Ukraine. Comprehensive data protection. Bill
Draft Law 8153Draft Law No. 8153 'On Personal Data Protection' (new version)
Partly verified
Low confidence.Status after early 2025 could not be verified (search budget exhausted); check Verkhovna Rada bill card. text_url bill card ID unverified.
§1Summary
- Synopsis
A GDPR- and Convention 108+-aligned replacement for the 2010 law that would add GDPR-style rights, accountability, DPOs for public bodies, 72-hour breach notification and much higher fines. It passed first reading in November 2024 and is awaiting second reading.
- Key themes
- Unique features
Refinements reportedly include an explicit ban on transfers to the aggressor state; industry has pressed for long transition periods and delay until martial law ends.
- SaaS relevance
If enacted, SaaS providers targeting Ukrainian users would face GDPR-style duties and turnover-based fines.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Proposed: authority within 72h
- DPO
- Conditional
- Cross-border transfers
- Proposed adequacy/safeguards
- Maximum penalty
- Proposed GDPR-scale turnover fines
§3Dates
- Key dates
- Registered 2022-10-25; adopted at first reading 2024-11-20; being prepared for second reading; companion Draft Law No. 6177 would create a National Commission
§4Text and authority
- Text
- Authoritative text itd.rada.gov.ua
- Authority
- Proposed: National Commission for Personal Data Protection and Access to Public Information
§5Where it applies
- Domestic law of
- Ukraine
§6Sources and verification
- Verification
Low confidence.
Partly verified
Low confidence.Status after early 2025 could not be verified (search budget exhausted); check Verkhovna Rada bill card. text_url bill card ID unverified.