UkraineDraft Law No. 8153, cross border transfer reform
Draft Law No. 8153, GDPR Chapter V style cross border transfer framework
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
What it requires
- Before transferring personal data of a person in Ukraine outside the country, rely on an adequacy assessment, standard contractual clauses, binding corporate rules, or a derogation for specific circumstances, the General Data Protection Regulation (GDPR) Chapter V style framework the draft is expected to introduce.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What this law does
Draft Law No. 8153 is expected to introduce a more detailed cross border transfer framework modeled on General Data Protection Regulation (GDPR) Chapter V, formalizing adequacy assessments, standard contractual clauses, binding corporate rules, and derogations for specific circumstances, in place of the current 2010 law's Convention 108 and adequacy by default treatment, recorded on the sibling instrument ua-zakon-ukrainy-pro-zakhyst-personalnykh-danykh in this file.
The source states this as the reform's expected direction rather than as first reading text already adopted, and gives no article number for it. The draft has passed only a first reading and remained in second reading preparation as of the most recent source located, dated May 2026.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .