Law of Ukraine "On Personal Data Protection"

Law of Ukraine "On Personal Data Protection"
Title	Law of Ukraine "On Personal Data Protection"
Enacted	2010
Jurisdiction	Ukraine
Status	in force

Law of Ukraine "On Personal Data Protection"

The Law of Ukraine "On Personal Data Protection" is a national statute regulating collection, processing, storage, and dissemination of personal data in Ukraine. It establishes definitions, procedural safeguards, rights of individuals, duties of controllers and processors, and mechanisms for oversight and liability, aligning national rules with international instruments and regional practices. The law interacts with Ukrainian institutions and international partners to govern personal data in public administration, commerce, healthcare, and research sectors.

Background and Legislative History

The statute was adopted against a backdrop of post‑Soviet statutory reform involving Verkhovna Rada deliberations influenced by model laws from the Council of Europe, the European Union, and comparative experience from jurisdictions such as United Kingdom, Germany, France, Poland, Estonia, Lithuania, Latvia, Sweden and Denmark. Early drafts referenced standards from the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and incorporated guidance from the United Nations agencies, including the Office of the United Nations High Commissioner for Human Rights and the International Labour Organization where employment data protection issues arose. Subsequent amendments reflected decisions by the European Court of Human Rights and transposition pressures related to cooperation with the European Union and negotiations connected to the Association Agreement between the European Union and its Member States and Ukraine. Legislative debates involved members of factions represented in the Verkhovna Rada and consultations with the Ministry of Justice (Ukraine), the Security Service of Ukraine, the Ministry of Internal Affairs (Ukraine), and civil society actors including Transparency International chapters and privacy advocacy groups.

Scope and Definitions

The law defines "personal data" with reference to identifiable natural persons and provides an inventory of special categories such as biometric, health, and financial data; terms are crafted to interact with concepts used by the European Data Protection Board, the European Commission, and standards from the International Organization for Standardization (notably ISO/IEC 27001). It specifies territorial scope relevant to entities in Crimea, Donetsk Oblast, and Luhansk Oblast while addressing processing by public authorities like the Cabinet of Ministers of Ukraine, municipal administrations of Kyiv and Lviv, and state institutions including the Pension Fund of Ukraine and the State Tax Service of Ukraine. Definitions cover roles such as "data controller" and "processor", and reference records and registries similar to those maintained by the Ministry of Digital Transformation of Ukraine and registries used in Estonia and Finland.

Principles and Legal Grounds for Processing

The statute establishes principles including lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability, in line with standards articulated by the European Union and the Council of Europe. Lawful bases for processing include consent, contract performance, legal obligations under laws such as the Civil Code of Ukraine and the Tax Code of Ukraine, protection of vital interests, public tasks performed by authorities including the Ministry of Health of Ukraine, and legitimate interests assessed against rights protected by the Constitution of Ukraine. Special safeguards apply to processing for investigative activities by the Prosecutor General's Office of Ukraine, intelligence activities involving the Security Service of Ukraine, and for electoral data related to the Central Election Commission of Ukraine.

Rights of Data Subjects

Individuals are granted rights to access, rectification, erasure, restriction of processing, data portability, objection, and complaint, similar to rights recognized by the European Court of Human Rights and the European Commission. The law outlines processes for exercise of rights vis‑à‑vis public bodies such as the Ministry of Social Policy of Ukraine and private companies including Ukrainian banks like PrivatBank and telecommunications operators regulated under the National Commission for the State Regulation of Communications and Informatization. Redress mechanisms link to administrative procedures before the supervisory authority and judicial remedies in courts of first instance and appellate tribunals, with potential appeals to bodies aligned with international instruments like the European Convention on Human Rights.

Obligations of Data Controllers and Processors

Controllers and processors must implement technical and organizational measures including encryption, access controls, audit logs, and incident response plans following guidance from international standards such as ISO/IEC 27001 and best practices seen in Germany and Sweden. Obligations include maintaining records of processing activities, conducting data protection impact assessments for high‑risk operations, appointing data protection officers where applicable, and notifying the national supervisory body and affected individuals of breaches. These duties apply to public entities including the Ministry of Education and Science of Ukraine and private corporations such as energy companies operating in Dnipro and Odesa.

Cross‑border Data Transfers and International Cooperation

Cross‑border transfers are regulated through adequacy decisions, contractual clauses, and international agreements, reflecting interaction with frameworks of the European Union–Ukraine Association Agreement and cooperation with partners such as the United States, United Kingdom, and multilateral organizations including the Council of Europe and the Organisation for Economic Co‑operation and Development. Transfers to third countries require safeguards comparable to those promoted by the European Commission and may involve binding corporate rules for multinational groups operating across Poland, Germany, Romania, and Hungary.

Enforcement, Supervisory Authority, and Liability

Enforcement is vested in a national supervisory authority responsible for monitoring compliance, conducting inspections, issuing enforcement notices, and imposing administrative fines; the authority cooperates with counterparts such as the European Data Protection Board and data protection agencies in France, Spain, Italy, and Belgium. Liability regimes provide for administrative and civil remedies, and criminal provisions apply in cases of unlawful disclosure affecting state secrets or critical infrastructure overseen by agencies like the Security Service of Ukraine and the Ministry of Defense (Ukraine). Judicial review of supervisory decisions is available through the Administrative Court of Ukraine and higher judicial instances.

Category:Law of Ukraine