Ukraine

Article 1 of Law No. 2297-VI defines the subject matter with no territorial or extraterritorial trigger, and Article 4 lists the parties to a data relationship without any residency condition. The absence of a territorial clause cuts both ways: there is no explicit foreign reach, but there is also no explicit exclusion, and the Commissioner has in practice inspected Ukrainian-established entities of all ownership types. A local-presence requirement does appear elsewhere: under Article 8 of Law No. 80/94-VR, as rewritten by Law No. 4336-IX of 27 March 2025, where any element of a system or critical information infrastructure object sits outside Ukraine, the owner or operator must be a legal entity registered in Ukraine or must have an official representative in Ukraine.

Article 29(3) of Law No. 2297-VI permits transfer to foreign parties only where the destination state ensures adequate protection, in cases established by law or by an international treaty. Two categories are deemed adequate by the statute itself: European Economic Area member states, and states that have signed the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108). A third category was inserted by Law No. 3585-IX of 22 February 2024: states whose capital markets regulators are signatories to the IOSCO Multilateral Memorandum of Understanding. That third limb is a rare example of a sector rule that widens rather than narrows the transfer route, and it pulls the United States back in for securities purposes. Article 29(3) also directs the Cabinet of Ministers to determine a list of states ensuring adequate protection; we found no adopted list and the statutory cross-reference on the official gazette site is not hyperlinked to any instrument, unlike every other live cross-reference in the same law. SECTOR OVERRIDES: (a) government — where a state or local authority is the controller, only a state-owned or municipal enterprise may act as processor (Article 4(3)), which excludes private and foreign suppliers entirely; (b) government and defence — official information and state secrets may not be processed using cloud resources or data centres located abroad, except that during martial law the Ministry of Defence and the Armed Forces may do exactly that; (c) government — state information resources and public electronic registers may currently be hosted abroad, but only because martial law is in force; (d) all sectors — hosting on temporarily occupied territory, in a state recognised by Parliament as an aggressor or occupier, in a state in a customs or military union with such a state, or with a sanctioned person, is prohibited outright; (e) health — a martial law exception lets telemedicine data follow the law of the treating clinician's country, except for citizens of Russia and Belarus; (f) securities — the IOSCO widening above. No transfer restriction specific to banking, payments, insurance, telecoms, education, gaming, e-commerce or mapping was found in the primary statutes we read on 18 August 2026.

The model is an allowlist by category rather than by named country, and the categories are populated by operation of law, not by a published government list. Article 29(4) of Law No. 2297-VI sets out the five alternatives. There is no standard contract published by the Ukrainian government, no binding corporate rules scheme, no certification scheme and no case-by-case approval process. The Cabinet of Ministers has the power under Article 29(3) to publish a list of adequate states; we found no such list, so the deemed-adequate categories in the statute are doing all the work today. The practical consequence is that a transfer to a United States cloud provider under the general law usually rests on consent or on the Article 29(4)(5) guarantees limb, not on adequacy.

Article 22 of Law No. 2297-VI gives supervision to the Commissioner and the courts. Article 23 gives the Commissioner the power to run planned and unplanned, on-site and desk inspections, to demand any document including restricted-access information, to issue binding orders to stop or change processing, and to draw up administrative offence reports for a court. The procedure is set by Commissioner's Order No. 1/02-14 of 8 January 2014. Published inspection targets are heavily weighted towards public bodies — city councils, administrative service centres, the National Health Service, the state enterprise eZdorovya — with a smaller number of private companies. Separately, the State Service of Special Communications and Information Protection runs cyber incident response through CERT-UA and supervises the protection of state information resources, and the National Bank supervises banks and payment providers. There is no separate specialised data protection authority, and the draft law that would create one has not been enacted.

