Ukraine
SubstantialLaw on Personal Data Protection No. 2297-VI (2010)
Authority: Ukrainian Parliament Commissioner for Human Rights | Enforcement: partial | Enacted: January 2011
Overview
Ukraine's data protection law was enacted in 2010 as part of EU approximation efforts. The law is modelled on the EU Data Protection Directive. Full alignment with GDPR is a goal under the EU-Ukraine Association Agreement. Enforcement has been limited.
14-Topic Coverage
Data Protection Authority
Partially AddressedCommissioner for Human Rights has data protection oversight. No dedicated DP authority.
Consent Requirements
Fully AddressedConsent required for processing. Must be voluntary and informed.
Data Subject Rights
Fully AddressedRights to access, correction, and objection.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with consent.
Breach Notification
Partially AddressedNo explicit statutory requirement. Reform efforts ongoing.
DPO Requirements
Partially AddressedMust register personal data databases. No formal DPO role.
Children's Data
Partially AddressedGeneral provisions apply.
Penalties & Enforcement
Partially AddressedLimited penalties. GDPR alignment reforms in progress.
Sector-Specific Rules
Fully AddressedNBU financial data rules, health data regulations, telecom provisions.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific provisions.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedLaw applies to government with national security exemptions.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Ukraine's regulations.
Book a Consultation