🇺🇦Law of Ukraine on Protection of Personal Data No. 2297-VI
Law of Ukraine on Protection of Personal Data No. 2297-VI
The law applies to automated processing and to non-automated personal data held or intended for a filing system. The current official revision is dated 14 June 2025.
Core holder and processor duties
Purpose and sensitive data: Articles 6-7 require a specific lawful purpose, adequate and non-excessive data, limited retention and a permitted condition for protected categories.
Rights and notice: Article 8 lists data-subject rights, including access, objection, correction or destruction, consent withdrawal and protection from legally consequential automated decisions. Article 12 requires collection information immediately when data come from the person or, in other cases, within 30 working days unless an exception applies.
High-risk notification and governance: Article 9 requires notice to the Commissioner within 30 working days after particularly risky processing starts and notice of changes within 10 working days. Article 24 requires organisational and technical protection and, for public bodies and covered high-risk processing, a responsible unit or person.
Transfers: Article 29 permits transfer to adequate jurisdictions and specified transfers based on unambiguous consent, contract-related necessity, vital interests, public or legal claims, or appropriate guarantees. A temporary wartime telemedicine exception appears in Article 30.
Before starting processing classified by the Commissioner as posing a particular risk, assign responsibility, document safeguards and prepare the Article 9 notification within 30 working days of commencement.
Articles 6-9 - principles, special data, rights and high-risk notification.
Articles 12-16 - collection information, disclosure and access.
Article 24 - security and responsible organisation.
Articles 29-30 - international transfers and final provisions.