Law of the Republic of Uzbekistan On the Protection of Information in the Automated Banking System

Law of the Republic of Uzbekistan ON THE PROTECTION OF INFORMATION IN THE AUTOMATED BANKING SYSTEM

Adopted by the Legislative Chamber November 16, 2005 Approved by the Senate February 24, 2006

Article 1. Purpose of this Law The purpose of this Law is to regulate relations in the field of information protection in the automated banking system.

Article 2. Legislation on the protection of information in the automated banking system Legislation on the protection of information in the automated banking system consists of this Law and other acts of legislation. If an international treaty of the Republic of Uzbekistan establishes rules other than those provided for by the legislation of the Republic of Uzbekistan on the protection of information in the automated banking system, the rules of the international treaty shall apply.

Article 3. Automated banking system An automated banking system is an information system designed to collect, store, search, process, and use information in the field of banking activities.

Article 4. Goals of information protection in the automated banking system Information protection in the automated banking system is carried out for the purposes of:

ensuring information security and cybersecurity of information systems and resources of banks and protecting banking secrecy; (prevention of leakage, theft, loss, distortion, blocking, forgery of information and other unauthorized access to it, as well as copying and other forms of interference in the automated banking system.)

Article 5. Organization of information protection in the automated banking system The organization of information protection in the automated banking system is carried out by:

developing and observing rules for information protection, ensuring information security and cybersecurity of information systems and resources, as well as controlling the implementation of measures aimed at protecting information processed in the automated banking system; using certified technical means and information protection means; creating an information protection service in the automated banking system; coordinating activities on the collection and use of methods for processing information in the automated banking system.

Article 6. Access to information in the automated banking system Access to information in the automated banking system is provided to the user of the automated banking system with the permission of the information owner. Providing access to information in the automated banking system without the permission of the information owner is permitted only in cases provided for by law.

Article 7. Owner of the automated banking system The owner of the automated banking system must be a legal entity. The owner of the automated banking system coordinates interaction between the information owner and the user of the automated banking system. The owner of the automated banking system is obliged to inform the information owner and the user of the automated banking system about the features of information processing methods in the automated banking system, and the information owner and the user of the automated banking system are obliged to confirm their consent to the application of the proposed processing methods and the absence of claims. The owner of the automated banking system is obliged to ensure information protection in accordance with the rules established by the Central Bank of the Republic of Uzbekistan and is obliged to notify the information owner of all facts of violation of the protection of his information. The owner of the automated banking system is obliged to ensure the protection of information containing state secrets or being confidential in the manner established by the Cabinet of Ministers of the Republic of Uzbekistan.

Article 8. Certification of technical means in the automated banking system Certification of technical means in the automated banking system, as well as means of protecting this system (including cryptographic ones), which process information containing state secrets or being confidential, is carried out in accordance with legislation.

Article 9. Information protection service in the automated banking system An information protection service in the automated banking system must be created in the Central Bank of the Republic of Uzbekistan and in banks. The information protection service in the automated banking system:

organizes control over the preservation of information; provides methodological and practical assistance in information protection issues; participates in the design, testing, and acceptance of the information protection system in the automated banking system; takes measures to protect information in the automated banking system upon detection of attempts at unauthorized access to information, other forms of interference, and violation of system operation rules; analyzes the state and effectiveness of information protection measures; carries out other powers in accordance with legislation.

Article 10. Dispute resolution Disputes in the field of information protection in the automated banking system are resolved in the manner established by legislation.

Article 11. Liability for violation of legislation on the protection of information in the automated banking system Persons guilty of violating the legislation on the protection of information in the automated banking system bear responsibility in the established manner.

Article 12. Entry into force of this Law This Law enters into force from the day of its official publication.

President of the Republic of Uzbekistan I. KARIMOV city of Tashkent, April 4, 2006, No. ZRU-30 (Collection of Legislation of the Republic of Uzbekistan, 2006, No. 14, Art. 112; National Database of Legislation, September 21, 2024, No. 03/24/964/0736)