Ukraine

Article 1 of Law No. 2297-VI sets out what the law covers. It says nothing about territory, and nothing about reaching companies with no office in Ukraine. Article 4 lists the parties to a data relationship, with no condition about where anyone is based. That gap cuts both ways. There is no stated foreign reach, but there is no stated exclusion either. The Commissioner has inspected Ukrainian-established organisations of all ownership types. A local presence rule does appear elsewhere. It is Article 8 of Law No. 80/94-VR, as rewritten by Law No. 4336-IX of 27 March 2025. If any part of a system or critical information infrastructure object sits outside Ukraine, the owner or operator must be a legal entity registered in Ukraine. Having an official representative in Ukraine is the alternative.

Article 29(3) of Law No. 2297-VI allows transfers to foreign parties only where the destination state ensures adequate protection. It must also be a case established by law or by an international treaty. The statute itself treats two groups as adequate. European Economic Area member states. And states that have signed the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108). Law No. 3585-IX of 22 February 2024 added a third group. It covers states whose capital markets regulators have signed the IOSCO Multilateral Memorandum of Understanding. This is a rare industry rule that widens the transfer route rather than narrowing it. It brings the United States back in for securities purposes. Article 29(3) also tells the Cabinet of Ministers to set a list of states that ensure adequate protection. We found no adopted list. On the official gazette site this cross-reference is not linked to any document. Every other live cross-reference in the same law is linked. INDUSTRY RULES: (a) Government. Where a state or local authority decides how data is used, only a state-owned or municipal enterprise may handle it for them (Article 4(3)). That shuts out private and foreign suppliers entirely. (b) Government and defence. Official information and state secrets may not be handled using cloud resources or data centres located abroad. During martial law the Ministry of Defence and the Armed Forces may do exactly that. (c) Government. State information resources and public electronic registers may currently be hosted abroad. That is only because martial law is in force. (d) All industries. Hosting is banned outright in four places. On temporarily occupied territory. In a state Parliament has recognised as an aggressor or occupier. In a state in a customs or military union with such a state. Or with a sanctioned person. (e) Health. A martial law exception lets telemedicine data follow the law of the treating clinician's country. Citizens of Russia and Belarus are excluded. (f) Securities. The IOSCO widening above. We found no transfer restriction specific to banking, payments, insurance, telecoms, education, gaming, e-commerce or mapping. That is based on the main statutes we read on 18 August 2026.

You can only send data to approved countries. But the approval works by category, not by named country. The categories are filled in by the law itself, not by a published government list. Article 29(4) of Law No. 2297-VI sets out the five alternatives. There is no standard contract published by the Ukrainian government. There is no company-wide binding rules scheme, no certification scheme, and no case-by-case approval process. The Cabinet of Ministers has the power under Article 29(3) to publish a list of safe states. We found no such list. So the categories written into the statute are doing all the work today. That means a transfer to a United States cloud provider under the general law usually rests on consent. The alternative is the guarantees limb in Article 29(4)(5). It does not rest on the destination being treated as safe.

Article 22 of Law No. 2297-VI gives supervision to the Commissioner and the courts. Article 23 sets out the Commissioner's powers. It can run planned and unplanned inspections, on site or on paper. It can demand any document, including restricted-access information. It can issue binding orders to stop or change how data is used. And it can draw up administrative offence reports for a court. The procedure is set by Commissioner's Order No. 1/02-14 of 8 January 2014. Published inspection targets lean heavily towards public bodies. City councils, administrative service centres, the National Health Service and the state enterprise eZdorovya, with a smaller number of private companies. Other bodies matter too. The State Service of Special Communications and Information Protection runs cyber incident response through CERT-UA. It also supervises the protection of state information resources. The National Bank supervises banks and payment providers. There is no separate specialist data protection authority. The draft law that would create one has not been passed.

