If you can, make sure that only people you allow may upload (for instance, by requiring authentication via the server)
Make sure the file system doesn't fill up. You could for instance disable uploading if there's less than some amount of space on the disk (you probably should set this in a BEGIN block).
Disabling scripts in the data directory is not enough, if that dir is directly accessible via the server - people can upload php, asp, jsp pages (even server config files), or malicious client side scripts.
Watch out for malicious file names!
Use taint mode! (perl -wT) - in my view this should be mandatory for any CGI script.
As you are running on windows, use binmode on the data file handles.