ZRU-547 is the Law of the Republic of Uzbekistan “On Personal Data” of 2 July 2019: it sets out how a business collects, processes and stores the data of customers, employees and subscribers. The localisation requirement sits in Article 27-1. Since the ZRU-1125 amendment of 26 March 2026, three categories must be stored only in Uzbekistan: biometric and genetic data, and data on users of telecom operators’ services. Other personal data — name, phone number, order history — may be processed abroad if one of the conditions is met: the recipient country is recognised as ensuring adequate protection, the operator follows standard contractual clauses or binding corporate rules, or it complies with international data-management standards (gazeta.uz, 2026). For a CRM the rule is simple: contacts and conversations may sit in a foreign cloud under these conditions, while a voiceprint used to establish identity stays in the country. A call recorded for quality control, where nobody is identified by voice, is generally not treated as biometric data.
What ZRU-547 and ZRU-1125 are
ZRU-547 is the Law of the Republic of Uzbekistan “On Personal Data”. It sets out how a business must collect, process and store people’s data — customers, employees, subscribers. The ZRU-1125 amendment of 26 March 2026 clarified the key question: which data must physically stay inside the country and which may be stored abroad (gazeta.uz; the text is on lex.uz).
The localisation requirement used to be read broadly. After the amendment the picture is more precise — and for many companies, less demanding.
Which data must be stored in Uzbekistan
After ZRU-1125, mandatory in-country localisation applies to three categories:
- Biometric data — fingerprints, face recognition, voiceprints.
- Genetic data.
- Telecom operator subscriber data.
Other personal data (name, phone number, order history) may be processed abroad under one of the Article 27-1 conditions: the recipient country is recognised as ensuring adequate protection, the operator applies standard contractual clauses (SCCs) or binding corporate rules, or it complies with international data-management standards. Write down in the contract which basis applies: a certificate mentioned in a sales deck does not settle the question.
| Data category | Where it may be stored |
|---|---|
| Biometrics (including a voiceprint used for identification) | Uzbekistan only |
| Genetic data | Uzbekistan only |
| Telecom subscriber data | Uzbekistan only |
| Name, phone number, orders | Abroad, with adequate protection in the recipient country, SCCs or binding corporate rules, or international data-management standards |
| Call recordings and transcripts with no voice identification | Abroad — under one of the Article 27-1 conditions |
How this touches your CRM and call recordings
Your CRM stores personal data by definition — contacts, conversations, deal history. If the business uses call recordings to identify people, they contain voice biometrics, and that is already a mandatory-localisation category. This is why “the server is in Uzbekistan” remains a strong and often necessary argument when choosing a system.
Global CRMs keep data in EU, US or Russian data centres. Zukko.AI stores data belonging to customers in Uzbekistan inside the country, and for CIS banks and regulated companies an on-prem / private cloud deployment is available — see the Security section and the article on on-prem CRM for CIS banks. How this is built into the system itself is covered on the AI-CRM page.
The same applies to an AI employee (AI agent) that answers customers in messengers and calls through your base: its chats, transcripts and call recordings are the same personal data as the CRM holds. So the question of where data lives covers not only the CRM but the AI layer on top of it. How such an employee works is explained in what an AI employee is.
When a call recording counts as biometric data
The law treats as biometric the data describing a person’s anatomical and physiological features, and its special processing rules apply to biometric and genetic data used to establish identity (lex.uz). In practice this separates two scenarios. Calls recorded for quality control, transcription and conversation review are audio recordings and transcripts — ordinary personal data. If the voice is used to check who is calling, for example with a voiceprint at login or when confirming a transaction, that is biometric data. Zukko.AI uses call recordings for transcription, call analytics and quality control and does not identify people by voice.
Checklist: what to ask a CRM vendor before signing
These questions do not replace a legal assessment, but in half an hour they show whether a vendor is ready to talk about ZRU-547. Each answer should sit in the contract or its annex, not only in a verbal pitch.
What the business gets
- Less regulatory risk — the data sits where the law requires it to sit.
- Readiness for an inspection — residency, access control and the audit trail answer compliance questions.
- An argument for banks and large customers — their first question is where the data physically lives.
- Peace of mind on call recordings — voice data stays in the country.
One caveat: Zukko.AI helps you comply with ZRU-547 (residency, RBAC, audit trail), but that is compliance support, not a legal guarantee. A legal assessment for your specific business is your lawyer’s job. The full data-protection picture is in the CRM security guide.
Frequently asked questions
What is ZRU-547 in plain words?
ZRU is the Russian abbreviation for “Law of the Republic of Uzbekistan”; ZRU-547 is the “On Personal Data” law of 2 July 2019. It sets the rules for collecting, processing and storing people’s data and the business’s responsibility for it, and Article 27-1 defines which data stay in the country.
Does all data have to be stored in Uzbekistan?
No. After the ZRU-1125 amendment, mandatory localisation covers biometrics, genetic data and telecom subscriber data. Other personal data may be stored abroad under one of the Article 27-1 conditions: adequate protection in the recipient country, standard contractual clauses or binding corporate rules, or international data-management standards.
Do call recordings fall under localisation?
It depends on how they are used. A recording made for transcription and quality control, where nobody is identified by voice, is as a rule ordinary personal data and may be stored abroad under one of the Article 27-1 conditions. If the voice is used to identify a person, that is biometric data and it stays in Uzbekistan only. Keeping recordings in the country settles the question either way.
Does Zukko.AI help with ZRU-547 compliance?
Yes — through data residency, on-prem for CIS banks, access control and an audit trail. That is compliance support, not a legal guarantee.
What about certifications?
We claim no certification of our own — we state the controls that are actually in place: encryption, role-based access, an audit trail and data inside the customer’s perimeter. We apply GDPR practices.