The Cabinet of Ministers of Uzbekistan has approved a list of foreign states that ensure a level of personal data protection comparable to that of Uzbekistan. The list includes 49 countries and territories, including Russia, the United States, Germany, the United Kingdom, Japan, South Korea, and Singapore.
The decision was made to establish a unified procedure for cross-border personal data transfer. Now, personal data and anonymized information can be automatically transferred to countries on the approved list through information systems created on the basis of international agreements. No additional permits or notifications to the authorized body will be required, but the operator must ensure data protection against leaks.
For transfers to countries not on the list, additional requirements will apply. Such transfers are allowed only if legal, organizational, and technical conditions set by the authorized body are met.
Furthermore, if a personal data leak occurs during cross-border transfer, the database operator must notify the authorized body within 24 hours of discovering the incident, and within the next 72 hours provide detailed information about the causes and measures taken.
The Ministry of Internal Affairs, together with other agencies, must approve requirements for standard contractual clauses and corporate data protection rules for transfers to countries not included in the list. At the same time, the Ministry of Foreign Affairs has been tasked with preparing proposals for Uzbekistan's accession to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, as well as for including the country in similar international lists.
The list includes: Austria, United States, Andorra, Argentina, Belgium, Bulgaria, Brazil, United Kingdom, Hungary, Germany, Guernsey, Hong Kong, Greece, Denmark, Jersey, Ireland, Spain, Iceland, Israel, Italy, Canada, Cyprus, Republic of Korea, Latvia, Lithuania, Liechtenstein, Luxembourg, Malta, Isle of Man, Netherlands, Norway, Poland, Portugal, Russia, Romania, Singapore, Slovakia, Slovenia, Uruguay, Faroe Islands, Finland, France, Croatia, Czech Republic, Switzerland, Sweden, Estonia, New Zealand, and Japan.
For the United States, the decision applies only to companies participating in the EU-US Data Privacy Framework.
It is worth recalling that in February, the Senate of the Oliy Majlis approved amendments to the Law "On Personal Data" that remove key barriers for PayPal and other international digital payment systems to operate in Uzbekistan. The new norms create a legal basis for freelancers to legally earn income and for the country's integration into the global digital economy.
Source: podrobno.uz