Tashkent, Uzbekistan (UzDaily.com) -- The order of the Minister of Justice “On approval of the standard procedure for processing personal data” was adopted.

The standard order defines:

procedure for processing personal data;

principles, purposes and conditions of processing;

rights and obligations of the owner and operator of the personal data database.

When processing personal data by the owner and (or) operator or third party, the following procedure must be observed:

carrying out processing for specific and predetermined purposes;

preventing the merging of personal data databases that do not match the purposes of processing;

ensuring the accuracy, reliability, reliability and integrity of personal data;

storage of personal data for no more than the period during which the purpose of processing personal data is achieved (in cases where the law or agreement with the subject does not provide for a period for storing personal data);

ensuring the destruction or depersonalization of personal data when the goals of processing personal data are achieved or when there is no longer a need to achieve the goals (unless the law provides for a different procedure).

The subject’s consent to the processing of his personal data must be obtained in writing or in the form of an electronic document.

When specific purposes for processing personal data are indicated in the offer (public contract), acceptance (approval) of the offer (public contract) is recognized as the consent of the subject to the processing of his personal data.

The subject’s agreement with the requirements and conditions for using the services of the owner and (or) operator is recognized as consent to the processing of his personal data by the owner and (or) operator.

The subject or his legal representative has the right to withdraw his consent to the processing of personal data at any time.

The subject’s consent to the processing of his personal data must reflect:

name of the operator, INN (for individuals - full name, PINFL);

FULL NAME. subject, information about the document confirming his identity;

purposes of processing personal data;

a list of information related to personal data, to the processing of which the subject gives consent;

the term or period during which the consent to the processing of personal data is valid;

consent to the transfer of personal data to third parties and (or) their cross-border transfer;

consent to the dissemination of personal data in publicly available sources;

other information.

When processing personal data for historical, statistical, sociological and scientific research, the owner, operator, as well as third parties must anonymize this data. To depersonalize personal data, the consent of the subject is not required.

Depersonalization of personal data eliminates the possibility of their recovery.

Personal data must be destroyed within 3 days if:

achieving the goals of processing personal data;

withdrawal of consent to data processing;

expiration of the period for which consent to the processing of personal data was given;

entry into force of the court decision.

When a government agency requests information about personal data, the subject must be notified about this (except for cases when it comes to state secrets and restricted information).

Business associations, government organizations and institutions, non-governmental organizations are provided with personal data with the consent of the subject.