---
title: "Data Masking ISO 27001 GDPR: Avoid Fines With Compliance"
description: "Explore how Data Masking ISO 27001 GDPR requirements protect sensitive data, reduce risk, and align with Annex A 8.11 and GDPR Article 32."
canonical: "https://axipro.co/data-masking-iso-27001-gdpr-compliance-rules/"
language: "en-US"
modified: "2026-03-31T09:26:26+00:00"
generator: "WordPress 7.1.2"
---

[Home](https://axipro.co)

/ [All Blog](https://axipro.co/category/blog/)

/ Is Data Masking Mandatory? Navigating ISO 27001 and GDPR Requirements

# Is Data Masking Mandatory? Navigating ISO 27001 and GDPR Requirements

![Picture of Thatware](https://secure.gravatar.com/avatar/?s=300&d=mm&r=g)

- Thatware
- January 6, 2026

Copy Link

![data-masking-iso-27001-gdpr-mandatory-guide](https://axipro.co/wp-content/uploads/2026/01/data-masking-iso-27001-gdpr-mandatory-guide.png)

Data masking is a critical yet often misunderstood element of modern data protection strategies. While neither ISO 27001 nor GDPR explicitly mandates it in all circumstances, it becomes essential wherever sensitive data is processed beyond production environments.

ISO 27001’s Annex A 8.11 identifies masking as a recognized control, requiring organisations to justify its applicability based on risk assessments, while GDPR Article 32 emphasises implementing technical and organisational measures appropriate to risk, including pseudonymization techniques. In practice, masking limits unnecessary exposure, supports data minimization, reduces breach impact, and strengthens audit defensibility.

At Axipro, we guide organisations in evaluating where data masking is necessary, mapping it to both ISO 27001 and GDPR requirements, and implementing controls that are practical, defensible, and aligned with real-world compliance expectations.

Data masking is one of those controls that sits in a grey area of compliance. It is referenced in standards. It is encouraged by regulators. It is frequently expected by auditors. Yet it is rarely described as strictly mandatory.

This creates confusion for organisations attempting to build defensible security programs. Some implement masking blindly, assuming it is required. Others avoid it entirely, believing encryption and access controls are sufficient. Both approaches can create problems.

To answer whether data masking is mandatory, it is necessary to look at how ISO 27001 and GDPR actually operate in practice, not how they are often summarised in marketing material.

This article examines Data Masking ISO 27001 GDPR requirements through the lens of risk, audit scrutiny, and regulatory enforcement, rather than abstract theory.

##### TL;DR

- Data masking is not universally mandatory but is often necessary to reduce sensitive data exposure.
- ISO 27001 Annex A 8.11 requires risk-based justification for implementing masking.
- GDPR Article 32 encourages pseudonymization and technical measures appropriate to risk.
- Masking supports data minimization, limits breach impact, and strengthens audit defensibility.
- Axipro helps organisations align masking with ISO 27001 and GDPR through practical, risk-driven controls.

## Why the Question Itself Is Often Framed Incorrectly

The question “Is data masking mandatory?” assumes that compliance frameworks function by prescribing specific technical solutions. [ISO 27001](https://axipro.co/iso-27001-certification/) and GDPR do not work that way.

Both are built on outcome-based principles. They require organisations to protect information in proportion to risk. They do not dictate the exact tools that must be used.

As a result, the correct question is not whether data masking is mandatory in isolation. The correct question is whether an organisation can reasonably justify not using it in the presence of specific risks.

That distinction matters greatly during audits and regulatory reviews.

## Data Masking in Operational Reality

Data masking is not primarily a privacy control.

It is a risk containment mechanism.
Its role is to limit the exposure of real sensitive data when full fidelity is not required.

This typically applies to:

- Development and testing environments
- Analytics and reporting workflows
- Support and troubleshooting activities
- Training systems
- Third-party integrations

In these environments, encryption does not reduce exposure because data must be decrypted to be usable. Access controls also fall short because many users require access to the system but not to real personal data.

Data masking addresses this gap directly.

##### Secure your data confidently—book a compliance consultation with Axipro today.

[BOOK A CALL](https://calendly.com/ali-axipro/pioneer-compliance-framework)

## ISO 27001 Is Risk-Based, but Audits Are Evidence-Based

ISO 27001 requires organisations to operate an Information Security Management System grounded in risk assessment. This is well understood in theory. What matters is how it is evaluated during [audits](https://axipro.co/iso-27001-internal-audit/).

