Jurisdiction Guides / Europe
Ukraine Privacy & Data Protection Laws
Every regime below can apply to a business handling Ukraine residents' data, depending on whether you have an established presence there, actively offer goods or services to residents, or monitor their behavior. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Comprehensive Privacy Law · 1
Ukraine's current law predates the GDPR and is closer to the 1995 EU Directive model. It applies to processing of personal data carried out in Ukraine, or by controllers registered/established in Ukraine — there is no clear statutory targeting test reaching a foreign business with no Ukrainian establishment, so the triggers below are modeled on established presence only. Supervision sits with the Ukrainian Parliament Commissioner for Human Rights (the Ombudsperson) rather than a dedicated data-protection authority. A GDPR-aligned replacement bill (draft law No. 8153, which would create an independent supervisory authority and add GDPR-style extraterritorial reach) has been progressing through the Verkhovna Rada as part of the EU accession process; its status should be reconfirmed before relying on the current framework for a long-horizon compliance plan.
Cross-Border Data Transfer · 1
Art. 29 permits transferring personal data to foreign recipients only where the destination state ensures adequate protection of personal data, with member states of the European Economic Area and states party to Council of Europe Convention 108 treated as meeting that standard, and otherwise only on the specific grounds the Article lists (including the data subject's unambiguous consent and necessity for a contract in the data subject's interest). What Ukraine does NOT have is the modern toolkit: there is no enacted standard-contractual-clause or binding-corporate-rules regime to fall back on when the destination is not adequate, which makes the consent and contract grounds do most of the work in practice. Comprehensive reform aligning Ukrainian law with the GDPR has been under parliamentary consideration for several years without enactment. Marked 'check': the official English translation could not be retrieved directly and the article's content was triangulated across independent legal-reference sources — confirm the current text with the Ukrainian Parliament Commissioner for Human Rights, which acts as the supervisory authority.
Other Europe jurisdictions