Article 44.3 of the Tax Code sets the minimum periods. They are counted from the day the relevant return was filed. Article 6(8) of Law No. 2297-VI is the general storage limit. Data may be held in a form that identifies people no longer than the purpose requires. Article 15(2) makes that concrete by listing four deletion triggers. The second is the one people miss. It is the end of the legal relationship between the person and the organisation holding the data. Where the two directions clash, the tax and accounting minimum wins. Article 15(2)(2) is expressly subject to any contrary rule of law. Article 27(1) lets other laws add to the privacy law, as long as they do not contradict it. There is no general duty to keep logs in Ukrainian law. There is no rule making telecoms companies keep traffic data. We read Law No. 1089-IX on Electronic Communications in full on 18 August 2026. We found only a duty to keep billing records for the limitation period.

Law No. 2297-VI has no breach reporting duty of any kind. Article 24 imposes only a general security duty. The compulsory deadlines come from Article 9-1 of Law No. 2163-VIII on the Basic Principles of Cyber Security. It was rewritten by Law No. 4336-IX of 27 March 2025. Owners of systems holding state information resources, official information or state secrets must report ALL cyber incidents to the relevant response team. Owners of critical information infrastructure objects must report SIGNIFICANT incidents only. Article 9-1(4) says compulsory reports are made 'within the time limits and in the manner established by the Authorised Body'. That body is the State Service of Special Communications and Information Protection. So the deadline lives in a regulator's order, not in the statute. It can be changed without going through Parliament. Officials who miss it face administrative liability. Separately, Article 9(3) of Law No. 80/94-VR covers the owner of a system holding state information resources. They must tell the same agency about attempted or actual unauthorised access. So there are two deadlines for the public sector and its suppliers. There is no deadline at all for an ordinary private company that loses customer data.

(1) Article 4(3) of Law No. 2297-VI, in the wording introduced by Law No. 1907-IX of 18 November 2021. A state authority or a local self-government body may decide how data is used. If so, only an enterprise in state or municipal ownership may handle it for them. No contract can get around this. (2) Article 182 of the Criminal Code covers unlawful collection, storage, use, destruction or spreading of confidential information about a person. The punishment is a fine of 500 to 1,000 tax-free minimums (about $205 to $410). It can also be correctional labour, probation supervision, or restriction of liberty for up to three years. A repeat offence, or substantial harm, carries up to five years in prison. (3) Article 188-39 of the Code of Administrative Offences applies to citizens, officials and individual entrepreneurs. No administrative fine for a data protection breach is payable by a company. That is why the maximum exposure of about $800 is so misleadingly small. (4) Article 114-2 of the Criminal Code was added after the 2022 invasion. It punishes spreading information about the movement or location of Ukrainian forces, where they can be identified on the ground. The sentence is five to eight years in prison. Any product handling user photographs, check-ins or precise location data in Ukraine is exposed. (5) Presidential Decree No. 64/2022, paragraph 3. It expressly allows temporary limits on the constitutional privacy right under Article 32 of the Constitution. Those limits last as long as martial law does. The Commissioner's own guidance confirms it.

DATED ITEMS. Martial law was extended by Presidential Decree No. 596/2026 of 13 July 2026. It runs from 05:30 on 2 August 2026 for 90 days. This is the twenty-second extension since February 2022. Three permissions are tied to martial law and lapse six months after it is lifted. State information resources and public electronic registers may be hosted on clouds and in data centres abroad. The Ministry of Defence and the Armed Forces may handle defence information, official information and state secrets in foreign clouds. And telemedicine data may be transferred under the law of the treating clinician's country, except for Russian and Belarusian citizens. In each case the position that returns is more restrictive, not less. SWITCHES THAT COULD BE FLIPPED. First, the Cabinet of Ministers may at any time publish the list of states treated as safe under Article 29(3). That could confirm or narrow the current position, with no consultation. Second, the cyber agency sets the compulsory incident reporting deadline by its own order, so the deadline can be shortened administratively. Third, the martial law decree already allows limits on the constitutional privacy right. Further restrictions do not need a new act of Parliament. Fourth, the ban on hosting in aggressor, occupied or sanctioned territories keys off sanctions lists that change often.