🇺🇦Ukraine

Ukraine's current framework remains Law No. 2297-VI

The Law of Ukraine on Protection of Personal Data No. 2297-VI has been in force since 1 January 2011. The official parliamentary register marks it current in the revision of 14 June 2025, based on Law No. 4240-IX. The Ukrainian Parliament Commissioner for Human Rights supervises compliance.

Operational points

The law requires a defined lawful purpose, proportionate data, consent or another legal basis, special-data safeguards, transparency, access and correction procedures, confidentiality, security and controlled disclosure and transfers. Processing posing a particular risk must be notified to the Commissioner within 30 working days after it starts, and material notified particulars must be kept current.

This law is not a copy of the GDPR. It does not contain a general statutory 72-hour breach notice, a general DPIA requirement or a GDPR-style DPO regime. Covered organisations instead create or designate a responsible unit or person in the circumstances specified by Article 24.