Auditors do not ask whether a control exists because it is listed in Annex A. They ask whether identified risks are adequately treated.

### Annex A 8.11 Data Masking

Annex A 8.11 explicitly references data masking as a control. This signals that ISO considers masking a legitimate and recognised mitigation for certain risk categories.

However, the standard does not say every organisation must implement it. Instead, organisations must decide whether the control is applicable based on risk.

In practice, Annex A 8.11 becomes relevant when:

- Sensitive data appears outside tightly controlled production environments
- Access is granted to personnel who do not require real identifiers
- Systems are used for purposes other than primary processing

When these conditions exist, auditors expect one of two things:

- Data masking is implemented
- A documented and credible alternative control exists

The absence of both results in nonconformities.

## What Auditors Actually Look For

During ISO 27001 audits, masking discussions typically arise indirectly. Auditors review:

- Data flow diagrams
- Environment separation
- Access rights
- Risk treatment plans

When auditors see production data replicated into non-production systems, they ask how exposure is controlled.

If the answer is encryption or role-based access alone, follow-up questions usually come next. Who can decrypt the data. Why real data is required. Whether test outcomes depend on real identifiers.

In many cases, organisations struggle to justify these decisions convincingly. This is where data masking becomes the simplest and strongest answer.

## GDPR Does Not Mandate Controls, but It Punishes Weak Justifications

GDPR is often misunderstood as a checklist regulation. It is not.
The regulation focuses on accountability. Organisations must demonstrate that they have taken appropriate measures to protect personal data.

### GDPR Article 32 Compliance in Practice

GDPR Article 32 requires technical and organisational measures appropriate to the risk. The regulation explicitly references pseudonymization and encryption as examples, not as exhaustive requirements.
The phrase appropriate to the risk is critical. It places the burden of justification on the organisation.
If personal data is processed in environments where identification is unnecessary, regulators expect steps to reduce exposure. Data masking is one of the most effective ways to meet that expectation.

## Pseudonymization vs Masking Is Not an Academic Debate

![data-masking-iso-27001-gdpr-audit-readiness](https://axipro.co/wp-content/uploads/2026/01/data-masking-iso-27001-gdpr-audit-readiness.png)

The discussion around pseudonymization vs masking often becomes overly theoretical. In enforcement actions and regulatory guidance, the focus is practical.
Regulators assess whether:

- Individuals can be identified from the data
- Additional information is required to re-identify individuals
- Access to re-identification mechanisms is restricted

When data masking irreversibly replaces identifiers and mapping keys are isolated or destroyed, it functions as pseudonymization under GDPR.
When masking is reversible without strong controls, it does not.
This distinction determines whether masked data meaningfully reduces risk under Article 32.

## Why Masking Carries Disproportionate Weight in GDPR Enforcement

GDPR enforcement consistently focuses on preventable exposure.
Many major fines involve:

- Excessive internal access
- Test environments with real customer data
- Third-party access to live datasets
- Poor separation between production and development

In these cases, regulators often conclude that the organisation failed to apply data minimization and security of processing principles.

Masking directly addresses both.

It ensures that even if access controls fail or credentials are misused, exposed data has limited impact on data subjects.

##### Secure your data—book a GDPR and ISO 27001 review today.

[BOOK A CALL](https://calendly.com/ali-axipro/pioneer-compliance-framework)

## Encryption Alone Does Not Satisfy Risk Reduction Expectations

Encryption protects data against external interception and theft. It does not reduce internal exposure.

Once data is decrypted inside an application, it is fully visible to:

- Developers
- Support staff
- Analysts
- Contractors
- Automated tools

[GDPR](https://axipro.co/gdpr-compliance/) and ISO 27001 both assess risk at this point of exposure. If individuals can see full personal data without a business need, encryption no longer mitigates that risk.

Masking does.

## When Masking Becomes the Only Defensible Option

In many environments, alternatives to masking exist only in theory.

Examples include:

- Completely synthetic datasets
- Perfectly segregated access models
- Fully anonymised analytics pipelines

In practice, these approaches are difficult to maintain at scale. Masking offers a controlled compromise that balances usability with protection.

This is why many organisations that initially avoid masking later adopt it after audit findings or regulatory feedback.

## Risk-Based Security Controls Demand Consistency

One of the most common compliance failures is inconsistency.

Some environments use masking. Others do not. Some fields are masked. Others remain exposed. Documentation does not match reality.

Both ISO 27001 and GDPR penalise inconsistency because it undermines risk treatment credibility.

- Effective masking programs define:
- Which data elements are sensitive
- Where masking is mandatory
- How reversibility is controlled
- How exceptions are approved

Without this structure, masking becomes symbolic rather than protective.

## How We Evaluate Data Masking at Axipro

At Axipro, we do not treat data masking as a default recommendation. We treat it as a risk decision.

We begin by analysing:
Data flows across environments

- Who accesses what data and why
- Whether real identifiers are operationally required
- What would happen if that data were exposed

We then map findings directly to:

- ISO 27001 risk treatment plans and Annex A 8.11
- GDPR Article 32 security obligations
- Audit and regulatory evidence requirements

Our role is to ensure that whatever decision is made, it is defensible under scrutiny.

## Why Organisations Get This Wrong

Most failures around data masking stem from misunderstanding accountability.

Common mistakes include:

- Assuming optional controls do not require justification
- Treating masking as cosmetic obfuscation
- Ignoring non-production environments in risk assessments
- Failing to revisit masking decisions as systems evolve

These gaps become visible during audits and investigations.

## Is Data Masking Mandatory in Practice?

From a strict legal standpoint, no universal mandate exists.

From an audit and enforcement standpoint, data masking is often expected wherever sensitive data exposure exceeds necessity.

When organisations cannot clearly justify why real data is required, the absence of masking becomes difficult to defend.

In this sense, data masking is not mandatory by rule, but frequently mandatory by reality.

## Final Perspective on Data Masking ISO 27001 GDPR Alignment

Modern compliance is judged by reasoning, not by slogans.

Data masking succeeds because it aligns cleanly with:

- Risk reduction principles
- Data minimization requirements
- Audit expectations
- Regulatory enforcement logic

When implemented deliberately and documented correctly, it strengthens both ISO 27001 and GDPR compliance. When ignored without justification, it raises questions that are hard to answer convincingly.

##### Strengthen your compliance and reduce risk—partner with Axipro.

[BOOK A CALL](https://calendly.com/ali-axipro/pioneer-compliance-framework)

## Work With Axipro on Risk-Driven Compliance Decisions

We help organisations move beyond generic compliance approaches. Our focus is on controls that stand up to audits, regulator scrutiny, and real-world threats.

Whether you are evaluating Annex A 8.11 applicability or strengthening GDPR Article 32 compliance, we work with you to ensure every control choice is grounded in risk, evidence, and accountability.

If you want compliance decisions that hold up under pressure, we are ready to support you.

## Conclusion

Data masking is not merely a technical preference—it is a critical control for organisations handling sensitive data. While ISO 27001 and GDPR do not mandate it universally, real-world audits and regulatory scrutiny demonstrate that masking is often essential to limit exposure, enforce data minimization, and mitigate breach impact. By implementing masking thoughtfully and documenting its role in risk treatment plans, organisations can satisfy Annex A 8.11 requirements, align with GDPR Article 32 expectations, and build a defensible compliance posture. At Axipro, we guide organisations in making risk-driven decisions about masking, ensuring that controls are practical, auditable, and effective in protecting both data subjects and business interests.

## Frequently Asked Questions (FAQ)

1. Is data masking mandatory under ISO 27001 or GDPR?

Data masking is not universally mandatory. ISO 27001 requires controls based on risk, and GDPR Article 32 focuses on appropriate measures for the risk level. However, in environments where sensitive data is exposed unnecessarily, masking is often expected and considered a best practice.

2. What is the difference between pseudonymization and data masking?

Pseudonymization transforms personal data so that it cannot be attributed to an individual without additional information. Data masking can serve as pseudonymization if masked data cannot be reversed without secure mapping keys, thereby reducing exposure in non-production environments.

3. When should an organisation implement data masking?

Masking should be implemented whenever sensitive or personal data is accessed outside production, such as in development, testing, analytics, or third-party integrations, to minimize risk and maintain audit defensibility.

4. Can encryption alone satisfy ISO 27001 and GDPR requirements?

Encryption protects data at rest and in transit but does not reduce exposure when decrypted internally. Masking complements encryption by limiting access to real identifiers, making it a critical risk-based control in many scenarios.

5. How does Axipro help organisations with data masking and compliance?

At Axipro, we evaluate your data flows, access requirements, and risk exposure. We then map masking and other technical controls to ISO 27001 Annex A 8.11 and GDPR Article 32, ensuring practical, auditable, and defensible compliance solutions.

### Ensure compliance and safeguard data—consult Axipro on ISO 27001 and GDPR today.

[BOOK A DEMO](https://calendly.com/ali-axipro/pioneer-compliance-framework)

### More To Explore

Axipro Author

![Picture of Thatware](https://secure.gravatar.com/avatar/?s=300&d=mm&r=g)

### Thatware

- January 6, 2026
- [All Blog](https://axipro.co/category/blog/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [Vanta](https://axipro.co/category/vanta/)

- October 3, 2026

#### [Best Vanta Deployment Service (2026): 7 Partners Ranked](https://axipro.co/best-vanta-deployment-service/)

Vanta can tell you a control is failing within the hour. It cannot rewrite your access review process, decide which systems belong in audit scope, or explain to a CPA why a test that shows red is actually fine. That work falls to people, and choosing the right ones is the difference between a 6-week path to audit readiness and a 6-month slog that ends with your Vanta subscription renewing before you have a report. This guide ranks the 7 best Vanta deployment services for 2026, explains what each one is good at, and covers what most comparison pages skip: how long this really takes, what it costs, and how to spot a partner who’ll hand you a half-configured platform and disappear. What Is a Vanta Deployment Service? A Vanta deployment service is a hands-on engagement where a specialist firm sets up, configures, and operationalizes Vanta so your company reaches audit readiness for one or more compliance frameworks. Vanta itself is a compliance automation and trust management platform: it connects to your cloud, identity provider, code repositories, HR system, and endpoints, then runs automated tests and maps the evidence to frameworks such as SOC 2, ISO 27001, HIPAA, and GDPR. The platform automates evidence collection and continuous monitoring. It doesn’t put controls in place for you. A deployment partner handles the judgment work around the tool: scoping, gap analysis, control mapping, policy writing, risk assessment, remediation of failing tests, and coordination with the audit firm. The best partners also stay on after the audit, because a Vanta instance nobody owns degrades fast. Worth Knowing: Vanta is a software vendor, not an auditor. Vanta is a software vendor, not an auditor. Your SOC 2 report still comes from a licensed CPA firm under AICPA attestation standards, and your ISO 27001 certificate comes from an accredited certification body. A deployment partner sits between the platform and the auditor. 1. Axipro Best for: SaaS and technology companies that want Vanta deployed, controls implemented, and the audit delivered by one accountable team, fast. Axipro is an authorized Vanta partner and a Drata Elite Partner, so its team works inside both leading compliance automation platforms every day. Founded in 2023, it has served 200+ clients from offices in the US, UK, and Bahrain, with a 100% audit success rate across 200+ certified clients. What puts Axipro first is scope. Most Vanta partners configure the platform and leave control implementation to you. Axipro’s Achievement Plan covers the whole path: