Data Protection and Employee Privacy in Uzbekistan

1) What laws in Uzbekistan regulate the protection of employee personal data, and how do they compare to international standards?

In Uzbekistan, the protection of employee personal data is regulated by the following main legislative acts:

1. The Labor Code of the Republic of Uzbekistan (chapter on the protection of employee personal data).

2. The Law of the Republic of Uzbekistan "On Personal Data" No.LRU-547 dated July 2, 2019 (regulates general rules for the processing, storage, and protection of personal data).

3. The Resolution of the Cabinet of Ministers of the Republic of Uzbekistan “On approval of certain normative-legal acts in the field of personal data processing” No.570 dated October 5, 2022.

4. Order of the Minister of Justice of the Republic of Uzbekistan "On approval of the standard procedure for organizing the activities of a structural unit or authorized person of the owner and (or) operator of a personal database ensuring the processing and protection of personal data", registered on November 15, 2023, reg. number 3477.

5. Order of the Minister of Justice of the Republic of Uzbekistan "On approval of the standard procedure for processing personal data", registered on November 15, 2023, reg. number 3478.

The legislation of the Republic of Uzbekistan on personal data protection largely aligns with international standards, such as GDPR, but does not encompass some of its specific features.

2) What types of employee personal data are typically protected under labor laws?

In accordance with Article 175 of the Labor Code of the Republic of Uzbekistan (hereinafter “LC”), personal data of employees subject to protection includes information about the facts, events, and circumstances of the employee's life, as well as those of their family members, provided to the employer in connection with employment relations.

3) How to ensure compliance with personal data protection legislation when transferring employee personal data to third parties (e.g., contractors, partners)?

According to Article 178 of the LC, when transferring employee personal data to third parties, the following requirements should be adhered to:

• Inform the employee about the purposes, sources, and methods of obtaining their personal data, the nature of the data to be collected, and the consequences of refusing to provide written consent;
• Ensure that third parties receiving personal data are informed that the data can only be used for the purposes for which it was provided and require confirmation that they will comply with this confidentiality requirement.

4) In what form is consent obtained for the processing of employees' personal data?

In written form, including in the form of an electronic document.

5) What personal data of employees may not be requested and processed by the employer?

The employer and his representatives do not have the right to receive and process the employee’s personal data regarding his membership in public associations or his trade union activities.

6) What are the consequences of violating employee data protection laws?

If a violation by the employer of the procedures for processing and protecting employee personal data results in the unlawful deprivation of the employee's ability to work or leads to a reduction in their wages, the employer is obligated to compensate the employee for the lost earnings.

Moreover, violation of personal data laws may also entail administrative and criminal liability.

Author: Javokhir Urinov