When choosing hosting, most site owners compare price, speed and the control panel, but rarely ask which country the server physically sits in. If your website collects customers' names, phone numbers, addresses or passport details, that question stops being purely technical and becomes a legal one. Uzbekistan has required personal data of its citizens to be stored on servers inside the country for several years now. This article explains what the rule says, who it applies to and how to check your own site.
What the law actually requires
The core document is the Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 of 2 July 2019. In January 2021 it was amended by Law No. ZRU-666. Under the amendment, owners and operators that process personal data of Uzbek citizens using information technologies, including on the internet, must collect, systematize and store that data on technical means physically located in Uzbekistan. Those databases must also be registered in the State Register of Personal Data Databases. The rule came into force in April 2021, and compliance is overseen by the State Personalization Center.
Which websites hold personal data
The rule is not limited to large companies or government bodies. Any organization that gathers citizens' data online, from a small online store to a private clinic, falls within its scope.
Many owners assume their site holds no personal data because it stores no passport scans or medical records. In practice, any information that identifies a person, such as a name together with a phone number, counts. Order forms, callback requests, registration pages and newsletter sign-ups all collect it. Online shops keep buyers' names and delivery addresses, clinics keep appointment records, schools and training centres keep lists of students and parents, and CRM systems pull all of this into one place along with call history and correspondence. If a form asks for a passport series or a personal identification number (PINFL), the data becomes far more sensitive and needs stronger protection.
An example: an online shop in Tashkent
Picture a small Tashkent shop selling home appliances on WordPress and WooCommerce. At checkout, customers enter their name, phone number and address. Years ago the owner picked foreign hosting because it was cheaper, so the database lives abroad too. Orders are also pushed automatically to a cloud CRM overseas, and backups go to a foreign cloud storage bucket. That means citizens' data sits in at least three places outside the country. Moving only the website to local hosting would not solve the problem, because the CRM and the backups are part of the same data flow. The right approach is to map the whole chain first: where data is collected, where it is sent and where it is stored.
Questions to check your own site
- Where are the site and database physically located? What matters is the data centre address, not where the hosting company is registered.
- Where are backups stored? Many panels send backups to an external cloud by default, which copies data abroad.
- Which third-party services are connected? Form builders, CRMs, analytics and chat widgets may send visitor data to their own servers.
- Is there a privacy policy page explaining what data is kept, why and for how long?
- Does every form have a consent checkbox?
- Who has access to the data? Review admin accounts, password strength and staff permissions.
- Is the database registered in the state register? This is a separate legal requirement that is easy to forget.
The practical side of local hosting
Keeping the server in Uzbekistan helps beyond compliance. Local data centres are usually connected to Tas-IX, so pages load noticeably faster for visitors inside the country, which matters a lot for shoppers on mobile internet. sayt.uz hosting servers are located in Uzbekistan, so site files and databases stay within the country, and every site gets a free, automatically renewed SSL certificate to encrypt form submissions. For larger projects, a VPS gives you full control over the database and backups.
Compliance does not end with the server
Local hosting covers an important part of the requirement, but full compliance also involves internal documents, a consent procedure, access control and registration in the state register. Since every business is different, it is wise to confirm your exact obligations with a lawyer who knows personal data law. Moving the server to Uzbekistan and tidying up your data flows, however, is a practical step you can take today.