Article 44.3 of the Tax Code sets the minimum periods, counted from the day the relevant return was filed. Article 6(8) of Law No. 2297-VI is the general storage-limitation principle: data may be held in identifiable form no longer than is necessary for the purposes for which it was collected. Article 15(2) makes that concrete by listing four deletion triggers, of which the second is the one people miss — the end of the legal relationship between the person and the controller. Where the two directions conflict, the tax and accounting floor wins because Article 15(2)(2) is expressly subject to any contrary provision of law, and Article 27(1) allows other laws to supplement the privacy law provided they do not contradict it. There is no general log retention duty in Ukrainian law, and no telecoms traffic data retention regime: we read Law No. 1089-IX on Electronic Communications in full on 18 August 2026 and found only a duty to keep billing records for the limitation period.

Law No. 2297-VI contains no breach notification obligation of any kind; Article 24 imposes only a general security duty. The mandatory clocks come from Article 9-1 of Law No. 2163-VIII on the Basic Principles of Cyber Security, as rewritten by Law No. 4336-IX of 27 March 2025. Owners of systems processing state information resources, official information or state secrets must report ALL cyber incidents to the relevant response team; owners of critical information infrastructure objects must report SIGNIFICANT incidents only. Article 9-1(4) states that mandatory notifications are made 'within the time limits and in the manner established by the Authorised Body', which is the State Service of Special Communications and Information Protection — so the deadline lives in a regulator's order, not in the statute, and can be changed without going through Parliament. Officials who miss it face administrative liability. Separately, Article 9(3) of Law No. 80/94-VR requires the owner of a system holding state information resources to notify the same agency of attempted or actual unauthorised access. The practical result is two clocks for the public sector and its suppliers, and no clock at all for an ordinary private company that loses customer data.

(1) Article 4(3) of Law No. 2297-VI, in the wording introduced by Law No. 1907-IX of 18 November 2021: where the controller is a state authority or a local self-government body, the processor may only be an enterprise in state or municipal ownership. This is a hard procurement wall that no contract can cure. (2) Article 182 of the Criminal Code punishes unlawful collection, storage, use, destruction or dissemination of confidential information about a person with a fine of 500 to 1,000 tax-free minimums (about $205 to $410), correctional labour, probation supervision or restriction of liberty for up to three years; a repeat offence or substantial harm attracts up to five years' imprisonment. (3) Article 188-39 of the Code of Administrative Offences addresses citizens, officials and individual entrepreneurs — there is no administrative fine payable by a legal entity for a data protection breach, which is why the maximum exposure of about $800 is so misleadingly small. (4) Article 114-2 of the Criminal Code, added after the 2022 invasion, punishes dissemination of information about the movement or location of Ukrainian forces where they can be identified on the ground with five to eight years' imprisonment. Any product handling user-generated photographs, check-ins or fine-grained location data in Ukraine is exposed. (5) Presidential Decree No. 64/2022, paragraph 3, expressly allows temporary limitation of the constitutional privacy right under Article 32 of the Constitution for the duration of martial law, and the Commissioner's own guidance confirms it.

DATED ITEMS. Martial law was extended by Presidential Decree No. 596/2026 of 13 July 2026 from 05:30 on 2 August 2026 for 90 days, the twenty-second extension since February 2022. Three permissions are tied to it and lapse six months after it is lifted: state information resources and public electronic registers may be hosted on clouds and in data centres abroad; the Ministry of Defence and the Armed Forces may process defence information, official information and state secrets in foreign clouds; and telemedicine data may be transferred under the law of the treating clinician's country, except for Russian and Belarusian citizens. In each case the default position that returns is more restrictive, not less. DORMANT SWITCHES. First, the Cabinet of Ministers may at any time publish the list of states deemed to ensure adequate protection under Article 29(3), which could either confirm or narrow the current position without consultation. Second, the cyber agency sets the mandatory incident reporting deadline by its own order, so the clock can be shortened administratively. Third, the martial law decree already authorises limitation of the constitutional privacy right, meaning further restrictions do not need new primary legislation. Fourth, the ban on hosting in aggressor, occupied or sanctioned territories keys off sanctions lists that change frequently.