Video surveillance and personal data: where the archive may legally be stored

The Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of 2 July 2019 defines personal data as information recorded on an electronic, paper or other medium that relates to a specific individual or makes it possible to identify them. The phrase “makes it possible to identify” is the key: a recording in which a person's face is distinguishable falls under that definition.

From this follows a conclusion many find unexpected: an ordinary office recorder is a personal data database, and the company that installed and configured it for itself acts as the operator, with all the duties that people tend not to consider until the first inspection or complaint.

The law singles out biometric data: personal data characterising the anatomical and physiological features of the subject. Face recognition at a turnstile, a fingerprint on a time-attendance terminal, an iris template — all of it is biometrics in the legal sense, not merely “a convenient way to open a door”.

The difference is practical. An access card is impersonal: lose it and you are issued another. A biometric template cannot be changed, and a leak of such a database is irreversible. That is precisely why the law places separate requirements on processing biometric data, and why a face recognition terminal should not be installed simply because it is available.

This is the part that decides equipment choice. The law was supplemented with Article 27-1 on special conditions for processing the personal data of citizens of the Republic of Uzbekistan. Under it, when processing the personal data of the republic's citizens using information technologies, including over the internet, the owner or operator must ensure their collection, systematisation and storage in personal data databases on technical facilities physically located in the territory of the Republic of Uzbekistan and registered in the established manner in the State Register of Personal Data Databases.

The authorised state body in this area is the State Personalisation Centre under the Cabinet of Ministers. It maintains the State Register of Personal Data Databases, issues the certificate of registration of a database and, within its powers, oversees compliance with the legislation.

The mass-market cloud services offered by camera manufacturers are convenient: mount the camera, link it to the app, watch from anywhere. The question is where the recording physically resides. If the system identifies citizens of Uzbekistan while the server sits outside the republic, the arrangement runs against the requirement to keep the database within the country.

Hence our engineering position, which we explain to every client: a local recorder or an on-site server is neither conservatism nor an attempt to sell hardware. Remote access does not disappear — you can still watch from a phone through a local recorder; the only difference is where the archive is kept.

First, notification. When their personal data is entered into a database, the subject must be notified in writing of the purposes of processing and of their rights. In practice that is the familiar “video surveillance in progress” sign, but the duty does not end with a sign: employees whose biometric data enters an access control system need a document.

Second, transfers. If personal data is passed to a third party, the owner or operator notifies the subject in writing within three days. Third, timing: the duty to protect the data arises at the moment of collection and lasts until the data is destroyed or de-identified. “We simply keep an archive and show it to nobody” does not remove the obligations.

Uzbek law has no ready-made list of places where cameras are banned — the boundary follows from several rules read together. Article 31 of the Constitution of the Republic of Uzbekistan (adopted by referendum on 30 April 2023) guarantees everyone the inviolability of private life, personal and family secrets, and the right to demand the destruction of information about them collected unlawfully. Article 25 of Law No. ZRU-547 classes information about private life as special personal data: processing it is prohibited except in the cases the law lists, and for a private camera owner the main one is the written consent of the person concerned.

An ordinary camera in a shop or office rests on a different basis. Article 18 of the same law allows data to be processed to exercise the owner's rights and legitimate interests — protecting property, for example — on one condition: the rights and legitimate interests of the data subjects must not be violated. That gives the practical rule we follow on every site: the camera covers entrances, tills, storage, parking and corridors, while places where people undress or expect privacy — toilets, showers, changing rooms, fitting rooms, staff rest and sleeping rooms — and the windows and doors of other people's homes stay out of frame.

The home deserves a separate word: the same Article 31 enshrines its inviolability. A camera above your own gate that sees the street is normal practice; a camera turned so that a neighbour's yard or windows fall into frame already intrudes on someone else's private life, and that angle is best avoided even if the bracket allows it. Cameras have a privacy mask for exactly these cases: the selected part of the frame is blanked out and never reaches the archive.

An entrance hall, staircase and lift are common areas, not anyone's flat, so a camera there does not by itself intrude on private life. In new buildings it is in fact mandatory: under Presidential Resolution No. PP-48 of 5 February 2026, from 1 May 2026 cameras in every entrance, in lifts and on the adjacent grounds are included in the design, and the installed equipment becomes common property of the building. In an existing building a camera in the entrance is best installed by agreement with the neighbours and the management company: the space is shared, and the question of who keeps the archive is better settled in advance.

A camera by your own door is appropriate when it covers your door and the landing in front of it. Pointing the lens at a neighbour's doorway or peephole, keeping their hallway in frame every time the door opens, let alone posting recordings of neighbours in group chats, may be treated as unlawful collection or dissemination of information about private life. Article 46-1 of the Code of Administrative Responsibility sets a fine of 10 to 40 base calculation amounts for this, and a repeat offence after an administrative penalty falls under Article 141-1 of the Criminal Code.

The Labour Code of the Republic of Uzbekistan of 28 October 2022 devotes Articles 175–180 to employees' personal data. Article 175 includes in it information about facts, events and circumstances of the employee's life that have become known to the employer, and classes such information as confidential. A recording in which an employee can be recognised fits that definition in substance.

Article 176 obliges the employer to inform the employee of the purposes, sources and methods of obtaining their personal data and to have employees sign to confirm they have read the documents setting out how that data is processed. For video surveillance this means, in practice, an order or policy on video surveillance (which zones, why, how long the archive is kept, who has access), each employee's signature confirming they have read it, and signs at the entrance to monitored areas. A hidden camera in an office does not meet these requirements.

One more detail from Article 177: a clause in an employment contract or internal document under which the employee waives protection of their personal data is invalid. A line reading “I consent to any video surveillance” in the contract is no substitute for a proper policy. For breaches of personal data legislation, Article 46-2 of the Code of Administrative Responsibility sets a fine of 7 base calculation amounts for citizens and 50 for officials.

SAT Solutions designs systems so that the archive and biometric templates stay at the client's site or on their server in Uzbekistan: local recorders, surveillance servers, access control with a local database. Remote access is set up over a secured connection rather than by moving the database abroad.

This article describes the requirements of the law in general terms and does not replace legal advice on a specific site: the composition of the data, the range of subjects and the processing scheme differ from client to client. If you need an assessment of a particular configuration, send us the system description and we will go through it together with your lawyer.