Must students' personal data be stored on servers in Uzbekistan?

Short answer. No, not all of it. Under article 27¹ of Law ZRU-547 (since 27 March 2026), biometric and genetic data, like face or fingerprint attendance, and the data of people who use telecom operators in Uzbekistan must stay in the country. Other data may be stored abroad on one of three conditions, for example a country on the Cabinet's list.

Which data goes where

For the data a university, college, lyceum or learning centre keeps in its systems (LMS, exams, HR, CRM, access control):

The three conditions for storing abroad (art. 27¹, part 3): the country is recognised as protecting personal data to the same level; the operator adopts and follows standard contractual terms or binding corporate rules meeting the authorised body's requirements; or the operator complies with international standards on a list the authorised body approves.

As of 25 October 2026, lex.uz has neither the requirements for standard contractual terms and binding corporate rules, nor the list of international standards, nor the conditions for transfers to countries off the list. In practice the one condition that works today is a server in a country on resolution No. 415's list.

What to check, in order

1. List your data. For each system: what data, whose (student, staff, applicant, parent), on which server, in which country.
2. Separate the biometrics. Face, fingerprints, voice and face images (photos and video too): on a server in Uzbekistan. If used to identify a person, get consent. Such a database is registered in the State Register of Personal Data Bases (application through pd.gov.uz).
3. Choose where the rest goes. If a server is abroad, check whether the country is on resolution No. 415's list; if not, one of the other two conditions is needed.
4. Write down the basis and the consent. For each kind of data, the basis for processing (art. 18). Health data: written consent; a learner under 18: the parents' (guardians') written consent (art. 21). You must be able to prove consent was given (art. 31). If a server is abroad, say so in the notice to students: the subject has a right to know of a cross-border transfer (art. 22).
5. A responsible person and the contract. Name the unit or official responsible for personal data (art. 31). Put in the contract with the developer or host: which country the data is in, who has access, protection measures (art. 27), destruction once the purpose is met (art. 17), and, for a leak during cross-border transfer, the host tells you at once: as the operator, you notify the authorised body within 24 hours and give full details within 72 hours (resolution No. 415, point 4).
6. SMS in an admissions campaign. From 1 November 2026, SMS advertising only with written or electronic consent; the SMS service must have registered its information system in the state register; advertising SMS and calls are banned from 18.00 to 09.00 (PQ-265, point 11).

What the law says

• Law No. ZRU-547 of 2 July 2019 on personal data, article 27¹ (as worded by Law No. ZRU-1125 of 26 March 2026). Biometric and genetic data of individuals, and the data of users of telecom operators working in Uzbekistan, must be stored in Uzbekistan; other data may be stored abroad on one of three conditions; the Cabinet of Ministers sets the list of countries with the same level of protection. lex.uz/docs/-4396419 (official text in Uzbek; lex.uz's English translation does not yet show this wording) · Checked: 25 October 2026.
• The same law, article 20. Databases that must be stored in Uzbekistan under art. 27¹ part 2 are registered in the State Register (part 1, as worded by ZRU-1125); registration is by application; databases of data processed under labour law are not registered (part 3); changes are notified within ten calendar days. lex.uz/docs/-4396419 (official text in Uzbek) · Checked: 25 October 2026.
• The same law, article 26. Biometric data are personal data describing the subject's anatomical and physiological features; biometric and genetic data used to identify a person may be processed only with the subject's consent (except as the law provides). lex.uz/docs/-4396419 (official text in Uzbek and Russian) · Checked: 25 October 2026.
• The same law, articles 18, 21 and 25. Bases for processing include consent, a contract the subject is party to, and the owner's or operator's duties under the law (art. 18). Consent may take any form that lets its receipt be confirmed; for special data it must be written, including electronic; for minors, the parents (guardians) give written consent; it is withdrawn in the same form or in writing (art. 21). Data on physical or mental health are special personal data (art. 25). lex.uz/docs/-4396419 (official text in Uzbek) · Checked: 25 October 2026.
• The same law, articles 27 and 31. The owner and operator take legal, organisational and technical protection measures; present proof of consent; entrust processing to a third party (a host or a developer, say) with the subject's written consent, to perform a contract with the subject (a study contract, for example), or as the law provides; the subject is told in writing within three days when data go to a third party (art. 23); and name a responsible unit or official. lex.uz/docs/-4396419 (official text in Uzbek and Russian) · Checked: 25 October 2026.
• Cabinet of Ministers resolution No. 415 of 29 July 2026 (in force 3 August 2026). A list of 49 foreign countries and territories with the same level of protection (for example Germany, the Netherlands, Finland, the Russian Federation, Singapore; the USA only for companies in the EU-US Data Privacy Framework); transfer to countries not on the list once the legal, organisational and technical conditions set by the authorised body are met; a leak during transfer is reported by the operator to the authorised body within 24 hours, with details within 72 hours; the authorised body is the Department of Migration and Personalisation under the Ministry of Internal Affairs (our translation); requirements for standard contractual terms and binding corporate rules to be approved within three months (point 7). lex.uz/docs/-8369688 (official text in Uzbek) · Checked: 25 October 2026.
• Code on administrative responsibility, article 46², part 1. Breaking the personal data law: a fine of seven base calculation amounts for citizens and fifty for officials. This part is still in its 2021 wording and names the former rule of storing citizens' data on technical means in Uzbekistan. lex.uz/docs/-97664 (official text in Uzbek and Russian) · Checked: 25 October 2026.
• Presidential resolution PQ-265 of 15 July 2026, point 11 (from 1 November 2026). SMS advertising only after the person's written or electronic consent; companies sending advertising calls and SMS may serve only after registering their information systems in the State Register; advertising calls and messages over mobile networks are banned from 18.00 to 09.00. lex.uz/docs/-8329406 (official text in Uzbek and Russian) · Checked: 25 October 2026.

The text of the law's article 8 still names the authorised body as the State Personalisation Centre under the Cabinet of Ministers; resolution No. 415 and pd.gov.uz name the Department of Migration and Personalisation (as of 25 October 2026). The Department's regulation was approved by Presidential resolution PQ-14 of 19 January 2026; the Personalisation Centre now sits within the Department. lex.uz/docs/-8003859 (text in Uzbek) · Checked: 25 October 2026.

Example: Zarmed University

A medical university in Samarkand and Bukhara: six systems on one base, «each at the university’s own address» (each system's own web address), an Avada project. Avada's terms (the avada.uz home page): «Your data is yours. All your data handed to you within 10 working days, on request.» On the demos: «Invented data, reset every night»; for a demo on your own data: «If we don’t go ahead, we delete your data.»

Questions and answers

Where must students' data be stored? Under article 27¹ of ZRU-547 (as worded by ZRU-1125 of 26 March 2026, in force since 27 March 2026), biometric and genetic data, and the data of people who use telecom operators' services in Uzbekistan, must be stored in Uzbekistan. For an educational institution that means, first of all, a database of attendance or entry by face or fingerprint; such a database is also registered in the state register (art. 20). Other personal data (name, passport details, grades, payments) may be stored and processed abroad if one of the article's three conditions is met: the country is recognised as protecting personal data to the same level (the list in resolution No. 415); the operator follows standard contractual terms or binding corporate rules meeting the authorised body's requirements; or the operator complies with international standards on the authorised body's list. We advise treating voice and face images (photos and video too) as biometric and keeping them in Uzbekistan (our reading). Note: part 1 of article 46² of the Code on administrative responsibility still carries the former wording (as of 25 October 2026); go over it with your lawyer before moving data abroad.

Can we use a cloud server abroad? For biometric and genetic data, no. For the rest, yes, if the server's country is on resolution No. 415's list or one of the other two conditions is met. The USA is on the list only for companies in the EU-US Data Privacy Framework. The conditions for a transfer to a country not on the list are for the authorised body to set; as of 25 October 2026 they are not on lex.uz.

Do we need consent for all data? Not always: art. 18 gives other bases too, such as a contract the subject is party to (a study contract, for example) or a duty under the law. Consent is required for biometrics used to identify a person (art. 26), in writing for special data such as health (arts 25, 21), and when the purpose of processing changes (art. 19). You must be able to prove it (art. 31).

What if the learner is under 18? For minors, the parents (guardians) give written consent, including as an electronic document (art. 21). That covers lyceums, colleges, schools and learning centres, and sometimes first-year students.

Must the database be registered in the state register? Under art. 20 part 1 (as worded by ZRU-1125): databases that must be stored in Uzbekistan, that is, those with biometric or genetic data. But art. 31 still lists registering one's databases as a general duty, and the Code's art. 46² mentions registered databases: if in doubt, ask the authorised body through pd.gov.uz. The application goes through pd.gov.uz (by application, art. 20). Part 3 exempts databases of data processed under labour law; how that applies to a staff-only fingerprint clock the text does not say plainly, so ask the authorised body.

What is the liability for a breach? Article 46² of the Code on administrative responsibility: a fine of seven base calculation amounts for citizens and fifty for officials. Part 1 of that article is still in its 2021 wording and names the former rule of storing citizens' data in Uzbekistan (as of 25 October 2026): go over this with your lawyer before moving data abroad.

One step: See the Zarmed University project: a medical university, six systems on one base