UkraineDraft Law No. 8153, National Commission and penalties
Draft Law No. 8153, National Commission on Personal Data Protection and penalty structure
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
What it requires
- Treat the National Commission on Personal Data Protection and Access to Public Information, which the draft establishes to replace the Ombudsperson, as the authority that supervises your processing of personal data of a person in Ukraine.
These lines are LexLint's reading of the law's text.
If you get it wrong
Penalty structure
Draft Law No. 8153 proposes a tiered fine scheme rather than one ceiling: an individual faces a fine from UAH 10,000 to UAH 20 million; a legal entity at the lower tier faces UAH 30,000 or 0.05 percent to 5 percent of annual turnover, not less than UAH 300,000; and a legal entity at the upper tier, for the most serious violations, faces up to UAH 150 million or 8 percent of the prior year's annual turnover, whichever is higher, the ceiling recorded here. A repeat violation within one year adds a penalty of 200 percent of the initial fine. This is proposed legislation that has passed only a first reading.
- Rule
- Higher of
- As of
- Currency
- UAH
- Fixed cap
- 150,000,000
- Turnover percentage cap
- 8
Who enforces it
Enforcement body
National Commission on Personal Data Protection and Access to Public Information, a new independent body Draft Law No. 8153 would establish in place of the Ombudsperson; not yet established, since the draft has not been enacted.
What this law does
Draft Law No. 8153 would replace the Ombudsperson with the National Commission on Personal Data Protection and Access to Public Information, a new independent body responsible for both policymaking and enforcement, with quasi-investigative powers including the ability to engage technology and other subject-matter experts; a companion draft law, No. 6177, sets out the Commission's institutional structure, and the source expects the Commission to focus on institutional formation, without imposing penalties, during its first year.
The draft's penalty scheme is far higher than the current law's: an individual faces a fine from UAH 10,000 to UAH 20 million, a legal entity at the lower tier faces UAH 30,000 or 0.05 percent to 5 percent of annual turnover but not less than UAH 300,000, and a legal entity at the upper tier, for the most serious violations, faces up to UAH 150 million or 8 percent of the prior year's annual turnover, whichever is higher, doubling to 200 percent of the initial fine on a repeat violation within one year.
The current law's Ombudsperson, its narrower administrative fines, and the Criminal Code's separate offence are recorded on the sibling instrument ua-zakon-ukrainy-pro-zakhyst-personalnykh-danykh in this file. The draft has passed only a first reading and remained in second reading preparation as of the most recent source located, dated May 2026.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .