On 29 July 2026, the Cabinet of Ministers of the Republic of Uzbekistan adopted Resolution No. 415, approving the List of Foreign Countries Ensuring the Same (Equivalent) Protection of Personal Data.
The Resolution is an important implementing measure under Uzbekistan's personal data protection framework and establishes specific rules governing the cross-border transfer of personal data.
What does the Resolution establish?
Resolution No. 415 approves a list of 49 foreign countries and jurisdictions recognized as ensuring the same (equivalent) protection of personal data as Uzbekistan.
The Resolution includes 49 foreign countries and jurisdictions, including France, the United Kingdom, Germany, Japan, Russia, Canada, Singapore and the United States, among others.
What changes in practice?
Resolution No. 415 establishes several important rules for cross-border transfers of personal data:
1. Transfers to countries included in the List
Personal data are automatically transferred across borders through information systems established on the basis of international agreements, without additional permits and without notifying the competent state authority, provided that measures are taken to prevent data leakage.
2. Transfers to countries not included in the List
Transfers of personal data in any form to foreign countries not included in the List are permitted provided that the operator and the owner of the personal data database comply with the legal, organizational and technical requirements established by the competent state authority.
3. Personal data breaches
If a personal data breach occurs during a cross-border transfer, the operator of the personal data database must:
Looking Ahead
Resolution No. 415 provides greater clarity for organizations involved in international data transfers and represents an important step in the further development of Uzbekistan's personal data protection framework.
The Resolution may be particularly relevant for businesses using international cloud services, global IT platforms, multinational group structures and other cross-border data-processing arrangements.
The Resolution is an important implementing measure under Uzbekistan's personal data protection framework and establishes specific rules governing the cross-border transfer of personal data.
What does the Resolution establish?
Resolution No. 415 approves a list of 49 foreign countries and jurisdictions recognized as ensuring the same (equivalent) protection of personal data as Uzbekistan.
The Resolution includes 49 foreign countries and jurisdictions, including France, the United Kingdom, Germany, Japan, Russia, Canada, Singapore and the United States, among others.
What changes in practice?
Resolution No. 415 establishes several important rules for cross-border transfers of personal data:
1. Transfers to countries included in the List
Personal data are automatically transferred across borders through information systems established on the basis of international agreements, without additional permits and without notifying the competent state authority, provided that measures are taken to prevent data leakage.
2. Transfers to countries not included in the List
Transfers of personal data in any form to foreign countries not included in the List are permitted provided that the operator and the owner of the personal data database comply with the legal, organizational and technical requirements established by the competent state authority.
3. Personal data breaches
If a personal data breach occurs during a cross-border transfer, the operator of the personal data database must:
- notify the competent state authority within 24 hours of discovering the breach; and
- provide, within 72 hours, detailed information on the causes of the breach and the measures taken to remedy them.
Looking Ahead
Resolution No. 415 provides greater clarity for organizations involved in international data transfers and represents an important step in the further development of Uzbekistan's personal data protection framework.
The Resolution may be particularly relevant for businesses using international cloud services, global IT platforms, multinational group structures and other cross-border data-processing arrangements.