ORDER OF THE MINISTER OF JUSTICE OF THE REPUBLIC OF UZBEKISTAN

of November 15, 2023 No. 20-mkh

About approval of the Standard procedure for personal data processing

According to the Law of the Republic of Uzbekistan "About personal data" PRIKAZYVAYU:

1. Approve the Standard procedure for personal data processing according to appendix.

2. This order becomes effective from the date of its official publication.

Appendix

to the Order of the Minister of Justice of the Republic of Uzbekistan of November 15, 2023 No. 20-mkh

Standard procedure for personal data processing

This Standard procedure determines procedure for processing and personal data protection, the principles, the purposes and conditions of personal data processing, the right and obligation of the owner and (or) the operator of base of personal data.

Chapter 1. General provisions

1. In this Standard procedure the following basic concepts are used:

personal data - the information fixed on electronic, paper and (or) other material medium relating to certain physical person or giving the chance of its identification;

the subject of personal data (subject) - physical person to which personal data belong;

base of personal data - the database in the form of information system containing personal data in the structure;

personal data processing - realization of one or sets of actions for collection, systematization, storage, change, amendment, use, provision, distribution, transfer, depersonalization and destruction of personal data;

the operator of base of personal data (operator) - state body, the physical and (or) legal entity performing personal data processing;

the owner of base of personal data (owner) - state body, the physical and (or) legal entity having right of possession, uses and orders of base of personal data;

the third party - any person which is not the subject, the owner and (or) the operator, but related circumstances or the relations on personal data processing;

collection of personal data - the actions connected with receipt of personal data;

systematization of personal data - the action directed to consolidation of personal data in certain system;

personal data storage - actions for ensuring integrity, confidentiality and possibility of use of personal data;

distribution of personal data - the actions directed to disclosure of personal data to the indefinite group of people including promulgation of personal data in mass media, placement on the Worldwide information network the Internet or provision of access to personal data any different way;

provision of personal data - the actions sent on disclosure of personal data to the particular person;

blocking (restriction) of personal data - temporary suspension of personal data processing (except as specified when processing is necessary for refining of personal data);

use of personal data - the actions with personal data directed to realization of the purposes of activities of the owner, operator and the third party;

change and (or) amendment of personal data - change and (or) amendment of the personal data which are available in base of personal data;

cross-border transfer of personal data - transfer of personal data by the owner and (or) operator out of limits of the territory of the Republic of Uzbekistan;

depersonalization of personal data - actions as a result of which making determination of accessory of personal data to the specific subject becomes impossible;

destruction of personal data - actions as a result of which becomes impossible to recover personal data;

bio data - surname, name, the subject's middle name, personal identification number of physical person this about year and the birthplace, the address and profession and also other personal data which are not part of biometric, genetic and special data;

biometric data - the personal data characterizing anatomic and physiological features of the subject (fingerprints, person, crystalline lenses of eyes, features of voice, etc.);

genetic data - the personal data relating to the inherited or acquired characteristics of the subject which are analysis result of biological example of subject or the analysis of other element allowing to obtain equivalent information;

special data - data on racial or social origin, political, religious or world outlook convictions, membership in political parties and labor unions, and also the personal data concerning physical or sincere (mental) health, data on private life and criminal record.

2. This Standard procedure is applied to the interactions between owners, operators, subjects and the third parties arising in processing of personal data.

Chapter 2. Principles, conditions and purposes of personal data processing

3. The principles of personal data processing are:

observance of constitutional rights and freedoms of man and citizen;

legality of the purposes and methods of personal data processing;

accuracy and personal data verification;

confidentiality and security of personal data;

equal rights of subjects, owners and operators;

safety of the personality, society and state.

4. Personal data processing is performed in the following cases:

consent of the subject to processing of these data;

need of processing of these data for agreement performance which party is the subject, or taking measures to the subject's request to the conclusion of such agreement;

need of processing of these data for the obligation fulfillment of the owner and (or) the operator determined by the legislation;

need of processing of these data for protection of legitimate interests of the subject or other person;

need of processing of these rights granted for implementation and legitimate interests of the owner and (or) operator or the third party or for achievement of the socially significant purposes provided that at the same time the rights and legitimate interests of subjects of personal data are not violated;

processings of these data in statistical or other research purposes on condition of obligatory depersonalization of personal data;

if these data are obtained from public sources.

In need of personal data processing for the purpose of protection of the rights and legitimate interests of the subject their processing is allowed without the consent of the last till the moment when receipt of consent becomes possible.

5. The owner and (or) the operator or the third party in case of personal data processing shall observe the following requirements:

implementation of personal data processing in specific and earlier stated purposes;

non-admission in case of personal data processing of combination of bases of personal data with the inappropriate purposes;

ensuring accuracy, reliability, integrity and safety of personal data;

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info