for installation in a closed environment without mandatory internet access.
• Data: where code, results and reports are stored; whether development and testing environments can be separated.
• Integrations: GitLab and other DevOps platforms running inside the perimeter.
• Reporting: export of test results for the IS team, linkage to CVE and CVSS in line with the CBU regulation.
• Support: local support and licensing for an organization in Uzbekistan. Clarify terms with the vendor.
• Pilot: run a check on your own code. The procedure is described in how to run a SAST and SCA pilot in 30 days.

Frequently asked questions

This article is for information purposes only and does not constitute legal advice. Uzbekistan's regulatory framework is updated frequently; check current versions on lex.uz and cbu.uz.

Sources

• Regulation on Minimum Requirements for IS and Cybersecurity of Commercial Banks, CBU Resolution No. 19/1 (lex.uz)
• Law "On Personal Data" No. ZRU-547 (lex.uz)
• Kun.uz: storage of some personal data outside Uzbekistan is permitted
• IT-TEAM SERVICE: review of the 2026 amendments to the personal data law
• Spot.uz: CBU requires non-bank credit organizations to store biometric data in Uzbekistan
• Anhor.uz: the president signed the cybersecurity law
• CBU of Uzbekistan: additional powers for ensuring cybersecurity