UkraineDraft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform)
Draft Law of Ukraine No. 8153 first reading passed (processing principles, legal bases, data protection by design, DPO, art. 39 DPIA)
In committee, dated , as of .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Governance, DPIA, Design code
Where it has got to
The text described here is Проєкт Закону (draft law) No. 8153, as registered . That print is 8153, published .
Locally, this stage is готується на друге читання (being prepared for second reading).
The stage above is recorded at itd.rada.gov.ua.
The Verkhovna Rada is unicameral, so a bill awaiting its second reading is with a committee rather than before a second chamber. The bill card records that on it was referred to committee to be prepared for second reading, and no second-reading text has been published.
What it requires
- Process personal data of a person in Ukraine only under a lawful basis, applying the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P1
- Rely on legitimate interests as a legal basis for processing personal data of a person in Ukraine, alongside consent and contract, under the draft's expansion of legal bases toward General Data Protection Regulation (GDPR) Article 6.NIST Privacy FrameworkCT.PO-P1
- Implement data protection by design and by default so that only the personal data necessary for each specific purpose is processed by default.NIST Privacy FrameworkGV.PO-P2
- Appoint a data protection officer where you regularly and systematically monitor data subjects at large scale, process large volumes of sensitive data, or process biometric or genetic data of a person in Ukraine.NIST Privacy FrameworkGV.PO-P3
- Carry out a data protection impact assessment under Article 39 before processing that involves systematic automated analysis or another high risk activity.NIST Privacy FrameworkID.RA-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Verkhovna Rada’s European integration committee concluded on the first-reading text that the draft “потребує допрацювання” (“needs further work”) to take account of provisions of Regulation (EU) 2016/679.
- As of
What this law does
Draft Law No. 8153 was registered in the Verkhovna Rada on , developed with expert support from the Council of Europe and the EU4DigitalUA program, and passed its first reading on . A source dated May 2026 describes it as in second reading preparation.
The draft sets out the General Data Protection Regulation (GDPR) aligned processing principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability, and adds legitimate interests to the current law's consent and contract legal bases, aligning Ukraine with GDPR Article 6.
It requires data protection by design and by default so that only necessary personal data is processed by default, requires a data protection officer where an organization regularly and systematically monitors data subjects at large scale or processes large volumes of sensitive data or biometric or genetic data, and requires a data protection impact assessment under Article 39 for processing that involves systematic automated analysis or another high risk activity.
Its data subject rights, breach notification, cross border transfer, and enforcement provisions are recorded on the sibling instruments this draft is split into in this file.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .