Data protection & privacy law in Ukraine (2026)

Legal framework

Law of Ukraine No. 2297-VI "On Personal Data Protection" (adopted 1 June 2010, in force since 1 January 2011), supervised by the Ukrainian Parliament Commissioner for Human Rights (Ombudsman). A GDPR-aligned overhaul (Draft Law No. 8153) passed first reading on 20 Nov 2024 but is not yet enacted.

Key points: data & privacy in Ukraine

1. 01Comprehensive law in force

   Law No. 2297-VI "On Personal Data Protection" (1 June 2010) is the general statute governing protection and processing of personal data, covering fully/partly automated processing and structured manual (card-index) data.

   zakon.rada.gov.ua natlex.ilo.org

2. 02Supervisory authority

   Since 1 January 2014 the Ukrainian Parliament Commissioner for Human Rights (Ombudsman) is the state authority controlling compliance with data-protection legislation; it is a parliamentary human-rights body, not a standalone independent DPA.

   ombudsman.gov.ua dlapiperdataprotection.com

3. 03Data-subject rights

   The law guarantees rights to restrict processing, withdraw consent, place limits when giving consent, know the logic of automated processing, and protection against legally significant automated decisions.

   zakon.rada.gov.ua

4. 04Sensitive data prohibition

   Processing of data on racial/ethnic origin, political, religious or philosophical beliefs, party or trade-union membership, health or sex life is prohibited unless based on the data subject's unambiguous consent or other grounds explicitly set out in law.

   zakon.rada.gov.ua

5. 05Pending GDPR-aligned reform

   Draft Law No. 8153, a new redaction harmonizing Ukrainian rules with the GDPR and Convention 108+, passed first reading on 20 Nov 2024 and was returned for refinement; it would add breach notification, DPIAs, mandatory DPOs and turnover-based fines, but is not yet enacted.

   iapp.org rm.coe.int

6. 06Proposed independent regulator

   The reform package envisions a dedicated independent supervisory authority (a National Commission for the Protection of Personal Data and Access to Public Information) to replace the Ombudsman's current oversight role, in line with EU norms.

   iapp.org

Sources

1. 1.zakon.rada.gov.ua/laws/show/en/2297-17
2. 2.ombudsman.gov.ua/en/informaciya-pro-pidrozdil-zpd
3. 3.natlex.ilo.org/dyn/natlex2/r/natlex/fe/details?p3_isn=87898
4. 4.rm.coe.int/opinion-on-the-draft-law-of-ukraine-on-personal-data-protection-/1680
5. 5.iapp.org/news/a/ukrainian-gdpr-the-reality-and-future-of-privacy-legislation-i
6. 6.dlapiperdataprotection.com/index.html?t=authority&c=UA