Law of Ukraine On Protection of Personal Data

Ukraine's current law predates the GDPR and is closer to the 1995 EU Directive model. It applies to processing of personal data carried out in Ukraine, or by controllers registered/established in Ukraine — there is no clear statutory targeting test reaching a foreign business with no Ukrainian establishment, so the triggers below are modeled on established presence only. Supervision sits with the Ukrainian Parliament Commissioner for Human Rights (the Ombudsperson) rather than a dedicated data-protection authority. A GDPR-aligned replacement bill (draft law No. 8153, which would create an independent supervisory authority and add GDPR-style extraterritorial reach) has been progressing through the Verkhovna Rada as part of the EU accession process; its status should be reconfirmed before relying on the current framework for a long-horizon compliance plan.