A personal data breach is the unlawful disclosure of information about a person, or access to it by people who have no right to it: a copied database, a forwarded file, a public post. For a business in Uzbekistan it carries two costs: recovery expenses and liability under the law. If a breach is detected during a cross-border transfer, the database operator must report it to the authorised state body within 24 hours.
Key takeaways
A breach is a loss of confidentiality: the data reached someone who had no right to it. The Law on Personal Data does not use the word “breach” as such — the offence is described through unlawful actions with data in article 46-2 of the Code of Administrative Liability.
Unlawfully altering or destroying data is also an offence, but a different one: it hits integrity and availability rather than confidentiality. The distinction matters if only because the steps you take afterwards are not the same.
Personal data is any information that identifies a person: name, phone number, address, passport and banking details, medical information, a photograph. An IP address and a purchase history become personal data once they are tied to a specific individual.
The core duties sit in the Law on Personal Data No. ZRU-547. Article 27 obliges the owner and the operator to take legal, organisational and technical protection measures. Article 31 requires them to designate a unit or an officer responsible for processing and protecting personal data — in other words, the job must have a named owner.
Article 27-1, as amended by law ZRU-1125 of 26 March 2026, requires biometric and genetic data, together with data on users of telecom operators, to be stored in Uzbekistan. Databases holding such data are registered in the State Register of Personal Data Bases (article 20). Other personal data may be stored and processed abroad if one of the conditions in part three of article 27-1 is met: the country is recognised as providing adequate protection, the operator has adopted and follows standard contractual clauses or binding corporate rules, or it follows international standards from an approved list.
Important The old claim that “all personal data of Uzbek citizens may be stored only inside the country” is out of date. Since 27 March 2026 mandatory localisation covers three categories, and everything else runs on the conditions in part three of article 27-1.
A specific deadline is set for one situation: a breach detected during a cross-border transfer. Under Cabinet of Ministers Resolution No. 415 of 29 July 2026, in force since 3 August 2026, the operator of the personal data base must inform the authorised state body within 24 hours of detecting it and, within 72 hours, submit detailed information on the causes of the breach and the work done to remove them. The same resolution names the authorised body: the Department of Migration and Personalisation under the Ministry of Internal Affairs.
| What happened | Who is notified | Deadline | What is reported |
|---|---|---|---|
| A breach detected during a cross-border transfer | The authorised state body | 24 hours from detection | The fact of the breach |
| The same breach, second step | The same body | 72 hours | Causes of the breach and the work done to remove them |
| Data altered or destroyed, or access to it restricted | The data subject and other parties to the processing | No deadline stated in the law | A written notice of what happened to the data |
| Personal data passed to a third party | The data subject | Three days | A written notice of the transfer |
The law sets no separate duty to notify every individual about a breach itself. Article 31, however, requires processing to be suspended or the data destroyed once there is information about a violation of processing conditions, and article 23 requires the subject to be told in writing within three days when their data is passed to a third party. In practice, warning the affected customers and partners limits the damage: someone who knows about the breach will not fall for a call “from the bank” quoting their own details.
Resolution No. 415 also settled where data may go: the list covers 49 states and territories, among them the EU countries, the United Kingdom, Canada, Russia, Singapore, South Korea and Japan. The United States carries a footnote — only for companies operating under the EU-US Data Privacy Framework. Transfers to countries outside the list are allowed once the legal, organisational and technical conditions set by the authorised body are met.
Fines are imposed on individuals and officers rather than on the company as such. The amounts are tied to the base calculation value, and since 1 September 2026 the BRV is 440,000 soums.
| Provision | For what | Who is liable | Penalty |
|---|---|---|---|
| Code of Administrative Liability, article 46-2, part one | Unlawful collection, storage, use, transfer, distribution or destruction of personal data; failure to meet storage and registration requirements | Individuals | A fine of 7 BRV — 3,080,000 soums |
| Code of Administrative Liability, article 46-2, part one | The same offence | Officers | A fine of 50 BRV — 22,000,000 soums |
| Code of Administrative Liability, article 46-2, part two | Unlawful processing of personal data using AI technologies and its distribution in the media, communication networks or on the internet | The offender | A fine of 50 to 100 BRV — 22,000,000 to 44,000,000 soums, with confiscation of the instruments used |
| Criminal Code, article 141-2, part one | The same acts committed after an administrative penalty has been applied | An individual | A fine of 100 to 150 BRV — 44,000,000 to 66,000,000 soums, or disqualification for up to 3 years, or corrective labour for up to 2 years |
| Criminal Code, article 141-2, part two | The same acts by a group in collusion, repeatedly, for gain, using an official position, or with grave consequences | An individual | A fine of 150 to 200 BRV — 66,000,000 to 88,000,000 soums, or corrective labour for 2 to 3 years, or restriction of liberty for 1 to 3 years, or imprisonment for up to 3 years |
Part two of article 46-2 was added by law ZRU-1115 of 21 January 2026 and deals specifically with processing personal data using artificial intelligence technologies. Criminal liability under article 141-2 of the Criminal Code does not arrive on the first occasion: an administrative penalty comes first, and only a repeat offence after it becomes a crime.
