Law: The Law of 1 June 2010 No. 2297-VI on Personal Data Protection (as amended) (only available in Ukrainian here) ('the Personal Data Protection Law')

Regulator: The Ukraine Parliamentary Commissioner for Human Rights ('the Commissioner')

Summary: Data protection in Ukraine is primarily governed by the Law of June 1, 2010 No. 2297-VI on Personal Data Protection (as amended) (the Personal Data Protection Law) which entered into force on January 1, 2011. The Constitution of Ukraine and additional legislation issued by the Ukraine Parliamentary Commissioner for Human Rights (the Commissioner) also comprise the national data protection framework.

The Personal Data Protection Law provides for data subject rights, obligations for data controllers, and general requirements for the processing of personal information, while the Commissioner's legislative acts address topics such as special risk data and supervision processes. In addition, the Commissioner often conducts audits to ensure compliance with data protection laws and has the power to issue administrative protocols and impose administrative liability to be enforced in court in case of non-compliance.

On October 25, 2022, a draft law on personal data protection was submitted to the Parliament of Ukraine following the rejection of the previous data protection bill from June 2021. The draft law would align national data protection legislation with the GDPR.

In terms of data transfers, the Law recognises the members of the EEA, as well as all other countries who are signatories of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (the Convention 108), as providing an adequate level of personal data protection. However, the EU has not adopted an adequacy decision for Ukraine.

Ukraine ratified Convention 108 in July 2010.