Under the Law on Personal Data, processing of personal data includes actions with respect to:

• Collection;
• Systematization;
• Storage;
• Modification;
• Addition;
• Use;
• Provision;
• Dissemination;
• Transfer;
• Depersonalization; and
• Destruction.

Further, the Law on Personal Data stipulates 7 grounds / conditions for processing of personal data, as follows:

• upon the subject’s consent to processing of his / her personal data;
• when processing of the subject’s personal data is necessary to fulfil the agreement to which the subject is a party to, or to take measures at the request of the subject before concluding such agreement;
• when processing of the subject’s personal data is required for fulfilment of obligations of the owner and / or operator as defined by law;
• when processing of the subject’s personal data is necessary for protection of legitimate interests of the subject or other person;
• when processing of the subject’s personal data is required to exercise the rights and legitimate interests of the owner and / or operator or a third party, or in order to achieve socially significant goals, provided that the subject’s rights are not violated;
• when processing of the subject’s personal data is necessary for statistical or other research purposes, under the mandatory condition of depersonalization of personal data;
• if the subject’s personal data is taken from public sources.

Processing of personal data should pursue a certain purpose. This purpose should be fixed in legal acts, regulations, charter or other documents regulating the activities of the owner / operator of personal data. That said, the owner / operator should specify in its foundation documents or other internal documents (e.g. data privacy policy etc.) the purpose of data processing. Whenever the purpose of these operations changes, a new consent from the subject to conduct operations over the personal data related to them in line with such new purpose must be obtained.

In order to achieve the intended purpose of personal data processing, the owner / operator has the right to independently determine the procedure and principles of collection and systematization of personal data. Therefore, the volume and the nature of personal data to be processed should correspond to the purpose and applied methods of processing.

According to the Law on Personal data, the owner / operator may assign the processing of personal data to third parties in the following cases:

• upon the subject’s consent obtained in a written form or in the form of an electronic document;
• if such assignment is made based on an agreement between the owner and the subject of personal data or for the fulfilment of the conditions of an existing agreement;
• other cases stipulated by law.

In processing the personal data, the owner / operator must comply with notification requirements set by the Law on Personal Data. Under the foregoing Law, the owner / operator must notify the subject:

• on inclusion of the subject’s personal data into the personal database along with informing the subject on purpose of personal data processing and the subject’s respective rights. The period of notification is not defined by the Law on Personal Data;
• on transfer of the subject’s data to third parties. Such notification must be provided within a 3-day period;
• upon the subject’s application. Under the Law on Personal Data, the subject has the right to request the owner / operator to provide him / her with information about processing of his / her data.

Upon achievement of the processing purpose, as well as in other cases stipulated by the Law on Personal Data (e.g. withdrawal of the subject’s consent, decision of the court etc.) personal data is subject to destruction by the owner / operator.

Along with the above, on 15 January 2021 data localization requirement was introduced to the Law on Personal Data that came into force on 16 April 2021. Under this requirement the personal data of Uzbek citizens processed with the use of information technologies, including via the Internet, must be collected, systematized and stored on technical means physically located on the territory of Uzbekistan and in databases duly registered in the State Register of Personal Databases.