UkraineDraft Law No. 8153, personal data breach notification
Draft Law No. 8153, 72 hour breach notification to the National Commission
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
What it requires
- Notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it.
- Include in that notification the nature of the breach, the number of affected individuals, the data types involved, the likely consequences, and the remedial measures taken.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What this law does
Draft Law No. 8153 would introduce a mandatory personal data breach notification duty the current 2010 law does not state at all. A controller would notify the new supervisory authority within 72 hours of becoming aware of a breach affecting personal data security, and the notification would cover the nature of the breach, the number of affected individuals, the data types involved, the likely consequences, and the remedial measures taken.
The source describes this as a significant change from the current law, which it says contains no mandatory breach notification obligation. The draft has passed only a first reading and remained in second reading preparation as of the most recent source located, dated May 2026.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .