UA Personal Data Law

Nothing changed in the last 90 days. Sign in to read further back.

1. 2024-11-20 The Verkhovna Rada adopts draft law No. 8153, a new Law on Personal Data Protection, at first reading; as of October 2026 it is being prepared for second reading
2. 2011-01-01 The Law on the Protection of Personal Data enters into force

1. 2025-06-14
   Law No. 2297-VI (edition of 14 June 2025, Law No. 4240-IX) AmendmentCurrent text

   Law No. 4240-IX of 12 February 2025 amended Article 16(1) on third-party access, for data used in verifying state payments and in state financial control offence proceedings. source

2. 2025-01-18
   Edition of 18 January 2025 (Law No. 3980-IX) Amendment

   Law No. 3980-IX of 19 September 2024 on the State Agrarian Register amended the list of parties to personal data relations (Article 4(1)). source

3. 2025-01-01
   Edition of 1 January 2025 (Law No. 4170-IX) Amendment

   Law No. 4170-IX of 19 December 2024 on reforming medical and social expert assessment added processing grounds for special categories of data (Article 7(2), point 6-2). source

4. 2024-04-27
   Edition of 27 April 2024 (Law No. 3585-IX) Amendment

   Law No. 3585-IX of 22 February 2024 on regulation of capital markets amended Articles 12 and 29. source

5. 2014-01-01
   Edition of 1 January 2014 (Law No. 383-VII) Amendment

   Law No. 383-VII of 3 July 2013 restated the supervision regime: the Parliament Commissioner for Human Rights became the supervisory authority. source

   More

   • Articles 9 (notification of high-risk processing), 22 (control), 23 (Commissioner's powers) and 24 (security of personal data) are in the wording of this law.

The law covers automated processing and filing-system processing by any organisation, public body or individual entrepreneur acting as controller or processor.

Material scope

Processing carried out wholly or partly by automated means, and non-automated processing of personal data contained in or intended for a filing system (Article 1). source

Controllers and processors

Enterprises, institutions and organisations of all forms of ownership, public authorities, local self-government bodies and individual entrepreneurs; a controller may entrust processing to a processor under a written contract (Article 4(2) and (4)). source

Martial law transfers

During martial law and six months after it ends, data needed for telemedicine may be transferred abroad under the law of the provider's country, as an exception to Article 29(3) (Article 30(2)). source

Controllers protect data themselves, notify the Commissioner of high-risk processing within 30 working days and appoint a person or unit for data protection where notification applies.

High-risk processing notice

A controller notifies the Commissioner of processing that poses a particular risk to data subjects within thirty working days of starting it, and of each change within ten working days (Article 9). source

Security duty

Controllers, processors and third parties must protect data against accidental loss or destruction and unlawful processing, including unlawful access (Article 24(1)). source

Data protection unit

Public bodies and controllers or processors whose processing is notifiable set up a unit or appoint a responsible person for data protection, reported to the Commissioner (Article 24(2)). source

The Commissioner inspects and issues binding orders, then refers administrative cases to court; fines are set in tax-free minimum incomes of citizens by the Code of Administrative Offences.

Commissioner's powers

The Commissioner carries out scheduled and unscheduled, on-site and off-site inspections, issues binding orders to prevent or remedy violations, and draws up administrative offence reports sent to court (Article 23). source

1. Law text Закон України «Про захист персональних даних» № 2297-VI
2. Law text Кодекс України про адміністративні правопорушення (Articles 188-39, 188-40)
3. Guidance Draft Law No. 8153 «Про захист персональних даних» (bill card)
4. Law text Наказ Уповноваженого № 1/02-14 — Typical procedure for processing personal data

1. UA Typical Personal Data Processing Procedure

   The Commissioner's order setting the typical processing procedure, the inspection procedure and the high-risk notification procedure under this law.

2. GDPR

   The EU regulation, with turnover-based fines imposed by data protection authorities rather than court fines set in tax-free minimum incomes.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 14 September 2026. Subscribe to UA Personal Data Law (RSS)