March 6, 2020

Databases of Personal Data

According to the Law on Personal Data Protection of 02.07.2019 No. ЗРУ-547, personal databases are subject to registration in the State Register of Databases of Personal Data.

The authorized state body in this area is the State Center for Personal Data under the Cabinet of Ministers (hereinafter – “Personalization Center“). Such registration is carried out free of charge by filing notification. The operator or owner of the personal databases in the application for registration, inter alia, must indicate:

  • the purpose of processing personal data;
  • the ability of remote management of databases;
  • whether this data is the property of the Owner/Operator;
  • whether permission has been obtained from an Entity whose personal data is being processed;
  • whether there is a possibility of cross-border transfer of personal data;
  • a person (an employee) who is responsible for the processing of personal data; and
  • a list of processed personal data of the Entity, among which may be biometric, genetic and other data.

The Entity is to be notified in writing about the purposes of processing personal data and his rights, when inserting his/her personal data in the database. In case of the transfer of personal data to a Third Party, the Owner or Operator within three days notifies the Entity in writing. In this case, the Owner or Operator is obliged:

  • to explain to the Entity the procedure of making decision on the basis of exclusively automated processing of his/her personal data and the possible legal consequences of such a decision;
  • to provide an opportunity to rise objections to this decision; and
  • to explain the procedure for the protection of his/her rights and interests.

Moreover, in accordance with the Regulations on the State Register of Databases of Personal Data approved by the Resolution of CM dated 08.02.2020 No. 71 registration of databases is carried out with the help of User Identification System – id.gov.uz. However, on the request of the Owner or Operator, the registration application may be submitted in printed form.

It should be noted that the amendments and additions to the databases are also subject to registration in the Personalization Center. Such changes are to be registered within ten (10) days from the date of their introduction. In this case, the registration number of the database remains unchanged.

Databases of personal data are excluded from the State Register, inter alia, upon suspension or termination of the activities of the Owner and (or) Operator, upon the expiration of the processing of personal data or the term for their termination, and based on a court decision to suspend the processing of personal data of the Owner or Operator. After removing the database from the State Register, its registration number cannot be not used later.