A CRM in a foreign cloud, a mailing list in an overseas service, 1C on a server in Europe — since 2021 this is a question not just of convenience but of legal compliance. Here’s a breakdown without the legalese.
What the law is about
The Law of the Republic of Uzbekistan “On Personal Data” (ZRU-547), as amended in 2021, requires that personal data of Uzbek citizens be processed and stored in databases physically located within the country. This is called localization. The requirement applies to any company that collects data on customers, employees or users — from an online store to a clinic.
What counts as personal data
- Full name, passport details, PINFL (personal identification number), date of birth.
- Phone number, email, delivery address.
- Data on purchases, orders and payments, if linked to a person.
- Camera photos and video in which a person can be identified.
- Employee data: HR documents, payroll, timesheets.
In other words, your CRM database, the customer table in 1C, the order form on your website and your store’s video archive are all personal data.
What you need to do
- Find out where your data physically resides. A website on European hosting, a CRM in a foreign SaaS, backups in Google Drive — all potential violations.
- Move databases to servers in Uzbekistan. A VPS or your own server in a local data center meets the requirement.
- Register the database in the register of personal data operators (via the Personalization Center under the State Center) — mandatory for most companies.
- Restrict access: passwords, roles, access logs, encrypted backups.
- State in your privacy policy what data is stored and where.
Frequently asked questions
Can I use a foreign service? Yes, as long as the primary database is stored in Uzbekistan and only what’s needed for a specific operation is transferred abroad, in compliance with cross-border transfer conditions. In practice: the primary database stays here, integrations as needed.
What are the penalties for violations? Administrative liability under Article 46-2 of the Code of Administrative Liability, fines and an order to remedy the violation. For companies working with government clients and banks, it’s also a matter of passing audits.
Do I need to move the entire website? It’s enough for the user database to be stored locally. But in practice it’s simpler and faster to move the whole site — and it’ll get faster too.
How MyCloud helps
A data center in Tashkent, VPS and server colocation — your data is physically in Uzbekistan. We advise and help with migrating websites, databases and CRMs; backups are stored inside the country too. We provide documents confirming where data is stored for audits and contracts. This article is for informational purposes only; consult a lawyer about your specific situation.
Need help with the task from this article?
We’ll pick a configuration, calculate the cost and help with the move.