Choosing a cloud or server in Uzbekistan comes down to four questions: what data you store, where your users are, how much load your systems carry, and who is responsible for backups and outages. Since 27 March 2026, the law requires only biometric and genetic data and data of telecom operators' users to stay in the country. Everything else can be stored abroad under the conditions of Article 27-1, so for a CRM or website the choice depends on speed, price and support.
Key takeaways
Three categories of personal data must be stored in Uzbekistan. This is set by Article 27-1 of the Law "On Personal Data" No. ZRU-547 as amended by Law No. ZRU-1125 of 26 March 2026, which took effect on the day of publication, 27 March 2026.
Before that, from 16 April 2021, the requirement was broader: all personal data of Uzbek citizens processed with information technology had to be stored on hardware located in the country. If your hosting contract or privacy policy still refers to the old wording, it is worth updating.
| Type of data | Must it be stored in Uzbekistan? | Legal basis |
|---|---|---|
| Biometric data: fingerprints, face templates | Yes | Article 27-1, part two |
| Genetic data | Yes | Article 27-1, part two |
| Data of users of telecom operators working in Uzbekistan | Yes | Article 27-1, part two |
| Other personal data: customers, employees, orders | No, if one of the legal conditions is met | Article 27-1, part three |
Important The new wording of Article 20 requires databases with data that must be stored in the country to be registered in the State Register of Personal Data Bases. The duty to protect data with legal, organisational and technical measures (Article 27) applies to all personal data, wherever the server is.
Other personal data may be stored and processed abroad if one of the three conditions in part three of Article 27-1 is met:
The Cabinet of Ministers approved the list of countries by Resolution No. 415 of 29 July 2026, in force since 3 August 2026. The list has 49 states, including Germany, the Netherlands, Finland, the United Kingdom, Russia, Singapore, Japan and the Republic of Korea. The United States is included only for companies that participate in the EU-US Data Privacy Framework. Kazakhstan, Turkey, the UAE and China are not on the list; Hong Kong is listed separately.
The resolution instructed the Ministry of Internal Affairs and other agencies to approve requirements for standard contractual clauses for countries outside the list within three months. If data leaks during a cross-border transfer, the operator must notify the authorised body within 24 hours of discovery and provide details of the causes and the measures taken within 72 hours.
Tip Before moving to a foreign cloud, check the data center country against the list, whether your database holds biometric data, and the data processing terms in your contract with the provider. Transfers of data abroad are also governed by Article 15 of the law, so it is best to agree the setup with a lawyer.
All three options work. The differences are in upfront costs, speed for users in the country, legal requirements and who is responsible for the facility.
| Criterion | Own server in the office | Cloud in Uzbekistan | Foreign cloud |
|---|---|---|---|
| Upfront costs | Server, UPS, cooling, licences | None, monthly payment | None, monthly payment |
| Latency for users in Uzbekistan | Low in the office, for everyone else it depends on the office connection | Short route within the country | Higher: data travels thousands of kilometres |
| Biometric and other data from part two of Article 27-1 | Allowed | Allowed | Not allowed |
| Other personal data | Allowed | Allowed | If one of the conditions in part three of Article 27-1 is met |
| Backup power and network links | Your own responsibility | Provided by the data center | Provided by the data center |
| Load growth | Buying new hardware | Changing the configuration within the provider's capacity | Changing the configuration within account quotas |
| Payment | Hardware on the company's balance sheet | Contract with a local company, payment by invoice | Usually by bank card in foreign currency |
| Who handles outages | Your administrator | The provider for the facility, you or a contractor for the system | The provider for the facility, you or a contractor for the system |
The further away the server, the longer each request takes to travel there and back. For a website this means fractions of a second per page load, but in a CRM or accounting system a single operation can trigger many requests to the server, and the delays add up.
A WonderNetwork measurement on 17 September 2026 showed the average response time from a server in Tashkent:
Response time depends not only on distance but on the traffic route: Dubai is closer than Frankfurt, yet the response takes two and a half times longer. So before choosing a provider, measure latency from your office to its test address rather than going by the map.
Your own server pays off when the load is constant and predictable and the company has someone to maintain it.
Your own server does not pay off when the load changes with the seasons, there is no IT specialist on staff, employees work from different cities and the office has no backup power. Then downtime, disk replacements and administrator time are added to the hardware cost.
A server's price is made up of computing resources and the services around them. Compare offers on the same set of items, otherwise a cheap plan turns expensive after the first invoice.
For your own server, calculate the total cost of ownership over three to five years: purchase, spare disks, UPS, electricity, network link and administrator time. For the cloud, add up the monthly bills over the same period, allowing for load growth. If you expect sharp growth, decide in advance how the platform will handle it; see our article on scalable web platform architecture.
Check the provider against this list before signing the contract. Every item should be backed by the contract or documentation, not just by the sales manager's word.
Security of the system itself, meaning access control, encryption and logging, remains your job with any provider. We covered what to build into the design in our article on security at the design stage, and how to get data back after a failure in the piece on recovering IT systems.
Syntra Cloud is Syntra Systems' cloud and dedicated servers in a data center in Uzbekistan, together with object storage and administration. We size the configuration to the real load: we look at traffic, data volume, the number of concurrent users and peak hours, and review the setup after launch.
| Task | What we do | Price |
|---|---|---|
| Server for a website or CRM | We deploy a server in Uzbekistan and set up the domain, SSL, backups and availability monitoring | from $30 per month |
| Capacity for high-load systems | We design application servers, the database and redundancy, enable DDoS protection, and fix availability and response time in the contract | from $150 per month |
| Migration from your current provider | We move a copy, test it with you, switch traffic in an agreed window and keep the old site as a fallback | from $900 |
Daily backups and DDoS protection come as standard in Syntra Cloud, and 99.9% monthly availability is set in the SLA. The scope of work and configuration estimate are on our servers and cloud in Uzbekistan page.
Let’s discuss your project
Tell us what you need, and we will estimate the timeline and cost and suggest a solution.
Syntra Cloud's servers sit in a data centre inside Uzbekistan, so it can also hold the data that, since 27 March 2026, is required to stay in the country: biometric data — from an access control system, for example — genetic data and telecom subscriber data.
A cloud, or virtual, server is a share of a physical machine's capacity, and its resources can be changed without reinstalling the system. A dedicated server belongs entirely to one client: more isolation and stable performance, but changing the configuration takes longer.
An SLA is a service level agreement covering availability, incident response time and compensation for breaches. 99.9% availability in a 30-day month allows about 43 minutes of downtime. Check the figure in the contract, not on the provider's website.
The law doesn't require every system to sit in one place — a CRM can run in Uzbekistan while the website runs abroad. If the foreign server collects personal data, the simplest route is to pick a country from the Cabinet of Ministers' list of 49 states with adequate data protection, which includes Germany, the Netherlands and Russia. The list can change, so it's worth checking before choosing a data centre.
Migration to Syntra Cloud starts from $900. There's no need to stop working: we first move a copy and test it together with you, then switch traffic over in an agreed window, keeping the old setup as a fallback.
Only if the system holds biometric data, genetic data or telecom subscriber data — the law requires those to stay inside Uzbekistan. Everything else can remain abroad if the law's conditions are met. Russia is the simpler case: it's on the list of countries with adequate data protection (Resolution No. 415). Kazakhstan isn't on that list, so it needs a different legal basis, and the scheme is worth agreeing with a lawyer.
