LexLint

Know the law your code answers to.

Law / Ukraine

Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform)

Draft Law of Ukraine No. 8153 first reading passed 20 November 2024 (processing principles, legal bases, data protection by design, DPO, art. 39 DPIA)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Proposed: draft date not recorded.

In committee, dated 19 December 2025, as of 12 September 2026.

A comprehensive regime rule binding public and private bodies.

As of 19 September 2026.

Where it has got to

The text described here is Проєкт Закону (draft law) No. 8153, as registered 25 October 2022. That print is 8153, published 25 October 2022.

Locally, this stage is готується на друге читання (being prepared for second reading).

The stage above is recorded at itd.rada.gov.ua.

More on this stage

The Verkhovna Rada is unicameral, so a bill awaiting its second reading is with a committee rather than before a second chamber. The bill card records that on 19 December 2025 it was referred to committee to be prepared for second reading, and no second-reading text has been published.

What it requires

  • This draft has passed only a first reading in the Verkhovna Rada and is not yet law; no obligation attaches to a developer under it until it is enacted, and the following describe what enactment would require.
  • Once enacted, process personal data of a person in Ukraine only under a lawful basis, applying the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability.
  • Once enacted, rely on legitimate interests as a legal basis for processing personal data of a person in Ukraine, alongside consent and contract, under the draft's expansion of legal bases toward General Data Protection Regulation (GDPR) Article 6.
  • Once enacted, implement data protection by design and by default so that only the personal data necessary for each specific purpose is processed by default.
  • Once enacted, appoint a data protection officer where you regularly and systematically monitor data subjects at large scale, process large volumes of sensitive data, or process biometric or genetic data of a person in Ukraine.
  • Once enacted, carry out a data protection impact assessment under Article 39 before processing that involves systematic automated analysis or another high risk activity.

What it reaches

Obligation class

Consent, Governance, DPIA, Design code

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Draft Law No. 8153 was registered in the Verkhovna Rada on 25 October 2022, developed with expert support from the Council of Europe and the EU4DigitalUA program, and passed its first reading on 20 November 2024. It remained in second reading preparation as of the most recent source located, dated May 2026, and has not been enacted.

If enacted, it would apply the General Data Protection Regulation (GDPR) aligned processing principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability, and it would add legitimate interests to the current law's consent and contract legal bases, aligning Ukraine with GDPR Article 6.

It would require data protection by design and by default so that only necessary personal data is processed by default, require a data protection officer where an organization regularly and systematically monitors data subjects at large scale or processes large volumes of sensitive data or biometric or genetic data, and require a data protection impact assessment under Article 39 for processing that involves systematic automated analysis or another high risk activity.

Its data subject rights, breach notification, cross border transfer, and enforcement provisions are recorded on the sibling instruments this draft is split into in this file.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • processes_biometrics

Read the law

recordinglaw.com
"Ukraine Data Privacy Laws: Personal Data Protection, Draft Law 8153, and the GDPR Reform," read in full (41,934 characters, not truncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app