UA Cloud Services Law
Law of Ukraine on Cloud Services — Verkhovna Rada of Ukraine / Cabinet of Ministers / Ministry of Digital Transformation / National Bank of Ukraine
Also known as: ЗУ про хмарні послуги, Закон про хмарні послуги, хмарні послуги, Закон № 2075-IX
Official site Official change log Subscribe to UA Cloud Services Law (RSS)
At a glance
- Current version
- Law No. 2075-IX (edition of 28 June 2024, Law No. 3783-IX)
- Published 28 June 2024. source
- Status
- In force
- Next deadline
- in 135 days
- Amendments by Law No. 4888-IX on public procurement to Articles 11 and 12 (how public users buy cloud services) take effect source
- Who must comply
- Providers of cloud and data centre services, with particular rules for public bodies and state enterprises that use cloud services. source
- How it is assessed
- To serve public users or critical infrastructure, a provider applies to the regulator's list with documents including a conformity document from a conformity assessment body. source
- Authority
- A law of the Verkhovna Rada. A communications services regulator keeps the list of providers eligible to serve public users and critical infrastructure (Articles 8 and 9). source
- Enforced by
- The regulator can refuse listing, and providers must remedy any non-compliance with its requirements. source
- Last change
Ukrainian law on cloud services (No. 2075-IX). It covers all relations in cloud services, adds particular rules for public bodies and state enterprises that use them, and binds every cloud and data centre service provider to its security requirements for critical infrastructure and state information resources.
Recent changes
-
Info
Law on provision of cloud services to public sector entities and critical infrastructure operators
The bill proposes amendments to Ukrainian legislation regarding the provision of cloud services and data center services. The changes aim to develop digital infrastructure for the …
-
Info
Bill specifies regulation of cloud services and data center operations
Parliament considers a bill to amend Ukraine's legislation on regulating cloud services and data center operations. The document establishes new requirements and rules for providers of …
That is the last 90 days. Sign in to read further back.
Key dates
Add these dates to your calendarAmendments
-
Law No. 2075-IX (edition of 28 June 2024, Law No. 3783-IX) AmendmentCurrent text
Law No. 3783-IX restated paragraphs two and three of Article 11(3): during martial law the Ministry of Defence and Armed Forces may process defence information, including classified data, in cloud resources abroad. source
-
Edition of 4 April 2024 (Law No. 3549-IX) Amendment
Law No. 3549-IX of 16 January 2024 restated Article 11(3) on use of cloud services by public users. source
-
Edition of 27 December 2023 (Law No. 3343-IX) Amendment
Law No. 3343-IX of 23 August 2023 on improving state governance and regulation of cloud services introduced the communications services regulator and the term communications services. source
-
Law No. 2075-IX (as adopted) Major version
Adopted on 17 February 2022; it entered into force on 16 September 2022, six months after publication (Article 16(1)). source
Who it applies to
Every cloud and data centre provider has security duties; providers serving public users or critical infrastructure must also be on the regulator's list.
- Scope
- The law governs relations arising in the provision of cloud services and sets particular rules for their use by public authorities, local self-government, military formations and state enterprises, institutions and organisations (Article 1). source
- Public users
- Public users choose a provider from the list using public procurement procedures; services to them must comply with personal data, information protection and cybersecurity legislation (Article 11). source
- Restricted locations
- Providers must not use technical means located on temporarily occupied territory, in an aggressor state, or owned by sanctioned states or persons (Article 8(1)). source
How compliance is assessed
To serve public users or critical infrastructure, a provider applies to the regulator's list with documents including a conformity document from a conformity assessment body.
- Listing application
- The application includes information protection documents, personal data policies, proof of rights to the means used and a conformity document issued by a conformity assessment body (Article 8(3)). source
- Decision in 15 working days
- The regulator decides on listing within 15 working days and publishes the decision; changes must be filed within five working days (Article 9). source
- Incident reporting
- Providers report, without undue delay, any incident with a significant negative impact on the service to the regulator and CERT-UA (Article 8(1)). source
Enforcement and penalties
The regulator can refuse listing, and providers must remedy any non-compliance with its requirements.
- Refusal of listing
- The regulator refuses listing for incomplete documents or unreliable information in the application (Article 9(3)). source
- Remedying non-compliance
- Providers must give the cyber protection authority information needed to assess security, including their security policy, and remedy any non-compliance with the regulator's requirements (Article 8(1)). source
Documents
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 11 September 2026. Subscribe to UA Cloud Services Law (RSS)