Ukraine. Comprehensive data protection. Act
Law 2297-VILaw of Ukraine No. 2297-VI 'On Personal Data Protection'
In force
Partly verified
Medium confidence.The brief's '1997 law' does not match; the operative statute is the 2010 Law 2297-VI. In-force date 2011-01-01 from prior knowledge.
§1Summary
- Synopsis
Ukraine's current data protection law, based on Directive 95/46 and Convention 108, setting consent-centred processing rules, data subject rights and notification of high-risk processing to the Ombudsman.
- Key themes
- Unique features
Supervisory role sits with the Ombudsman rather than a dedicated DPA; no general breach notification duty; very low fines.
- SaaS relevance
Applies to SaaS providers processing personal data of people in Ukraine, mainly through consent and transfer requirements.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- None
- DPO
- Conditional
- Cross-border transfers
- Permitted to adequate states (Convention 108 parties/EEA) or with consent/other grounds
- Maximum penalty
- Administrative fines up to ~€380; criminal liability for illegal processing
§3Dates
- Key dates
- Adopted
- In force
- Amended 2012 and 2013 (Ombudsman supervision from 2014-01-01); replacement Draft Law No. 8153 pending
§4Text and authority
- Text
- Authoritative text zakon.rada.gov.ua
- Authority
- Ukrainian Parliament Commissioner for Human Rights (Ombudsman)
§5Where it applies
- Domestic law of
- Ukraine
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.The brief's '1997 law' does not match; the operative statute is the 2010 Law 2297-VI. In-force date 2011-01-01 from prior knowledge.