Storing data in Uzbekistan is not mandatory for everyone: since the ZRU-1125 amendment, Article 27-1 of the Law “On Personal Data” requires biometric and genetic data and data on users of telecom operators’ services to stay in the country. Other personal data may be stored abroad under one of three legal conditions: the country is recognised as providing adequate protection, the operator has adopted standard contractual clauses or binding corporate rules, or it follows international standards from an approved list. Russia requires its citizens’ data to be localised under Part 5 of Article 18 of Federal Law No. 152-FZ, while the EU’s GDPR regulates transfers to third countries. For a company in Uzbekistan, a server in Russia or the EU does not replace Article 27-1; it adds a second layer of rules. Zukko.AI, an AI agent platform for business, stores the data of Uzbek customers in the country, and CIS banks can choose private cloud or on-prem deployment.
Personal data storage in Uzbekistan, Russia and the EU compared
The three jurisdictions answer “where should data be stored” differently. Uzbekistan lists the categories of data that stay in the country. Russia ties its rule to the data of its own citizens. The EU regulates not the storage location but the transfer of data out of the Union. The comparison below follows the texts of the laws.
| Criterion | Uzbekistan | Russia | EU |
|---|---|---|---|
| Main law | Law “On Personal Data” (No. ZRU-547), Article 27-1 as amended by Law No. ZRU-1125 of 26 March 2026 | Federal Law No. 152-FZ “On Personal Data”, Articles 12 and 18 | General Data Protection Regulation (GDPR), Article 3 and Chapter V |
| What must be stored inside | Biometric data, genetic data and data on users of telecommunications operators’ services | When data of Russian citizens is collected, recording, accumulating and storing it using databases located outside the country is not permitted (Article 18, part 5) | Chapter V regulates not the storage location but transfers of data to third countries |
| Storage and transfer abroad | Other data — on one of these conditions: the state is recognised as ensuring adequate protection; the operator has adopted standard contractual terms or binding corporate rules; the operator complies with international standards from an approved list | Before starting a cross-border transfer the operator notifies the authorised body; the list of states ensuring adequate protection is approved by that body (Article 12) | On a European Commission adequacy decision (Article 45) or with appropriate safeguards: standard data protection clauses, binding corporate rules (Article 46) |
| Whose data the rule names | Personal data of citizens of the Republic of Uzbekistan | Personal data of citizens of the Russian Federation | Processing in the context of the activities of a controller or processor established in the EU, and data of people in the EU who are offered goods and services (Article 3) |
| What it means for a company in Uzbekistan | Three categories stay in the country; the rest follows the conditions of Article 27-1 | Storing in Russia does not lift the requirements of Article 27-1 and adds the questions of a second jurisdiction | Storing in the EU does not lift the requirements of Article 27-1 and adds the questions of a second jurisdiction |
The main takeaway from the table: choosing a storage country does not switch off Uzbek law. Wherever the server stands, a company that processes the data of Uzbek citizens checks itself against Article 27-1.
What Uzbek law requires after the ZRU-1125 amendment
The earlier rule that all personal data of citizens is stored in the country no longer applies. Law No. ZRU-1125 of 26 March 2026 restated Article 27-1 of the Law “On Personal Data” (lex.uz). Three categories must be stored on the territory of Uzbekistan: biometric data, genetic data and data of individuals who use the services of telecommunications operators. Other personal data may be stored and processed abroad if one of these conditions is met:
- Adequate protection. The foreign state is recognised as ensuring adequate protection of personal data; the list of such states is set by the Cabinet of Ministers.
- Contractual terms or corporate rules. The operator has adopted standard contractual terms or binding corporate rules that meet the requirements of the authorised state body.
- International standards. The operator complies with international standards for managing personal data from a list approved by the authorised state body.
The law names no specific standards or certificates — it refers to the list of the authorised body. A detailed reading of the article is in the piece on personal data localisation under ZRU-547.
What changes if the data is stored in Russia
Russia’s localisation rule is set out in Article 18, part 5 of Federal Law No. 152-FZ: when personal data is collected, recording, systematising, accumulating, storing, updating and retrieving the personal data of citizens of the Russian Federation using databases located outside Russia is not permitted (consultant.ru). The rule speaks of the data of Russian citizens. Article 12 of the same law obliges the operator to notify the authorised body before starting a cross-border transfer (consultant.ru).
For a company in Uzbekistan, a server in Russia does not settle Article 27-1: the three categories still stay in Uzbekistan, and the rest needs one of the law’s conditions. Whether Russian law applies to your processing is for a lawyer to assess.
What changes if the data is stored in the EU
The GDPR is built differently: Chapter V regulates transfers of personal data to third countries. Article 44 allows a transfer only if the conditions of that chapter are complied with (gdpr-info.eu). Article 45 permits it where the European Commission has decided that the country ensures an adequate level of protection; Article 46 — where appropriate safeguards are provided, among them standard data protection clauses and binding corporate rules (gdpr-info.eu).
Who the regulation covers is defined in Article 3: processing in the context of the activities of a controller or processor established in the EU, and the data of people in the EU who are offered goods and services (gdpr-info.eu). For a company in Uzbekistan, storing in the EU means a second layer of rules on top of Article 27-1, not a replacement for it.
