From Data Localization to Digital Openness: Uzbekistan’s Regulatory Shift

In the wake of Uzbekistan’s 2021 amendment to its Law on Personal Data, which imposed strict data‑localisation requirements, the nation now stands at a regulatory crossroads. The amendment, initially framed as a protective measure for citizens’ information, has increasingly been scrutinised for its economic repercussions, particularly as the country seeks to integrate into the global digital economy. Recent negotiations with major technology firms, coupled with domestic cost‑benefit analyses, signal a shift from a restrictive stance toward a more open, albeit calibrated, digital policy framework.

Historical Context of Uzbekistan’s Data‑Localisation Regime

The 2021 amendment to the Law on Personal Data mandated that personal information of Uzbek citizens be stored and processed within national borders. This legislative move mirrored a broader regional trend of asserting sovereign control over data flows, yet it also placed Uzbekistan at odds with the operational models of leading global platforms. As a result, services such as PayPal, Stripe, Netflix, Spotify and Amazon Web Services declined entry, while even Apple Pay, Google Pay and Google Cloud limited their functionality within the country.

Early enforcement actions underscored the rigidity of the regime. In May 2021, Uzbekistan’s digital and telecommunications regulator, Uzkomnazorat, identified VKontakte, Twitter and WeChat as violators for processing data abroad, and by July 2 of that year, it blocked access to these platforms. The regulator’s stance was justified at the time by the assertion that “internet companies… have to observe the legislation of Uzbekistan,” a view echoed by Temur Akhmedov of the Institute for Strategic and Interregional Studies under the President.

Economic Impact of the Localization Requirement

By 2024, the fiscal cost of the data‑localisation mandate had become starkly evident. The Center for Economic Research and Reforms (CERR) estimated that the absence of YouTube monetisation alone cost Uzbekistan roughly $50 million annually. Wider calculations by Kotib AI Research in July 2025 placed the annual economic burden of the localisation law between $3.2 billion and $4.5 billion, with the lack of PayPal services alone accounting for at least $1.8 billion in lost revenue over the preceding five years. Moreover, limited access to international payment systems was quantified to cost the economy between $500 million and $800 million each year.

These figures illustrate how the localisation clause has constrained not only fintech and e‑commerce but also the broader creative and AI sectors. Article 27 of the data‑protection law, which bars YouTube from running ads, curtails the digital advertising market—estimated at 2.1 trillion Uzbek soms (approximately $164 million) in 2024, with digital ads comprising 29 percent. CERR projected that enabling YouTube monetisation could lift Uzbekistan’s GDP by 0.05‑0.1 percent, underscoring the macro‑economic stakes of the policy.

Policy Dialogues and Institutional Responses

Recognising the tension between data sovereignty and economic development, Uzbek authorities have initiated high‑level dialogues with global technology firms. In late September 2026, Saida Mirziyoyeva, head of the presidential administration, met with Google Vice President Karan Bhatia in New York to explore the launch of YouTube monetisation. Simultaneously, the Central Bank of Uzbekistan highlighted the need to amend the Personal Data Law to facilitate integration of Apple Pay and Google Pay, noting that current requirements impede the connection of Visa and Mastercard cards issued by Uzbek banks to these platforms.

Banking sector voices have also entered the debate. Oliver Hughes of TBC Bank Group, speaking at a December 2024 presidential meeting, advocated for allowing banks to store data both domestically and offshore, arguing that a hybrid approach could reconcile security concerns with operational efficiency. President Shavkat Mirziyoyev, while acknowledging the seriousness of personal data protection, stressed the necessity of a “carefully considered solution,” reflecting a willingness to adjust the legal framework without abandoning the core objective of safeguarding citizen data.

Stakeholder Perspectives on Legal Reform

By mid‑2025, a broad coalition of government officials, legal experts, and industry representatives convened to scrutinise Article 27 and the broader localisation clause. Participants highlighted the law’s ambiguous language and the absence of a dedicated authority to issue definitive guidance, which created uncertainty for foreign investors. Proposals ranged from a full repeal of the localisation requirement to a differentiated regime: strict compliance for state‑owned entities (those with over 20 percent state ownership) while granting commercial operators greater flexibility, provided they obtain explicit user consent for cross‑border data transfers.

These discussions reveal an emerging consensus that a one‑size‑fits‑all approach may be untenable. The need for a nuanced, sector‑specific framework aligns with Uzbekistan’s AI Strategy 2030, which aspires to deepen cooperation with international research institutions and technology firms. Strict localisation, by impeding cloud‑based AI development, directly conflicts with the strategy’s goal of fostering joint research projects and knowledge exchange.

Comparative Regional Dynamics

Uzbekistan’s regulatory evolution can be situated within a broader Central Asian context. While neighboring states have also grappled with data‑sovereignty concerns, Uzbekistan remains the sole country in the region without access to PayPal, a critical gateway for cross‑border e‑commerce and tourism payments. This isolation amplifies the competitive disadvantage posed by the localisation regime, especially as regional partners pursue more open digital policies to attract foreign investment.

The country’s experience also mirrors global debates on data localisation. Nations such as India and Russia have implemented similar restrictions, citing national security and privacy, yet have faced criticism for stifling innovation and inflating operational costs for multinational firms. Uzbekistan’s forthcoming policy adjustments will thus be watched as a case study of how a post‑Soviet state balances sovereign data concerns with the imperatives of digital integration.

Prospects for Legislative Revision in 2026

In January 2026, the Legislative Chamber commenced the third reading of a revised bill aimed at amending the Personal Data Law. Although the source material truncates the details of the bill, the timing suggests that the government is moving toward a calibrated reform that addresses both security and economic imperatives. The involvement of the presidential administration, the Central Bank, and key industry stakeholders indicates a coordinated effort to align legal standards with the practical needs of fintech, e‑commerce, and AI development.

Should the amendment succeed, it could pave the way for the re‑entry of platforms such as PayPal, Apple Pay and Google Pay, and enable YouTube monetisation—potentially unlocking billions of dollars in economic activity. Moreover, a clearer, more flexible legal environment would likely attract additional foreign digital services, fostering competition and innovation within Uzbekistan’s nascent digital market.

Forward‑Looking Assessment

The trajectory of Uzbekistan’s data‑localisation policy illustrates a broader tension between data sovereignty and digital openness that many emerging economies confront. The country’s initial protective stance, while well‑intentioned, generated measurable economic costs that have now spurred a policy reassessment. Ongoing negotiations with global tech firms, coupled with domestic cost‑benefit analyses, suggest that Uzbekistan is poised to adopt a more balanced framework that safeguards personal data without unduly hampering economic growth.

Future research should monitor the implementation of the revised Personal Data Law, the operational adjustments of multinational platforms, and the measurable impact on key sectors such as fintech, digital advertising and AI. As Uzbekistan navigates this regulatory transition, its experience will offer valuable insights for scholars of digital governance and policymakers seeking to harmonise national security objectives with the imperatives of a globally connected digital economy.

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: The Diplomat; thediplomat.com; Global1.News (17 October 2026).

By Prof. David Park, Staff Writer