CevroUkraine: Law on Personal Data Protection and what it requires
Law on Personal Data Protection: a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by Ukrainian Parliament Commissioner for Human Rights.
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Not required |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Depends on thresholds or circumstances |
| Data localization | Not required |
Penalties and enforcement
Administrative penalties under the Law.
What to know in practice
Aligned toward GDPR standards, with reform continuing amid broader legal harmonization efforts.
How Cevro helps
- Maps Law on Personal Data Protection to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Ukraine?
Ukrainian Parliament Commissioner for Human Rights oversees Law on Personal Data Protection.
Is breach notification mandatory under Law on Personal Data Protection?
Our reference does not record a fixed hourly deadline for Law on Personal Data Protection. Check the statute and Ukrainian Parliament Commissioner for Human Rights guidance for the notification timing that applies to you.
Does Ukraine restrict cross-border data transfers?
Conditionally. Transfers are restricted in some circumstances, so check whether your data flows trigger the rules before relying on them.
Do you need a data protection officer under Law on Personal Data Protection?
It is not a general requirement in our reference, though naming an accountable person is still good practice.
What are the penalties for non-compliance in Ukraine?
Administrative penalties under the Law.