Short answer: Under Uzbekistan's personal data localization rule, a company that processes the personal data of Uzbek citizens using information technology must store it in databases on technical means physically located in Uzbekistan and registered in the State Register. CRM, HR and point-of-sale data in Odoo is personal data too, so where the server sits must be decided at the start of the project. Deep Vision, an Odoo Gold Partner in Tashkent, raises this question during diagnostics and helps you choose a setup together with your lawyer.
When companies implement Odoo, leaders usually think about modules, price and timeline, and rarely ask: "Where will our customer database physically live?" Yet personal data localization is a legal requirement in Uzbekistan. A team from Dubai or any other country may, out of habit, set up the server in its own country or on an international hosting provider it knows well. This article explains what the law says, which Odoo data counts as personal data, and how to choose where to host Odoo for a business in Uzbekistan.
Important: this article is not legal advice. Consult a lawyer about your specific case.
What is personal data localization, and what does the law say?
Personal data localization is the obligation to collect, systematize and store the personal data of Uzbek citizens on technical means located in Uzbekistan.
Law No. ZRU-666 of 14 January 2021 added Article 27-1 to the Law "On Personal Data". Under it, owners and operators that process the personal data of Uzbek citizens using information technology must collect, systematize and store that data in databases on technical means physically located in Uzbekistan and registered in the State Register of personal data bases. The rule came into force on 15 April 2021 (Mondaq). The substance of the change and comments from the responsible officials are covered in a Kun.uz report.
Which data in Odoo counts as personal data?
Many people think personal data means only "a passport copy". In practice, Odoo holds personal data in almost every module:
- CRM and sales: customer names, phone numbers, addresses, message history;
- Point of sale (POS) and loyalty programs: shopper phone numbers, purchase history, loyalty cards;
- HR and payroll: passport details, personal identification numbers (PINFL), family members, salaries, leave and sick notes;
- Delivery and service: delivery addresses, warranty and service requests;
- Calls and messages: call recordings and SMS history, if connected to the system.
In other words, even an ordinary trading company starts processing the personal data of thousands of citizens on the day Odoo goes live.
Where does a foreign team host the server, and why is that a risk?
Picture a retail chain with 15 stores implementing Odoo with a team brought in from abroad. Following its usual practice, the team sets up the server with the foreign hosting provider it always uses: convenient, with backups and monitoring already in place. The project goes live successfully, and tens of thousands of shoppers join the loyalty program with their phone numbers.
A year later an auditor or lawyer asks: "Where is your customer database located, and is it registered in the State Register?" It turns out that:
- the server is in another country, and moving it requires a new project;
- the contract says nothing about where data is stored;
- only the foreign team has full access to the server;
- the backups are abroad as well.
This is not about the team's skill. A team from a different business environment is used to the rules of its own country and may simply not know this Uzbek requirement. A local team meets the question on every project.
Where can an Odoo server be hosted?
Odoo can be deployed in several ways, including on a company's own server (on-premise). That gives several options for meeting the personal data localization requirement:
- Your own server: a machine in your office or warehouse. Full control, but power, cooling, backups and security are your responsibility.
- A data centre in Uzbekistan: a rented physical or virtual server in a local data centre. The provider runs the infrastructure, and the data stays in the country.
- A mixed setup: the main database with personal data in Uzbekistan, and parts without personal data elsewhere. Such a setup needs separate review by a lawyer.
We compare editions in Odoo Community vs Enterprise. Which hosting option fits you depends on data volume, your IT staff and budget.
How to check personal data localization: a buyer's checklist
Before an Odoo project starts, or for the system you already run, find out:
- In which country and which data centre is the Odoo database physically located?
- Where are backups stored, and does your lawyer say they must also be in Uzbekistan?
- Is the personal data database registered in the State Register of personal data bases?
- Who has administrator access to the server, and is that written into the contract?
- Does the contract cover data location, data ownership and hand-over when the project ends?
- Could you control access to the server and database yourself if the relationship with the partner ended?
- Where do external services connected to Odoo (SMS, telephony, email) store data?
If any answer is "I don't know", that is the first topic to discuss with your lawyer and IT partner.
How does Deep Vision handle this?
Deep Vision is based in Tashkent and runs projects with clients in Uzbekistan and elsewhere in Central Asia. Our approach to personal data:
- work starts with diagnostics, where we discuss which modules will hold personal data and where the server will sit, followed by a phased estimate;
- the hosting option is chosen together with the client and their lawyer; we do not give legal opinions, but we explain the technical options;
- the team is in Tashkent, so if work on your own server is needed, a specialist comes to your office (our office: Shahrisabz ko'chasi 25, office 401);
- 7 Odoo-certified experts and Odoo Gold Partner status (odoo.com partner page).
Under Odoo's criteria, Gold requires 300 new Enterprise users a year, 6 certified people and at least 80% customer retention; Deep Vision's retention is 89%. See also our 12-question guide to choosing an Odoo implementation partner in Uzbekistan, Odoo POS for retail and our Odoo implementation service, or fill in a short brief.
Frequently asked questions
Does this requirement apply to small companies?
The law refers to owners and operators of personal data, not to exemptions by company size. Confirm your situation with a lawyer.
Can Odoo be installed on a server in Uzbekistan?
Yes. Odoo can be installed on a company's own server or on a server in a local data centre. The choice depends on data volume and IT resources.
What if our Odoo database is currently abroad?
First assess the situation with a lawyer. Technically, the database can be moved to a server in Uzbekistan; do it with a plan and a test migration.
Can backups be stored abroad?
That is a legal question. The law requires data to be stored on technical means in Uzbekistan, so agree your backup setup with a lawyer.
Who registers the database in the State Register?
Clarify this with your lawyer: who files, which documents are needed and what the deadlines are. Your IT partner can help prepare the technical details about the server and database.
Sources
- Mondaq: The Law On Personal Data Has Been Amended
- Kun.uz: changes in the law on personal data
- Deep Vision, odoo.com partner page
- Odoo partner tiers
To plan where your Odoo server and data will live, fill in the brief or call +998 77 093 00 07.