Versions per the National Database of Legislation (lex.uz, Russian text) as of 22 October 2026: Law No. ZRU-764, unamended, in force since 17 July 2022; Law No. ZRU-547, as amended, including by Laws No. ZRU-1125 of 26 March 2026 and No. ZRU-1174 of 11 September 2026; Resolution No. PP-167, published as an extract, as amended by Decree No. UP-168 of 25 October 2024. The official language of the acts is Uzbek.
This guide is not a legal opinion. The requirements are summarized closely to the Russian text on lex.uz; the exact wording is in the publications listed under "Sources". Whether your organization is a critical information infrastructure entity and which personal data it processes is for your legal team and responsible officers to decide.
In short
- Law No. ZRU-764 «On Cybersecurity» requires every cybersecurity entity to prevent unauthorized access to information systems and to notify the authorized state body of incidents (art. 16).
- Critical information infrastructure (CII) objects have extra measures: the General Requirements (Annex 2 to PP-167) and monitoring systems (art. 28 of the Law).
- Law No. ZRU-547 «On Personal Data» requires legal, organizational and technical protection measures (arts. 27, 31).
- These acts do not explicitly prescribe multi-factor authentication. The law sets no incident notification deadline in hours.
Law No. ZRU-764 «On Cybersecurity»
Cybersecurity entities must (art. 16(2)):
- prevent unlawful dissemination, theft, loss, loss of integrity, blocking and falsification of data, and any other unauthorized access (entry) to information systems and resources;
- take measures to restore systems promptly when the access rules are breached;
- notify the authorized state body of incidents and cybercrimes, keep digital traces from being lost and keep the data needed to analyse incidents;
- follow the cybersecurity requirements set by the authorized state body.
CII entities must install and run monitoring systems (art. 28(2)) and meet the requirements set for their objects (art. 29).
CII objects: General Requirements (PP-167)
They apply to CII entities, i.e. objects on the CII register (arts. 26–29 of Law No. ZRU-764). Item 15 of the General Requirements lists measures, including:
| Measure | Item |
|---|---|
| Identification and authentication at every stage of access | 15 |
| Managing access to files, systems and devices | 15 |
| Timely management of software updates (no deadline set) | 15 |
| Integrity of all data transmitted by devices; protection of data sent over communication lines | 15, 12 |
| Continuous monitoring of the cybersecurity state, analysis of attempts at unauthorized access and alteration of information | 15 |
CII entities notify the authorized state body and the working body of incidents without delay, in the established manner (Annex 1 to PP-167, item 12).
Law No. ZRU-547 «On Personal Data»
-
Protection measures (art. 27(2)). The owner, the operator and any third party take legal, organizational and technical measures. The measures ensure the integrity and safekeeping of personal data, their confidentiality and the prevention of unlawful processing. Art. 31 repeats the duty.
-
Storage in Uzbekistan (art. 27¹ as worded by Law No. ZRU-1125 of 26 March 2026). Per the Russian text on lex.uz, these must be stored in Uzbekistan:
- biometric data;
- genetic data;
- data of users of telecom operators' services.
Other personal data may be stored abroad if one of the conditions of part 3 of that article is met. This Russian text is an unofficial translation: until it is checked against the Uzbek text, the requirement is flagged for legal review and not mapped to findings.
-
The amendments to art. 25 made by Law No. ZRU-1174 of 11 September 2026 had no Russian translation on lex.uz as of the check, so this guide does not summarize them.
What a scan can check
A scan of your own infrastructure shows:
- RDP, management interfaces, SMB, databases, default credentials and unauthenticated services reachable from the internet. This is potential non-compliance with the duty to prevent unauthorized access (Law No. ZRU-764, art. 16). If the database holds personal data, Law No. ZRU-547, art. 27 applies too.
- Outdated software. For CII objects, timely management of updates (item 15).
- Deprecated TLS, expired or self-signed certificates. For CII objects, integrity of transmitted data (items 12, 15). The acts set no explicit TLS version.
- Insufficient event logging. Without it, digital traces and the data needed to analyse incidents are not kept (art. 16), and CII objects are not monitored (art. 28).
A scan cannot show whether an object is on the CII register or where personal data are stored. Documents confirm that.
How Cyber-Cortex helps
Cyber-Cortex maps findings to these requirements and shows the basis: the article or item, the edition of the act and a link to lex.uz. Uzbekistan's legislation is switched on in the organization settings; by default only Belarus applies. A mapping indicates potential non-compliance; applicability and the conclusion are for the organization's responsible officer.
What a scanner can and cannot see is covered in SGRC or vulnerability scanner.