kick-off and Vanta setup, gap analysis, a full policy and procedure suite, risk assessment and treatment, control implementation, vulnerability scanning, an internal audit, and external audit facilitation with an independent auditor. Clients get a dedicated infosec team over Slack, and the Achievement Plan comes with guaranteed certification. The other reason is speed. Axipro typically reaches SOC 2 readiness in around four weeks and ISO 27001 certification readiness in as little as six. It supports 20+ frameworks, including SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CMMC, ISO 42001, and the EU AI Act, plus Gulf frameworks such as NCA ECC and SAMA CSF that most US-only partners cannot cover. Teams that want to test the relationship first can start with the free 30-day Compliance Accelerator Plan, which includes Vanta setup, gap analysis, and policy documentation, and continue into ongoing vCISO and continuous monitoring through the Trust Assurance Plan after certification. Watch for: Axipro is built for companies that want the work done for them. Teams that want a light-touch coaching engagement and plan to run the program in-house will use only part of what it offers. 2. Control and Function Best for: US SaaS companies of roughly 10 to 60 people that want SOC 2 and ISO 27001 run as one fixed-price project. Control and Function is a Denver-based consultancy built around fixed-scope, fixed-price readiness for small SaaS teams that have no compliance department. Its sweet spot is the dual-framework engagement: building SOC 2 and ISO 27001 from one shared control set rather than running two projects back to back. It also covers HIPAA for healthtech and maps ed-tech requirements such as FERPA and HECVAT. The firm is platform-neutral, so it works inside Vanta rather than reselling it, and it is explicit about handing off cleanly to an independent auditor. It’s also one of the few firms here that publishes prices, with readiness coaching starting around $8,000 and full readiness around $15,000. Watch for: The framework range is narrower than larger partners. Companies that need PCI DSS, CMMC, or international frameworks will need a second provider. 3. Neutral Partners Best for: Growing companies that need managed GRC across SOC 2, ISO 27001, CMMC, and FedRAMP without hiring an internal compliance team. Neutral Partners, based in Miami, runs a managed GRC model. It builds and documents the compliance program, tests it through internal audits, and then hands off to the relevant independent assessor: a CPA firm for SOC 2, a certification body for ISO 27001, or a C3PAO for CMMC. It never issues the certificate itself, which keeps the independence question simple. Its framework coverage leans toward regulated and government-adjacent work, including CMMC, FedRAMP, PCI DSS, HIPAA, and HITRUST. That makes it worth a look for defense suppliers and companies selling to the public sector. Watch for: Vanta isn’t its main focus. Ask for recent Vanta deployment examples in your framework before signing. 4. Kobalt.io Best for: Small and mid-sized businesses that want Vanta plus managed security operations. Canada-based Kobalt.io markets itself as one of Vanta’s leading global service partners. Its Vanta practice covers policy and control development inside the platform, custom control mapping where standard controls do not fit, and an applicability review of Vanta’s tests. The broader appeal is its managed security services, which suit companies that want compliance and security operations from the same provider. 5. AuditPeak Best for: Startups that want a readiness and audit-preparation partner focused narrowly on SOC 2. AuditPeak focuses on SOC 2 audit readiness for early-stage companies working in

[Read more](https://axipro.co/best-vanta-deployment-service/)

- [ISO-27001](https://axipro.co/category/iso-27001-2/)

- September 29, 2026

#### [ISO 27001 Consultant vs. Software: Which Is Faster?](https://axipro.co/iso-27001-consultant-vs-software/)

Compliance software collects the evidence. A consultant builds the system that evidence is meant to prove. That’s the real difference in the ISO 27001 consultant vs software decision, and most teams only figure it out after they’ve bought one and realized they still need the other. Below, we compare what each route covers, where it breaks down, and what it costs you in time, money, and your team’s hours. Short version: software on its own works for a small group of companies. For most SaaS and tech scale-ups trying to get an enterprise deal over the line, consultant-led implementation on a compliance platform is the faster and safer path to a certificate. Quick Answer: Consultant, Software, or Both? Software-only works if you already have an in-house security lead who’s taken a company through ISO/IEC 27001 before and has the time to own the project. Consultant-only still makes sense if you run mostly on-premise or legacy systems that platforms barely integrate with. For everyone else, which means most cloud-native companies under a few hundred people, a hybrid works best: a platform to handle evidence and monitoring, and a consultant to build the management system and stand behind it in front of an auditor. Here’s why. What an ISO 27001 Consultant Handles ISO/IEC 27001:2022 is a management system standard. Clauses 4 to 10 cover how you run information security, and Annex A lists 93 controls you pick from based on risk. Almost none of it is box-ticking. Most of it comes down to judgment calls about your business, and that’s what you’re paying a consultant for. Scoping, Gap Analysis and Risk Assessment Scope is the first decision you make, and the most expensive one to get wrong. Go too wide and you’ll spend months on controls for systems no customer asks about. Go too narrow and the certificate won’t get through the procurement review it was supposed to pass. A consultant scopes around the deals you’re trying to close, runs a gap analysis, and builds a risk assessment based on your real assets and threats. That’s the document auditors dig into hardest. ISMS Documentation and Policy Writing The standard asks for a specific set of documents: the ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability, risk treatment plan, and evidence of competence, monitoring, internal audit, and management review. A consultant writes these around how your company works day to day, instead of how a template imagines it works. Auditors check whether you follow your own procedures, so a mismatch shows up fast. Internal Audit and Certification Audit Support You need an internal audit before certification, and Clause 9.2 says the auditor has to be objective and impartial. In a small company, the people who built the ISMS can’t credibly audit it, so most teams outsource it through ISO 27001 internal audit services. A good consultant also gets your team ready for the Stage 1 and Stage 2 audits, joins the conversations that matter, and handles corrective actions if the auditor raises nonconformities. What ISO 27001 Compliance Software Handles Compliance automation platforms, often called GRC platforms, have changed how cloud-native companies get certified. They’re very good at the repetitive, evidence-heavy side of the work. Automated Evidence Collection and Continuous Control Monitoring The platform plugs into your cloud provider, identity provider, code repos, HR system, and device management tools, then pulls evidence on its own. It’ll flag an unencrypted storage bucket, an ex-employee who still has access, or a laptop without disk encryption. For technical controls, that saves weeks of screenshots and spreadsheet tracking. Policy Templates and Annex A Control Mapping Most platforms come with a policy library and map each control to the ISO 27001 clauses and Annex A. You get a starting point and a clear view of which controls have evidence and which don’t. Auditor Access and Ongoing Compliance Tracking Auditors can log in and review evidence themselves, which cuts down fieldwork. After you’re certified, dashboards show when controls slip between surveillance audits, so you aren’t rebuilding evidence from scratch every year. Where Each Approach Falls Short Neither route covers everything by itself. The good news is that the ways each one fails are predictable, so you can plan around them. Limits of Compliance Automation Platforms A platform can tell you a control is failing. It can’t decide your scope, run your risk assessment, write a policy that matches your operations, convince your CTO to change the offboarding process, or explain to an auditor why you excluded a control from your Statement of Applicability. Templates can also make you feel further along than you are. A dashboard at 90% can hide an ISMS that won’t survive Stage 1, because the missing 10% is the management system itself. Insider Note: The Stage 1 problem we see most on software-only projects is a risk assessment copied straight from the platform’s default risk library. The risks are generic, the scores are almost identical, and nothing ties back to the company’s own assets. Auditors notice within minutes, and it weakens the Statement of Applicability that’s built on it. The other problem is ownership. Software assumes someone inside the company will drive the project. At most startups that’s a CTO or ops lead who already has a full-time job, and the subscription renews whether the work gets done or not. Limits of a Consultant-Only Approach A consultant working without automation spends billable days on things a platform does for free, like chasing screenshots, updating evidence trackers, and collecting the same proof again before every surveillance audit. You pay more and wait longer. You also end up with a program that’s only accurate on the day it’s handed over. Once the engagement ends, the evidence goes stale and year-two surveillance turns into a scramble. ISO 27001 Consultant vs Software: Side-by-Side Comparison Factor Consultant only Software only Hybrid (consultant + platform) Time to audit readiness 3 to 6+ months Highly variable; depends on internal expertise As little as 6 weeks for well-scoped

[Read more](https://axipro.co/iso-27001-consultant-vs-software/)

- [AI Security](https://axipro.co/category/ai-security/)

- September 27, 2026

#### [Uzbekistan AI Regulation 2026: Law ZRU-1115 Explained](https://axipro.co/uzbekistan-ai-regulation/)

Uzbekistan regulates artificial intelligence through two documents. The first is Law ZRU-1115, signed on 21 January 2026. It amends existing legislation to define AI, stops anyone from basing decisions about people’s rights on AI output alone, and fines companies that process personal data unlawfully with AI. The second is the set of Ethical Rules approved by Order No. 3787, in force since 17 June 2026, which spell out what developers, implementers, and users actually have to do. Uzbekistan hasn’t passed a standalone AI act, and its rules don’t sort systems into risk tiers or require conformity assessments. The framework is short and blunt, and it’s already enforceable. Below we walk through what each document requires, who it applies to, how it stacks up against the EU AI Act, and what a company using AI in Uzbekistan should do next. Uzbekistan AI Regulation at a Glance (TL;DR) Instrument Date What it does Who it binds Law ZRU-1115 Signed 21 January 2026 Defines AI in law, sets general rules for AI-built information resources and systems, bans legally significant decisions based only on AI, adds fines for unlawful AI processing of personal data State bodies, organizations, website owners, anyone processing personal data with AI Order No. 3787 (Ethical Rules) Registered 14 March 2026, in force 17 June 2026 Sets eight mandatory ethical principles and lists rights and obligations for developers, implementers, and users Individuals and companies developing, implementing, or using AI in Uzbekistan Law No. 1125 (Personal Data amendments) Adopted 26 March 2026 Limits data localization to biometric, genetic, and local telecom user data, and allows cross-border transfers under conditions Personal data operators, including AI providers AI Strategy until 2030 (RP-358) 14 October 2024 Sets national targets for AI adoption, infrastructure, and skills Government bodies What Is Law ZRU-1115? The law’s official title is a mouthful: “On making additions and changes to certain legislative acts of the Republic of Uzbekistan in connection with the regulation of relations arising from the use of artificial intelligence.” Put simply, it’s an amending law. Instead of creating a new AI code, it writes AI into laws that were already on the books. When It Was Signed and When It Took Effect The Legislative Chamber of the Oliy Majlis adopted the bill on 12 August 2025, and the Senate approved it on 1 November 2025. President Shavkat Mirziyoyev signed it on 21 January 2026. You can read the official text in Lex.uz, Uzbekistan’s national legislation database. The law set out the principles and the penalties. The day-to-day detail arrived later with the Ethical Rules, which came into force on 17 June 2026. For compliance planning, treat mid-June 2026 as the point when the whole framework started applying. Why Uzbekistan Amended Existing Laws Instead of Passing a Standalone AI Act Uzbekistan wants more AI, not less. Its national strategy sets numeric targets for adoption, investment, and local computing capacity, and a heavy EU-style act would have worked against them. So lawmakers kept it light. They defined AI, drew two hard lines (human control over decisions that affect people’s rights, and protection of personal data), and left the Ministry of Digital Technologies to fill in the rest through secondary rules. Businesses get less legal certainty, and the government gets to move faster. Which Laws ZRU-1115 Changes For businesses, two amendments matter most. The Law “On Informatization” (ZRU-560-II, 2003) now contains a legal definition of AI, a new article on using AI in information resources and systems, duties for website owners, and updated powers for the ministry in charge. The Code on Administrative Liability now includes an offense for processing and spreading personal data unlawfully using AI. The Legal Definition of Artificial Intelligence in Uzbekistan Under the amended Law “On Informatization,” AI is a set of technological solutions that imitate human cognitive functions, including learning on their own and solving problems, and that produce results on specific tasks comparable to what a person could do. That’s deliberately broad. It covers generative AI, machine learning classifiers, recommendation engines, and most agentic systems. The Ethical Rules add a narrower term, the AI system: software built on AI that can find, collect, store, analyze, process, evaluate, and use data, and make decisions on its own based on that data. If your product makes a decision from data, or shapes one, assume it counts. Key Rules Introduced by Law ZRU-1115 General Principles for Using AI in Information Systems and Resources The new article in the Law “On Informatization” starts from harm. Information resources created with AI, and information systems running on AI, must not harm people’s life, health, freedom, honor, or dignity, or violate their other inalienable rights. The standard is short and open-ended. It gives regulators something to enforce against without saying in advance what counts as harm. Principle-based rules like this deserve to be taken seriously precisely because the edges are undefined. Human Oversight: No Decisions on Rights and Freedoms Based Solely on AI Most coverage leads with this provision, and it’s easy to see why. When someone makes a legally significant decision that affects human rights and freedoms, they can’t rely only on conclusions produced by AI systems or AI-built information resources. AI can feed into the decision, but a person has to make it. That applies to loan denials, benefit eligibility, hiring rejections, licensing outcomes, and disciplinary action. In each case, someone needs to look at the AI output and own the final call. Insider Note: In AI governance engagements, teams rarely struggle to show that a review step exists. What they struggle to show is that the reviewer could disagree, and sometimes did. If a human clicks “approve” on every AI recommendation and nobody ever records an override, auditors will see automation with a signature on top. Build the override path and log when people use it, starting on day one. Powers of the Authorized State Body (Ministry of Digital Technologies) ZRU-1115 makes the Ministry of Digital Technologies the authorized state body for AI. Among its new jobs, it’s

[Read more](https://axipro.co/uzbekistan-ai-regulation/)

WhatsApp us