Cybersecurity law & regulation in Uzbekistan (2026)
Cybersecurity in Uzbekistan: comprehensive law.
Uzbekistan enacted a dedicated Cybersecurity Law in April 2022 establishing an overarching framework covering critical information infrastructure (CII), mandatory certification of security tools, and the SSS as the principal regulator. Presidential Resolution PP-167 (May 2023) elaborated CII-specific obligations, Presidential Decree PQ-153 (April 2025) tightened breach-notification duties especially for the financial sector, and Presidential Decree UP-38 (March 2026) launched a new National Cybersecurity Strategy for 2026-2030.
Legal framework
Law of the Republic of Uzbekistan 'On Cybersecurity' (April 2022, ZRU-764); administered by the State Security Service (SSS) as authorised cybersecurity body and UZCERT as the national CERT
Key points: cybersecurity in Uzbekistan
Core Cybersecurity Law (2022)
The Law 'On Cybersecurity' (signed 15 April 2022, ZRU-764) consists of 8 chapters and 40 articles covering the legal basis of cyber protection, roles of state bodies, CII registration, certification requirements for hardware/software, and liability for violations.
Regulatory Authority
The State Security Service (SSS) is the authorised state body for cybersecurity policy and maintains the unified register of CII facilities. The Inspectorate for Control in the Sphere of Information and Telecommunications under the Ministry of Digital Technologies serves as the operational/executive arm.
CII Obligations (PP-167, May 2023)
Presidential Resolution No. PP-167 (31 May 2023) requires operators of CII facilities (spanning banking, energy, telecoms, agriculture, health, defence, IT, and mining) to establish dedicated cybersecurity units or engage registered outsourcing providers, and to implement multi-factor authentication and secure connections for public-facing systems.
Breach Notification & 2025 Tightening
Presidential Decree No. PQ-153 (30 April 2025) introduced compulsory breach-notification obligations with particular emphasis on the financial sector, legal liability for data incidents, and a requirement to report significant cyber-incidents within 24 hours to the regulator; non-compliance can trigger administrative investigation and suspension of digital operations.
National CERT & Sector CERTs
National Cybersecurity Strategy 2026-2030
Presidential Decree UP-38 (signed 10 March 2026) adopted a five-pillar Cybersecurity Strategy covering national cyber resilience, CII protection, cybercrime combat, AI-based cybersecurity development, and international cooperation; it mandates dedicated cybersecurity units across all government agencies from 1 April 2026 and a 'Zero Trust' framework for large-scale public-data operators.
Sources
- cis-legislation.com/document.fwx?rgn=139485
- uzdaily.uz/en/post/72467/
- cis-legislation.com/document.fwx?rgn=150359
- dentons.com/en/insights/articles/2023/june/7/uzbekistan-cybersecurity-obligations
- dentons.com/en/insights/articles/2025/may/14/uzbekistan-tightens-cybersecurity-ob
- uzcert.uz/en/
- cbu.uz/en/cert/about/
- daryo.uz/en/2026/03/11/uzbekistan-to-strengthen-cyber-defenses-under-new-20262
- nurilla.com/insights/uzbekistan-cybersecurity-strategy-2030.html
- blackswan.law/law-on-cybersecurity/
- uzdaily.uz/en/state-security-service-is-defined-as-an-authorized-state-body-in-t
- legal500.com/developments/thought-leadership/personal-data-compliance-in-uzbekista
Next for Uzbekistan: Starting a BusinessEasy
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026