Duty LXD-1034
Processes personal data, in Ukraine
Each law's tag says when it binds: since in force proposed proposed
Law of Ukraine On the Protection of Personal Data, Article 2, depersonalization of personal datasince 1 line
Law of Ukraine No. 2297-VI, art. 2 (depersonalization and processing) · Read the law's page
- Treat depersonalizing personal data of a person in Ukraine, which Article 2 defines as removing information that allows the person to be identified directly or indirectly, as processing under Law No. 2297-VI, and apply the Law's requirements for processing to it, including the grounds listed in Article 11.
Law of Ukraine On the Protection of Personal Datasince 6 lines
Zakon Ukrainy Pro zakhyst personalnykh danykh No. 2297-VI, in force (Law of Ukraine No. 2297-VI) · Read the law's page
- Establish a lawful basis before processing personal data of a person in Ukraine under Law No. 2297-VI.
- Tell a data subject in Ukraine who the controller is, what personal data was collected, the data subject's rights under the Law, the purpose of collection and who receives the data, at the moment of collection where the data is collected from the data subject and otherwise within thirty working days from collection, except where a law provides otherwise, under Article 12(2) of Law No. 2297-VI.
- Do not process biometric or genetic data of a person in Ukraine unless a case listed in Article 7(2) of Law No. 2297-VI applies, such as the data subject's unambiguous consent to that processing.
- Notify the Ombudsperson of processing of biometric data, genetic data, health data, or another category the Ombudsperson lists as posing a special risk, within thirty working days from the start of that processing, under Article 9 of Law No. 2297-VI; this law does not define biometric data anywhere, including in its Article 2 definitions.
- Transfer personal data of a person in Ukraine to a foreign party only where the receiving state ensures adequate protection, which the law deems met by European Economic Area states, Convention 108 signatories and states whose capital-market regulators signed the IOSCO Multilateral Memorandum of Understanding.
- Expect a person in Ukraine to be able to complain about the processing of their personal data to the Ombudsperson or to a court under Article 8 of Law No. 2297-VI.
Draft Law No. 8153, data subject rightsproposed3 lines
Draft Law No. 8153 (data subject rights: erasure, restriction, portability) · Read the law's page
- Give a data subject in Ukraine the right to erasure of their personal data.
- Give a data subject in Ukraine the right to restriction of processing of their personal data.
- Give a data subject in Ukraine the right to receive their personal data in a portable format.
Draft Law No. 8153, personal data breach notificationproposed2 lines
Draft Law No. 8153, 72 hour breach notification to the National Commission · Read the law's page
- Notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it.
- Include in that notification the nature of the breach, the number of affected individuals, the data types involved, the likely consequences, and the remedial measures taken.
Draft Law No. 8153, cross border transfer reformproposed1 line
Draft Law No. 8153, GDPR Chapter V style cross border transfer framework · Read the law's page
- Before transferring personal data of a person in Ukraine to a third country or an international organization, use one of the transfer routes the draft provides: transfer to a country recognized as adequate under Article 45, transfer subject to appropriate safeguards under Article 46, or transfer under binding corporate rules under Article 47.
Draft Law No. 8153, National Commission and penaltiesproposed1 line
Draft Law No. 8153, National Commission on Personal Data Protection and penalty structure · Read the law's page
- Treat the National Commission on Personal Data Protection and Access to Public Information, which the draft establishes to replace the Ombudsperson, as the authority that supervises your processing of personal data of a person in Ukraine.
Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform)proposed4 lines
Draft Law of Ukraine No. 8153, first reading passed (processing principles, legal bases, data protection by design, DPO, art. 39 DPIA) · Read the law's page
- Process personal data of a person in Ukraine only on a ground listed in Article 5 of the draft, which includes the legitimate interests of the controller or of a third party under Article 5(1)(6), and apply the processing principles in Article 4 of the draft.
- Implement data protection by design and by default under Article 29 of the draft.
- Designate a data protection officer where the core activities of the controller or processor consist of or relate to processing personal data of a person in Ukraine on a large scale, which reaches biometric and genetic data, under Article 41(1)(3) of the draft.
- Carry out the data protection impact assessment that Article 39 of the draft provides for, and consult the supervisory authority under Article 40 where it indicates a high risk for data subjects.