Biometric data used by financial organisations to identify and authenticate customers must now be stored in Uzbekistan, according to a Central Bank resolution.
The requirement applies to payment-system operators, payment-service providers, electronic factoring platforms and credit bureaus.
The Central Bank board adopted Resolution No. 21/4 on 22 July, and the Justice Ministry registered it as No. 3914 on 1 August. It takes effect on the date of official publication.
The rule was added to the existing information-security and cybersecurity requirements governing each group of organisations.
Other customer personal data that is not biometric may still be stored and processed outside Uzbekistan under Part 3 of Article 27¹ of the Personal Data Law.
The territorial restriction therefore applies specifically to biometrics used to verify a customer’s identity, rather than to every category of personal data.
