Where we work · Uzbekistan
ISO and GRC certification consulting in Uzbekistan
Achieve ISO and GRC certification in Uzbekistan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Uzbekistan
Clients include
ISO and GRC certification in Uzbekistan at a glance
Food exporters in Uzbekistan now answer to a new regulator: the Committee for Food Safety, established under Presidential Decree No. UP-84 of 12 May 2026, which states the aim of spreading HACCP among food businesses. Alongside it sit the Law "On personal data", whose storage rules were restated in 2026 and which is supervised by the State Personalisation Centre under the Cabinet of Ministers, and the Law "On saving energy", which ties energy management to a State Energy Register. The Uzbek Center for Accreditation (O'ZAKK) is listed as a signatory of the international arrangement with ISO 9001, ISO 14001, ISO 22000, ISO/IEC 27001, ISO 13485, ISO 45001 and ISO 50001 in scope. Public tenders do not list an ISO certificate among participant criteria, so demand comes mostly from buyers: textile and garment makers, fruit and vegetable exporters, miners, chemical producers, banks and IT Park firms. Sterling, with 8,100+ client engagements in 60+ countries and 20+ years of practice, serves Uzbek organisations from its Dubai office, on-site where the work needs it and remotely otherwise, with Effivity and Sterling Academy included. Sterling does not certify.
ISO and GRC standards Sterling delivers in Uzbekistan
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Uzbekistan (9)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law of the Republic of Uzbekistan "On personal data" (Russian title "О персональных данных") dated 2 July 2019 No. ZRU-547 The authorised state body in the field of personal data is the State Personalisation Centre under the Cabinet of Ministers (Article 8), which regulates the field together with the Cabinet of Ministers (Articles 6 and 7). Its listed powers include keeping the State Register of Personal Data Databases, issuing registration certificates, state control within its powers, approving the model processing procedures and issuing binding orders to remedy breaches | The Law covers processing and protection of personal data by any means, with listed exclusions such as personal and household use, archive documents and state secrets. Processing is allowed on listed grounds (Article 18): consent, a contract with the person, a legal obligation, protection of legitimate interests, public-interest purposes where rights are not infringed, statistical or research use with anonymisation, and data from publicly available sources. Consent may take any form that lets its receipt be proved, and special categories need written consent, including in electronic form (Article 21). Article 27-1, as restated by Law No. ZRU-1125 of 26 March 2026, requires biometric data, genetic data and the data of users of telecommunications operators' services to be stored in Uzbekistan. Other personal data may be stored or processed abroad where the foreign state is recognised as adequate, the operator applies standard contractual clauses or binding corporate rules that meet requirements the authorised body approves, or the operator complies with international standards on data management and storage that appear on a list the authorised body approves. Article 15 lets transfers go to states ensuring adequate protection, or to other states in listed cases such as the person's consent. Databases that must be stored in Uzbekistan are registered by notification in the State Register of Personal Data Databases (Article 20). Owners and operators name a structural unit or official responsible for processing and protection (Article 31). Law No. ZRU-1158 of 13 July 2026, the Constitutional Law on the Tashkent International Financial Centre, also supplemented Article 3 so that personal data rules in a territory with a special legal regime set by Constitutional Law differ from those of this Law. | |
| Law of the Republic of Uzbekistan "On cybersecurity" dated 15 April 2022 No. ZRU-764 The authorised state body in the field of cybersecurity that Article 11 names, which keeps the register of critical information infrastructure objects and sets cybersecurity requirements for them | The Law is a cybersecurity framework, not a privacy law. It does not name ISO/IEC 27001, so an ISO 27001 certificate is evidence of an information security management system rather than proof of compliance with the Law's requirements for critical information infrastructure. | |
| Committee for Food Safety of the Republic of Uzbekistan (Комитет по безопасности пищевой продукции Республики Узбекистан) Food producers, processors, caterers and exporters | The Committee's page on the government portal states that it was established under Presidential Decree No. UP-84 of 12 May 2026 as the authorised body for unified state management and control in food safety, phytosanitary and veterinary matters, working on a field-to-table principle. Its listed functions include approving sanitary rules, norms and hygiene standards, inspecting producers, transporters, storers and sellers of food, assessing food safety risks, aligning its requirements with Codex Alimentarius and introducing risk-based inspection, registration, monitoring and traceability systems. The page states the aim of implementing hazard analysis and critical control points (HACCP) widely among food business operators. | HACCP |
