A personal data leak can create risks far beyond the loss of privacy. A person’s name, phone number, personal identification number, passport details or other information may be used by fraudsters for convincing impersonation calls, phishing attempts or other actions carried out in the person’s name. Uzbek law gives individuals the right to know how their data is processed, withdraw consent and seek protection of their rights.

Recent reports have raised concerns about personal data relating to citizens of Uzbekistan appearing online, including through Telegram-based services.

How can personal data be leaked?

A data leak does not necessarily mean that a server has been directly hacked.

Common causes may include:

API authorization vulnerabilities;

misconfigured or publicly accessible databases;

misuse of access by insiders;

third-party services and integrations;

phishing and malicious software.

Regardless of how a leak occurs, data controllers and operators remain responsible for implementing the legal, organizational and technical safeguards required by law.

What protection does the law provide?

Under Article 27 of the Law on Personal Data, data owners and operators must take measures to protect the integrity, confidentiality and security of personal data and prevent unlawful processing.

Under Article 28, personal data may not be disclosed or distributed without the individual’s consent unless another lawful basis exists.

What rights does an individual have?

Under Article 30, an individual has the right to:

know whether an operator holds personal data relating to them;

obtain information about how that data is processed;

withdraw consent previously given for processing;

request suspension of processing where the data is incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary;

apply to the competent public authority or a court to protect their rights.

The law also provides circumstances in which personal data must be destroyed, including following withdrawal of consent where there is no other lawful basis for continued processing.

What should you do after a suspected leak?

Never disclose SMS verification codes, PINs or bank card details to callers or online contacts.

Enable two-factor authentication for banking apps, email and other important accounts.

Regularly check whether any unknown loans have been opened in your name.

Ask your mobile operator about additional protection against unauthorized SIM replacement.

Immediately notify your bank and law-enforcement authorities if you identify suspicious activity.

A caller knowing your passport details or personal identification number does not prove that they represent a bank or government authority.

Must all personal data be stored in Uzbekistan?

No.

Following legislative amendments adopted in 2026, mandatory storage in Uzbekistan applies in particular to:

biometric data of individuals;

genetic data;

data of users of telecommunications operators operating in Uzbekistan.

Other categories of personal data may, subject to the safeguards established by law, be stored and processed outside Uzbekistan.

Legal basis

Law of the Republic of Uzbekistan No. ZRU–547 dated July 2, 2019 “On Personal Data,” including Articles 17, 21, 27, 27¹, 28 and 30.

The rules on data storage were amended by Law No. ZRU–1125 dated March 26, 2026.

General cybersecurity requirements are governed by Law No. ZRU–764 dated April 15, 2022 “On Cybersecurity.”