What a business in Uzbekistan should choose
The choice depends on what data you collect and who you work with. Storing in the country is not an obligation for everyone, but it is the shortest route: there is no condition for storage abroad to satisfy and no second jurisdiction to check.
| Situation | What to consider | Practical conclusion |
|---|---|---|
| Biometric data, genetic data or data on users of telecommunications operators’ services | Article 27-1 requires this data to be stored on the territory of Uzbekistan | In-country storage only |
| An ordinary customer base: name, phone number, order history | The law allows storage abroad on one of the three conditions of Article 27-1 | Check with a lawyer which condition is met; in-country storage removes the question |
| Call recordings | Whether recordings count as biometric data depends on how the voice is used | Get a lawyer’s assessment; until then it is sensible to keep recordings in the country |
| Working with CIS banks and the public sector | Such customers have their own requirements for storage location and deployment environment | Clarify the customer’s requirements before choosing a platform |
| Customers in Russia or the EU | The rules of those jurisdictions apply too: 152-FZ for the data of Russian citizens, the GDPR for people in the EU | A separate legal assessment for each jurisdiction |
Where CRM data physically sits and what residency means is covered in “Where your CRM data is stored”.
How Zukko.AI handles it
Zukko.AI stores the data of customers in Uzbekistan in the country. That is a property of the product, not a legal requirement for everyone: the storage location is known in advance, the jurisdiction is clear, and the conversation with CIS banks and the public sector, which have requirements of their own, gets simpler. Deployment is SaaS, private cloud or on-prem — the customer’s choice. Data is encrypted with AES-256 at rest and TLS 1.3 in transit, access is role-based (RBAC), and every action is written to the audit trail. How it works is set out on the Security page and under AI-CRM.
An honest word on certifications: we claim none — instead we name the controls in force: encryption, role-based access, an audit trail and deployment inside the customer’s perimeter. The platform helps you meet the requirements, but it is not a legal guarantee: a legal assessment for your business is your lawyer’s job. Launch for a small business takes from 2 hours; an enterprise rollout with private cloud or on-prem, up to 30 days.
What the business gets
- A clear jurisdiction — the data of customers in Uzbekistan sits in the country.
- Fewer cross-border transfer questions — the storage location is known before the contract is signed.
- An argument with CIS banks and the public sector — where the data is stored is one of the questions in a security review.
- A choice of environment — SaaS, private cloud or on-prem.
If the business records and analyses conversations, voice is added to the data perimeter — how that works is described under Call analysis. The full data-protection picture is in the CRM security guide.
Frequently asked questions
Is it mandatory to store personal data in Uzbekistan
Not all of it. Since Law No. ZRU-1125 of 26 March 2026, Article 27-1 of the Law “On Personal Data” requires biometric data, genetic data and data on users of telecommunications operators’ services to be stored in Uzbekistan. Other personal data may be stored and processed abroad if one of that article’s conditions is met. Confirm this with a lawyer.
Can data of customers in Uzbekistan be stored in Russia or the EU
For data outside the three mandatory categories — yes, on one of the conditions of Article 27-1: the state is recognised as ensuring adequate protection, the operator has adopted standard contractual terms or binding corporate rules, or it complies with international standards from an approved list. Biometric data, genetic data and data on users of telecommunications operators’ services stay in Uzbekistan.
What does Russian law require on data localisation
Article 18, part 5 of Federal Law No. 152-FZ concerns the data of Russian citizens: when it is collected, recording, systematising, accumulating, storing, updating and retrieving it using databases outside Russia is not permitted. Article 12 obliges the operator to notify the authorised body before starting a cross-border transfer. Whether it applies to you is for a lawyer to assess.
Does the GDPR require data to be stored inside the EU
Chapter V of the GDPR regulates not the storage location but transfers of personal data to third countries. Under Article 45 a transfer is possible where the European Commission has decided the country ensures adequate protection; under Article 46, where appropriate safeguards exist, including standard data protection clauses and binding corporate rules. Article 3 defines who the regulation covers.
Where should a company that works with CIS banks store data
CIS banks and the public sector usually have their own requirements for data location and deployment, which can be stricter than the general law. Before choosing a platform, ask the customer where the data must sit and whether cloud is acceptable. Zukko.AI offers SaaS, private cloud or on-prem; an enterprise rollout takes up to 30 days.
Where does Zukko.AI store data
Zukko.AI stores the data of customers in Uzbekistan in Uzbekistan. Deployment is SaaS, private cloud or on-prem. Data is encrypted with AES-256 at rest and TLS 1.3 in transit, access is role-based, and actions are written to the audit trail. We claim no certifications; the platform helps you meet the requirements, but it is not a legal guarantee.
Sources
- lex.uz — Law of the Republic of Uzbekistan “On Personal Data”, No. ZRU-547 of 2 July 2019 (Article 27-1)
- lex.uz — Law No. ZRU-1125 of 26 March 2026 (new wording of Article 27-1)
- consultant.ru — Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, Article 18 (part 5)
- consultant.ru — Federal Law No. 152-FZ, Article 12 “Cross-border transfer of personal data”
- gdpr-info.eu — GDPR, Article 3 (territorial scope)
- gdpr-info.eu — GDPR, Article 44 (general principle for transfers)
- gdpr-info.eu — GDPR, Article 45 (adequacy decision)
- gdpr-info.eu — GDPR, Article 46 (appropriate safeguards)