| The specially authorised state body for energy saving, as the Law refers to it Energy-intensive companies and public bodies | Law "On saving energy, its rational use and improving energy efficiency" No. ZRU-940 of 7 August 2024. Article 13 defines energy management as a system of continuous management of the processes that reduce and optimise energy resource use and says it is carried out in the subjects included in the State Energy Register, while the Cabinet of Ministers lists the ministries and agencies introducing energy management in line with international standards. Article 16 sets mandatory energy audits for register subjects and voluntary audits for other consumers, and Article 24 names the phased introduction of energy management systems in line with international standards among the directions for industrial enterprises. | ISO 50001 |
| Cabinet of Ministers, which sets the list of activities by environmental risk under the Law "On ecological audit" Industrial and other operators with environmental impact | Law "On ecological audit" No. ZRU-678 of 15 March 2021. Article 8 provides that ecological audit is voluntary for subjects with low or insignificant local risk and that subjects with high and medium environmental risk are subject to mandatory annual ecological audit, with the Cabinet of Ministers setting the list of activities by risk level. Article 5 allows ecological audit organisations to apply international ecological audit standards under a contract. The Law does not name ISO 14001. | |
| State Labour Inspectorate of the Ministry of Poverty Reduction and Employment of the Republic of Uzbekistan Employers (occupational health and safety) | The Labour Code of the Republic of Uzbekistan of 28 October 2022 contains a chapter on state supervision and inspection of compliance with labour legislation and labour protection rules, and its article 535 is headed "State Labour Inspectorate of the Ministry of Poverty Reduction and Employment". The Code does not name ISO 45001. | |
| Central Bank of the Republic of Uzbekistan, through its Cybersecurity Center CERT-CBU Banks, payment system operators and credit organisations | The Central Bank's CERT-CBU page states that the centre was founded in July 2021 under a presidential decree and ensures cybersecurity in the activities of payment system operators and credit and payment organisations: it sets cybersecurity requirements, keeps a register of critical information infrastructure objects, examines information systems for compliance, monitors cybersecurity and oversees the handling of incidents. The page does not name ISO/IEC 27001, PCI DSS or any other standard. | |
| Anti-Corruption Agency of the Republic of Uzbekistan State bodies and state-controlled organisations (anti-corruption management) | Presidential Decree No. UP-270 of 30 December 2025 provides for a National system of certification of anti-corruption management in state bodies and organisations, introduced in stages from 1 July 2026 to 2030 on a schedule the Agency approves. The Agency's Order No. 95 of 1 July 2026, registered with the Ministry of Justice on 24 July 2026 under No. 3906 and in force from 25 July 2026, approves the Regulation on the national procedure. The Regulation covers state bodies and companies with a state share of 50 per cent or more. It is a public-sector scheme and neither names ISO 37001 nor applies to private companies. | |
| Uzbek Agency for Technical Regulation under the Cabinet of Ministers (national standards body; standards role only) Manufacturers and standards users | The Agency's page on the government portal lists technical regulation, standardization and metrology among its areas of activity. This is its standards role as the portal presents it. |
Accreditation and recognition
- Uzbek Center for Accreditation (O'ZAKK), the State Enterprise "Uzbek Center for Accreditation" ("O'zbekiston akkreditatsiya markazi" DM): National accreditation body of the Republic of Uzbekistan, as its own site describes it, providing accreditation services to conformity assessment bodies in accordance with international standards.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Law of the Republic of Uzbekistan "On public procurement" No. ZRU-684 of 22 April 2021 (State customers, with the procedure details set by the Cabinet of Ministers and published on the special information portal): Article 36 lists the criteria every participant must meet: the technical, financial, material and staff resources to perform the contract, legal capacity, no overdue tax debt, no unfulfilled court-enforced obligations, no insolvency procedure and no entry in the Unified Register of Unscrupulous Contractors. A management system certificate is not among them. Article 37 lets a customer set additional participant requirements based on the specific properties of the goods, works or services, which must be stated in the procurement announcement and are checked through a preliminary qualification selection, and customers may keep lists of qualified participants. Where mandatory certification of the product applies, the bid documents ask for the certificate of conformity.
