UA Typical Personal Data Processing Procedure

No changes recorded yet — we are watching, and nothing has been published.

1. 2014-01-08 The Commissioner approves the Typical Procedure for Processing Personal Data (Order No. 1/02-14)

1. 2018-09-19
   Order No. 1/02-14 (edition of 19 September 2018, Order No. 55/02-18) AmendmentCurrent text

   Order No. 55/02-18 amended the Commissioner's inspection procedure, restating point 2.2 on who may carry out on-site inspections. source

2. 2015-06-26
   Edition of 26 June 2015 (Order No. 6/02-15) Amendment

   Order No. 6/02-15 restated point 2.2 of the inspection procedure. source

3. 2014-01-08
   Order No. 1/02-14 (as adopted) Major version

   The Commissioner approved the Typical Procedure for Processing Personal Data, the inspection procedure and the procedure for notifying high-risk processing. source

The Typical Procedure binds every controller and processor; the notification procedure applies to controllers carrying out high-risk processing.

Typical Procedure

Sets general requirements for processing and protecting personal data processed wholly or partly by automated means or held in filing systems; controllers and processors set their own procedures accordingly (points 1.1 and 1.2). source

High-risk processing

Notification covers processing of data on racial, ethnic or national origin; political, religious or ideological beliefs; membership of parties, trade unions, religious or ideological organisations; health; sex life; biometric and genetic data; administrative or criminal liability; pre-trial investigation and operational-search measures; violence against a person; and a person's location or movements (notification procedure, point 1.2). source

Inspected entities

Individuals, individual entrepreneurs, enterprises, institutions and organisations of all forms of ownership, and public and local authorities that are controllers or processors (inspection procedure, point 1.1). source

Controllers define and document their own processing and security measures, keep access and operation records, and assign a responsible person or unit.

Processing documentation

The controller defines the purpose and grounds, data subject categories, the data set and the processing procedure, including storage terms, transfers and protection measures (point 2.1). source

Security measures

Controllers and processors take organisational and technical measures at every stage of processing, keep a record of staff with access, and log operations on personal data (points 3.1, 3.5 and 3.11). source

Breaches recorded

Violations of the processing and protection of personal data must be documented by the responsible person or unit (point 3.20). source

The Commissioner inspects compliance, at most once a year for scheduled inspections, records findings in an inspection act and issues an order to remedy violations.

Inspections

The Commissioner carries out scheduled and unscheduled, on-site and off-site inspections; scheduled inspections of the same entity take place no more than once a year (points 2.1 and 3.3). source

Act and order

Findings are recorded in an inspection act; where violations are found, an order to remedy them is issued on its basis (points 5.1 and 5.10). source

1. Law text Наказ Уповноваженого ВРУ з прав людини від 08.01.2014 № 1/02-14 «Про затвердження документів у сфері захисту персональних даних»
2. Law text Закон України «Про захист персональних даних»

1. UA Personal Data Law

   The Law on the Protection of Personal Data, which this order implements and which sets the Commissioner's powers.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 24 September 2026. Subscribe to UA Typical Personal Data Processing Procedure (RSS)