Level Marketing / Articles / Running a business
Customer database and personal data in Uzbekistan: a guide
Every lead, every phone number taken at the checkout and every name in a Telegram bot is personal data. The rules for a customer database and personal data are not just for banks: a furniture store, a clinic or a training centre falls under them too. Here is what the law says, what changed in March 2026 and how to put your database in order in a single day.
This article is not legal advice. We explain the law in a business owner's language. For complex situations, talk to a lawyer.
Which law applies and to whom
The main act is the Law "On Personal Data" No. ZRU-547 of 2 July 2019 (lex.uz). It defines three key roles:
| Role | Who | In plain words |
|---|---|---|
| Database owner | The person or company that owns and uses the database | Whoever the customer list belongs to |
| Operator | The person or company that collects, stores and processes the data | Usually the business itself; sometimes a CRM service or call centre |
| Data subject | The person the data is about | Your customer |
Personal data is any information that identifies a person: name, phone, address, date of birth, purchase history. So 500 numbers in Excel, customer cards in a CRM and leads in a bot are all personal data databases.
Who should pay most attention:
- Shops that collect numbers at the checkout and send promotions.
- Clinics and dental practices — medical data is a special category under the law.
- Training centres and driving schools — they often handle data about minors.
- Developers and car dealers — they sign contracts that include passport details.
Consent: how to get it and how to prove it
Under Article 21, consent may be given in any form that makes it possible to prove it was obtained. Special data (such as health information) needs written consent, which may be an electronic document. For a minor, parents or guardians give consent.
The key word is prove. "The customer agreed verbally" will not help you in an inspection. In practice:
- In a lead form — a separate, unticked checkbox: "I agree to my data being used to contact me about this request", with a link to your privacy policy.
- In a Telegram bot — a consent question with a "Yes" button at the end of the form, saved with a timestamp. How to build one: Collecting leads with a Telegram bot.
- At the checkout or reception — a short paper form or a signature on a tablet.
- In a clinic — separate written consent for medical data.
Consent is tied to a purpose. If a customer agreed to "be called back about my request", that is not consent to promotional SMS. From 1 November 2026, promotional SMS require their own consent — see SMS advertising rules in Uzbekistan.
Customers can also withdraw consent: under the law, in the same form they gave it, or in writing. So mark "please stop messaging me" in your CRM straight away.
The state register: registering your database
Under Article 20, personal data databases are registered in the State Register by notifying the authorised body. If the registration details change, the owner and operator must report it within 10 calendar days. The law has some exemptions (for example, data used only for a one-time login to a website).
According to public sources, the application is filed through the pd.gov.uz portal using e-government ID (id.gov.uz); the public services portal also lists a "Registration of a personal data database in the State Register" service. Before applying, describe your database:
- What data you collect (name, phone, address, passport, medical data).
- For what purpose (lead, contract, delivery, advertising).
- Where it is stored (CRM, Google Sheets, your own server).
- Who has access and who receives the data.
- How long it is kept.
This list is useful beyond the register — it becomes your internal policy.
March 2026: where data may now be stored
Since 2021 the law required personal data of Uzbek citizens to be stored on servers inside the country (Article 27¹). That was a real question for businesses using foreign CRMs and cloud tools.
Amendments were signed on 26 March 2026 and took effect on 27 March (Kun.uz). Only the following must now be stored in Uzbekistan:
- biometric data;
- genetic data;
- data of users of telecom operators working in Uzbekistan.
Other personal data may be stored and processed abroad if one condition is met: the country is recognised as offering equivalent protection (the Cabinet of Ministers approves the list); the operator adopts standard contractual terms or binding corporate rules approved by the authorised body; or the operator follows international data management standards.
What this means for a shop or clinic: before using a foreign CRM or cloud spreadsheet, check where the service stores data and which standards it follows. Biometrics — face login or fingerprint attendance — stay in Uzbekistan only.