Economic zones
- Navoi free economic zone, Navoi region: innovative and high-technology production, export-oriented production, import-substituting production
- Special industrial zone "Technopark Nurabad", Samarkand region: manufacturing
- Technological park of software products and information technologies (IT Park): software, IT services, outsourcing
- Tashkent International Financial Centre, Tashkent: financial services, digital assets, financial market infrastructure
Sterling in Uzbekistan
Sterling delivers in Uzbekistan from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Uzbekistan clients ask
Is there a personal data law in Uzbekistan, and which body supervises it?
Yes. The Law "On personal data" (No. ZRU-547 of 2 July 2019) has been in force since 1 October 2019 and lex.uz shows amendments through 2026. It names the State Personalisation Centre under the Cabinet of Ministers as the authorised body, which keeps the register of personal data databases and can issue binding orders. Ask counsel which amendments apply to your processing.
Must personal data about people in Uzbekistan be stored inside the country?
Only for some categories. Under Article 27-1 as restated in 2026, biometric data, genetic data and the data of telecommunications service users must be stored in Uzbekistan. Other personal data may be kept or processed abroad if the destination is recognised as adequate, standard clauses or binding corporate rules are used, or listed international standards are followed. Have counsel review your hosting before migrating systems.
Which body accredits certification bodies in Uzbekistan?
The Uzbek Center for Accreditation, O'ZAKK, is the national accreditation body. The international arrangement's signatory list of 31 December 2025 shows it as a signatory for management systems certification covering ISO 9001, 14001, 22000, 27001, 13485, 45001 and 50001, and ILAC records its signatory status for ISO/IEC 17025 laboratories. For other standards, ask the certification body for its accreditation scope.
Does winning a government contract in Uzbekistan require an ISO certificate?
Not as a general rule. Participants must show resources, legal capacity, a clean tax and insolvency position and no listing in the register of unscrupulous contractors, and a management system certificate is not on that list. A customer can still attach its own conditions for particular goods or services in the announcement, so the individual tender decides.
What does the Committee for Food Safety mean for food exporters and processors?
It is the authorised body for unified control in food safety, phytosanitary and veterinary matters, established under Presidential Decree No. UP-84 of 12 May 2026. Its page lists sanitary rules, inspections, risk-based controls and traceability, and states the aim of spreading HACCP among food business operators. A HACCP-based system and ISO 22000 therefore fit the direction of inspections, though buyers set their own requirements.
Which holidays and rest days should be avoided when scheduling audits in Uzbekistan?
Avoid the non-working holidays in Article 208 of the Labour Code, which include 1 January, Navruz on 21 March, 9 May, 1 September, 1 October and 8 December, plus the first day of Ruza hayit and of Qurbon hayit. Sunday is the common rest day, and a rest day that coincides with a holiday moves to the next working day. Presidential decrees can also shift rest days.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law of the Republic of Uzbekistan "On personal data" (Russian title "О персональных данных") dated 2 July 2019 No. ZRU-547 — lex.uz (accessed 18 Oct 2026)
- Law of the Republic of Uzbekistan "On cybersecurity" dated 15 April 2022 No. ZRU-764 — lex.uz (accessed 18 Oct 2026)
- The Committee's page on the government portal states that it was established under Presidential Decree No. UP-84 of 12 May 2026 as the authorised body for unified state management and control in food safety, phytosanitary and veterinary matters, working on a field-to-table principle. Its listed functions include approving sanitary rules, norms and hygiene standards, inspecting producers, transporters, storers and sellers of food, assessing food safety risks, aligning its requirements with Codex Alimentarius and introducing risk-based inspection, registration, monitoring and traceability systems. The page states the aim of implementing hazard analysis and critical control points (HACCP) widely among food business operators — gov.uz (accessed 18 Oct 2026)
- Law "On saving energy, its rational use and improving energy efficiency" No. ZRU-940 of 7 August 2024. Article 13 defines energy management as a system of continuous management of the processes that reduce and optimise energy resource use and says it is carried out in the subjects included in the State Energy Register, while the Cabinet of Ministers lists the ministries and agencies introducing energy management in line with international standards. Article 16 sets mandatory energy audits for register subjects and voluntary audits for other consumers, and Article 24 names the phased introduction of energy management systems in line with international standards among the directions for industrial enterprises — lex.uz (accessed 18 Oct 2026)
- Law "On ecological audit" No. ZRU-678 of 15 March 2021. Article 8 provides that ecological audit is voluntary for subjects with low or insignificant local risk and that subjects with high and medium environmental risk are subject to mandatory annual ecological audit, with the Cabinet of Ministers setting the list of activities by risk level. Article 5 allows ecological audit organisations to apply international ecological audit standards under a contract. The Law does not name ISO 14001 — lex.uz (accessed 18 Oct 2026)
- The Labour Code of the Republic of Uzbekistan of 28 October 2022 contains a chapter on state supervision and inspection of compliance with labour legislation and labour protection rules, and its article 535 is headed "State Labour Inspectorate of the Ministry of Poverty Reduction and Employment". The Code does not name ISO 45001 — lex.uz (accessed 18 Oct 2026)
- The Central Bank's CERT-CBU page states that the centre was founded in July 2021 under a presidential decree and ensures cybersecurity in the activities of payment system operators and credit and payment organisations: it sets cybersecurity requirements, keeps a register of critical information infrastructure objects, examines information systems for compliance, monitors cybersecurity and oversees the handling of incidents. The page does not name ISO/IEC 27001, PCI DSS or any other standard — cbu.uz (accessed 18 Oct 2026)
- Presidential Decree No. UP-270 of 30 December 2025 provides for a National system of certification of anti-corruption management in state bodies and organisations, introduced in stages from 1 July 2026 to 2030 on a schedule the Agency approves. The Agency's Order No. 95 of 1 July 2026, registered with the Ministry of Justice on 24 July 2026 under No. 3906 and in force from 25 July 2026, approves the Regulation on the national procedure. The Regulation covers state bodies and companies with a state share of 50 per cent or more. It is a public-sector scheme and neither names ISO 37001 nor applies to private companies — lex.uz (accessed 18 Oct 2026)
- The Agency's page on the government portal lists technical regulation, standardization and metrology among its areas of activity. This is its standards role as the portal presents it — gov.uz (accessed 18 Oct 2026)
- Uzbek Center for Accreditation (O'ZAKK), the State Enterprise "Uzbek Center for Accreditation" ("O'zbekiston akkreditatsiya markazi" DM) — akkred.uz; iaf.nu; ilac.org (accessed 18 Oct 2026)
- Public procurement under the Law of the Republic of Uzbekistan "On public procurement" No. ZRU-684 of 22 April 2021 — lex.uz (accessed 18 Oct 2026)
- Navoi free economic zone, Navoi region — lex.uz (accessed 18 Oct 2026)
- Special industrial zone "Technopark Nurabad", Samarkand region — lex.uz (accessed 18 Oct 2026)
- Technological park of software products and information technologies (IT Park) — lex.uz (accessed 18 Oct 2026)
- Tashkent International Financial Centre, Tashkent — lex.uz (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice