UkraineLaw of Ukraine On the Protection of Personal Data
Zakon Ukrainy Pro zakhyst personalnykh danykh No. 2297-VI, in force (Law of Ukraine No. 2297-VI)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Transfer, Security, Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Establish a lawful basis before processing personal data of a person in Ukraine under Law No. 2297-VI.
- Do not process biometric or genetic data of a person in Ukraine unless a case listed in Article 7(2) of Law No. 2297-VI applies, such as the data subject's unambiguous consent to that processing.
- Notify the Ombudsperson of processing of biometric data, genetic data, health data, or another category the Ombudsperson lists as posing a special risk, within thirty working days from the start of that processing, under Article 9 of Law No. 2297-VI; this law does not define biometric data anywhere, including in its Article 2 definitions.
- Rely on the law's Convention 108, EEA, and United States adequacy-by-default treatment, or a documented safeguard, before transferring personal data of a person in Ukraine outside the country.
- Expect a person in Ukraine to be able to complain about the processing of their personal data to the Ombudsperson or to a court under Article 8 of Law No. 2297-VI.
These lines are LexLint's reading of the law's text. Also read by: Verkhovna Rada Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини), the supervisory authority under the Law (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Confirmed: Criminal Code of Ukraine (Kryminalnyi kodeks Ukrayiny, Law No. 2341-III of ) Art. 182, 'Порушення недоторканності приватного життя' (violation of the inviolability of private life), criminalizes illegal collection, storage, use, destruction, or dissemination of confidential information about a person, or its illegal alteration. Base offense (Part 1): a fine of 500-1,000 non-taxable minimum incomes of citizens (NMDG), or correctional labor for up to 2 years, or probation supervision for up to 3 years, or restriction of liberty for the same term. Aggravated offense (Part 2, a repeat offense or one causing substantial harm): probation supervision for 3-5 years, restriction of liberty for 3-5 years, or imprisonment for 3-5 years, the article's maximum penalty. A carve-out excludes public whistleblowing about a crime, made in compliance with legal requirements, from the offense. Current text confirmed at zakon.rada.gov.ua, last amended by Law No. 3342-IX of , no later amendment found.
Who enforces it
Enforcement body
Ukrainian Parliament Commissioner for Human Rights (Ombudsperson) (Уповноважений Верховної Ради України з прав людини), per Law No. 2297-VI Art. 23, confirmed as of to still be the current and sole enforcement body; the GDPR-aligned Draft Law No. 8153 that would create a dedicated data-protection authority remains pending second reading and is not in force. The Ombudsperson's Art. 23(1) powers are complaint intake and case decisions, on-site and off-site inspections, and binding compliance orders (приписи), but NOT direct fining: under Art. 23(1)(10), authorized officials of the Ombudsperson's Secretariat draft an administrative-offense protocol under KUAP Art. 188-39 and refer it to a court, which alone adjudicates and imposes the fine. The Ombudsperson also reports annually to the Verkhovna Rada on the state of personal-data-protection compliance (Art. 23(2)).
Settledness
The Commissioner's page sets the deadline for the notice of sensitive-data processing at thirty working days from the start of processing.
- As of
- Guidance link
- https://ombudsman.gov.ua/uk/oprilyudnennya-informaciyi-na-vimogu-statti-9-ta-24-zakonu-ukrayini-pro-zahist-personalnih-danih/poryadok-ta-formi-zdijsnennya-povidomlen-dodatkova-informaciya
- Guidance body
- Verkhovna Rada Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини), the supervisory authority under the Law
- Open questions
- Does "місцеперебування та/або шляхи пересування особи" ("the person's whereabouts and/or travel routes") cover device location data collected by an app, so that the processing must be notified to the Commissioner?
What it makes you log
Who may demand the log
Regulator
Logging duty
Law No. 2297-VI imposes no duty to keep a log or record of processing. Article 9 has a controller notify the Ombudsperson of processing that poses a special risk within thirty working days of its start and of each change within ten, and the Ombudsperson publishes what is notified, which is a filing with the regulator and not a record the controller keeps. Article 24 requires a responsible person or unit for data protection work, and no section names a register, a system log or proof of consent. The Ombudsperson may inspect controllers and may obtain on demand any information or documents needed to check data protection (Article 23(1), points 2 and 3), a general power with no record named. The Law's scope clause (Article 1) turns on the processing itself, automated or filed, and states no territorial hook.
- Kind
- None
- As of
What this law does
Law No. 2297-VI predates General Data Protection Regulation (GDPR) by six years and follows the older Council of Europe Convention 108 and EU Directive 95/46 model: the Ukrainian Parliament Commissioner for Human Rights (Ombudsperson) is the supervisory authority, rather than a dedicated data-protection agency, and Article 7(1) prohibits processing biometric and genetic data, together with the other special categories it lists.
Article 7(2) lifts that prohibition in listed cases, the first being the data subject's unambiguous consent to the processing. Article 9 requires a controller to notify the Ombudsperson of processing that poses a special risk to data subjects' rights within thirty working days from the start of that processing, for the types of processing and categories of data subjects the Ombudsperson determines.
The Ombudsperson's notification page lists biometric data and genetic data among the sensitive categories that must be notified. The law's definitions provision (Article 2) does not itself define biometric data or distinguish voiceprints from faceprints, leaving no enumerated example to test for a recording-derived exclusion.
Cross-border transfer is confirmed as a real, moderate regime: transfers proceed by default to Convention 108 signatories, EEA states, and the United States, with safeguards required elsewhere. Article 8(2)(8) lets a data subject complain about the processing of their data to the Ombudsperson or to a court. Breach notification's existence under the current law was not established.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .