According to Art. 31 of the Law on Personal Data, government bodies, legal entities and individuals processing personal data (i.e. operators of personal data) or having the right to use and dispose of personal data (i.e. owners of personal data) must designate a structural unit or a responsible person that has to organise work with respect to personal data protection in the course of its processing.

It is reported that internet service providers (ISPs) and mobile service providers are required to grant authorities direct, real-time access to their communications networks without prior notification or oversight. These operators must install System for Operational Investigative Measures (SORM)-compliant surveillance equipment on their networks in order to obtain an operating license, which would provide the authorities unfettered access to internet traffic and subscribers’ information. It is reported that this measure is contained in the Resolution of the President on Measures for Increasing the Effectiveness of Operational and Investigative Actions on the Telecommunications Networks of the Republic of Uzbekistan, but the text is not available online.

A basic legal framework on intermediary liability for copyright infringement is absent in Uzbekistan's law and jurisprudence.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Uzbekistan's law and jurisprudence.

It is reported that to become a registered user in online forums, individuals must provide personally identifiable information. Individuals are increasingly encouraged to register with their real names to participate in discussion forums such as the state-run Uforum.

It is reported that Uzbekistan imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card or a passport in case of foreigners to activate a new prepaid SIM card.

The government of Uzbekistan reportedly blocks and filters online content related to political and social issues. The Supreme Court publishes a list of banned websites, social media pages, and messaging app channels (e.g. on Telegram) that are alleged to promote extremism and terrorism. Reports indicate that Uzbekistan’s communications regulator, Uzkomnazorat, restricted access to several platforms in 2021 for failing to comply with the 2021 amendment to the Law on Personal Data, which requires data to be stored on local servers. TikTok, blocked for this reason in July 2021, remained inaccessible through the end of 2024.

The indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 2 in Uzbekistan for the year 2024. This corresponds to "The government shut down domestic access to the Internet several times this year."

Clause 3 of Resolution No. 86 prohibits the import of household electrical appliances with an energy efficiency class of D, E, F or G to the country.

Act. No. 801 establishes the criteria to allow building, purchasing, installing and importing radio electronic media and high-frequency devices, which include the permit of the Electromagnetic Compatibility Center.

It is reported that customs clearance in Uzbekistan poses significant complexities, with substantial processing delays even for capital equipment imports. To address these issues, many firms opt for pre-shipment inspections (PSI). The process is further compounded by excessive documentation requirements, which increase both the cost and time required for customs clearance.

In accordance with Art. 15 of the Law on Personal Data, cross-border transfers of personal data can be carried out when a foreign state ensures adequate protection for the rights of the subjects of personal data. In the absence of such protection, the cross-border transfer of personal data is allowed in the following cases:
- the data subject has consented to the cross-border transfer of their personal data;
- there is a need to protect constitutional order, public order, the rights and freedoms of citizens, or the health and the morals of the population; or
- it is stipulated by international treaties.
The transfer of personal data may be prohibited or restricted in order to protect the constitutional system of the Republic of Uzbekistan, the rights and legitimate interests of citizens, or to ensure the security of the State.

Uzbekistan has not joined any agreement with binding commitments to open transfers of data across borders.

The Law of the Republic of Uzbekistan on Personal Data provides for a comprehensive regime of data protection regime in Uzbekistan. It is the first unified data protection law and outlines requirements for data subjects' consent, the purposes of processing, and notifying data subjects when transferring their personal data to a third party. The excludes biometric, educational, criminal and health information, previously included in a draft version, from its application.

Art. 15 of the Law on Cybersecurity provides that operators of critical facilities must store a backup copy of all data from information systems and resources for at least three months. This requirement affects businesses that possess, operate or interoperate information systems used in critical facilities, including public administration and the provision of public services, defence, national security, law enforcement, fuel and energy industries (including nuclear energy), chemical and petrochemical industries, metallurgy, water management and water supply, agriculture, public health, housing and utility services, banking and finance, transportation, information and communication technologies, ecology and environmental protection, extraction and processing of minerals of strategic importance, manufacturing, other sectors of the economy and the social sphere.