Retention, deletion and customer rights
The law does not allow keeping data forever "just in case". Data is kept as long as the collection purpose requires. When the purpose is achieved, consent is withdrawn or the consent period ends, the data must be destroyed (Articles 17 and 31).
Key customer rights and your deadlines:
| Customer request | What the law says | What you do |
|---|---|---|
| "What data do you hold on me?" | The subject has the right to know about their data and the purposes of processing | Decide in advance who answers |
| "My number changed, please fix it" | Changes are made within 3 days of the request | Quick edits in the CRM |
| "Delete my data" | Deletion can be required if data is inaccurate, outdated or no longer needed | A deletion procedure and a responsible person |
| Transfer to third parties | The subject is notified in writing within 3 days | Think before sharing your base with a partner |
The last row surprises many owners. "Let's share our customer list with a partner store" is not just a marketing idea; it is an action with legal requirements.
The 5 most common mistakes in marketing
- A bought database. Someone sells "10,000 numbers". Those people never consented to hear from you — messaging them is a legal and reputational risk.
- Full access for every employee. A manager who leaves takes the base with them. Grant access by role and close old accounts immediately.
- The base in an open Google Sheet. "Anyone with the link can view" is the simplest way to leak data. Share only with named accounts.
- Consent hidden in the form. A pre-ticked box or small print on page three is weak proof of consent.
- Uploading the base to an ad account without thinking. Building a lookalike audience in Meta from a customer list is useful, but it is also sharing data with a third party. Mention advertising purposes in your consent text and check it with a lawyer if needed.
Liability: what is at stake
Breaching personal data legislation carries a fine under Article 46² of the Code of Administrative Responsibility. According to Kun.uz, from 30 January 2022 the fine is 7 BCA (base calculation amounts) for individuals and 50 BCA for officials (Kun.uz). If the same violation is repeated after an administrative penalty, criminal liability under Article 141² of the Criminal Code is possible. Check the current wording on lex.uz.
Beyond the fine there is trust. One news story about a leaked customer base spreads quickly on social media, and rebuilding your online reputation takes months.
A one-day checklist
- Listed all my databases (CRM, Excel, bot, checkout) in one place
- Wrote down the purpose, storage location and retention period for each
- Added a separate consent checkbox to the lead form, bot and paper form
- Keep a record of when and where consent was given
- Separated advertising consent from consent to handle a request
- Reviewed access rights by role and removed former employees
- Closed spreadsheets shared by link
- Checked where my foreign CRM or cloud service stores data
- Discussed registering the database with a lawyer
- Decided who answers "delete my data" requests and how
Questions and answers
I run a small shop with 300 numbers. Does this apply to me? Yes. The law does not distinguish by database size. But the work for a small business is modest: collecting consent, limiting access and deleting what you do not need takes a day.
Can I use a foreign CRM? Since 27 March 2026, all data except biometric, genetic and telecom user data may be stored abroad under the conditions set in the law. Check where the service stores data and which standards it follows.
A customer asks me to delete their data. What do I do? Remove it from the CRM, spreadsheets and ad audiences, then reply to the customer. If you must keep some data by law (for example, contracts or accounting documents), explain that to the customer.
Is a phone number on its own personal data? If it can identify a person, yes — especially when it is stored together with a name, purchase history or address.
What should a lead form for ads say? A short, clear text: who receives the data, why, and how the customer can opt out. On choosing between forms and messages, see Lead form or Direct messages.
Conclusion
A customer database is one of a business's most valuable assets, and the law sets out how to use it: collect it with consent, use it for its purpose, protect it and delete it when it is no longer needed. The March 2026 amendments made working with foreign services easier, but the consent and register requirements remain. Set aside one day, go through the checklist, and your database will be both lawful and useful for marketing.
At Level Marketing, when we set up ad campaigns, we plan in advance where leads land and how consent is collected, so the database can be used safely later.