The order is simple: stop it, preserve the evidence, size it up, and only then report and repair. Improvising at the first step costs more than the breach itself.
Mistake The first instinct is to wipe the logs and “reinstall everything from scratch”. That destroys the traces that show what actually left and through which door. Without them you cannot size up the breach, report it, or close the cause.
Most breaches are noticed late and from the outside: customers, partners or the fraudsters already using the data report them. Checking a handful of signs regularly shortens that delay.
The cause is rarely elaborate. Usually it is a known unpatched vulnerability, a stolen password or excessive access — including access held by a contractor.
The list of causes worth checking first:
A contractor deserves its own line in the risk register. It needs a written data processing procedure, named accounts instead of a shared one, access limited to the part of the system it works with, and rights revoked on the last day of the contract. How to rate such risks and put them in order is covered in the article on information security risks.
Basic measures do the work, not rare expensive systems. The order is usually the same: access first, then backups and encryption, then watching the events.
It is worth separating the tools from the service. SIEM, EDR and XDR are software: they collect events and look for suspicious chains, but people have to work with them. MDR is a service run by an outside team that triages the alerts and responds to confirmed incidents. The differences and the selection criteria are in the article on monitoring and incident response.
Technology has to be matched by work with people: more than half of breaches pass through a person, and short regular sessions and reviews of real messages help. That is covered in the piece on cybersecurity training for employees, and setting up roles and logging in the customer database is covered in the article on CRM access rights.
The price depends on the number of systems, employees and sites and on what is already done. The sensible order is to find out where you are exposed first and buy protection second.
At Syntra Systems we start with an information security audit from $1,200. We map what needs protecting, check servers, networks, mail, websites and workstations for known vulnerabilities, look at who holds which access and what happens when someone leaves, assess compliance with personal data law, and put together a prioritised report.
Then we build up protection of data and access from $4,000: roles and two-factor authentication, encryption, protection of mail against spoofing and phishing, backups with tested restores, incident procedures and employee training. Watching events and responding under an agreed procedure runs from $800 a month. The full scope is on the cybersecurity for business page.
Let’s discuss your project
Tell us what you need, and we will estimate the timeline and cost and suggest a solution.
The strict deadlines — 24 hours to report and 72 hours for a detailed report to the Interior Ministry's Department of Migration and Personalisation — apply only to breaches during a cross-border transfer. In other cases the law requires processing to be suspended or the data destroyed straight away, and it's worth warning customers immediately regardless, so they don't fall for a call "from the bank" using their own leaked data.
Article 46-2 of the Code of Administrative Liability fines people, not the company: 7 BRV for a citizen and 50 BRV for an officer — 3,080,000 and 22,000,000 soums at a base rate of 440,000 soums. A repeat violation after an administrative penalty becomes a criminal offence under Article 141-2 of the Criminal Code.
Resolution No. 415 approved a list of 49 states and territories, including the EU countries, the UK, Canada, Russia, Singapore, South Korea and Japan. The US is on the list with a footnote — only for companies under the EU-US Data Privacy Framework — while transfers to other countries are possible under conditions set by the authorised body.
Give the contractor a personal account instead of a shared one, access limited to the area they need, and a written data processing procedure, and revoke access on the day the work ends. According to Verizon DBIR 2026, 48% of breaches involve third parties — suppliers, partners, external systems.
With an information security audit: it shows where personal data sits, who can reach it, which vulnerabilities are open and what the law requires in your particular case. At Syntra Systems that audit starts at $1,200 and ends with a prioritised report.
The Law on Personal Data requires appointing a unit or a specific employee responsible for processing and protecting data — the task needs an owner. Under the same rule, in the event of a leak, that person is the one who suspends processing or destroys the data and arranges to warn customers.
Sources
