VPNs with servers in Uzbekistan

Under article 23 of the Law on Telecommunications (No. ZRU-1015, 27 December 2024), operators and providers must, through the specially authorised state body and at their own expense, buy, install and operate equipment for operational-search measures, and follow that body’s instructions. The Law fixes no retention period. Whether it reaches a VPN operator is not established.

On 2 July 2021 the communications regulator, Uzkomnazorat, added several social networks to a register of personal-data violators, citing article 27-1 as it then stood, and limited their use in Uzbekistan until the shortcomings were removed. It did not publish the list. Article 23 of the Law on Telecommunications separately provides that a network or telecommunications means used for criminal purposes harmful to individuals, society or the state is suspended.

Under the Criminal Code, defamation (article 139) and insult (article 140) published in print, in the media, on telecommunications networks or on the internet carry a fine of 200 to 400 basic calculated values, or community service, correctional labour, or in the case of defamation restriction of liberty. Article 244-6 punishes spreading false information, online included, that disgraces a person or threatens public order, where an administrative penalty was previously imposed for the same act.

Article 20 of the Law on Telecommunications keeps the secrecy of calls and messages and allows its restriction only by law and on a court decision. Article 23 adds that operational-search equipment is deployed and used only by the authorised state body, and operators must prevent disclosure of its methods. The data-storage rule has itself changed: in 2021 article 27-1 required citizens’ personal data generally to be kept in databases physically located in Uzbekistan.

The order of the rows is the security score, and a server’s location is not a recommendation.