Ukraine Law on Personal Data Protection (Law No. 2297-VI)
Ukraine's Law on Personal Data Protection No. 2297-VI (2010, current edition 14 June 2025), supervised by the Ukrainian Parliament Commissioner for Human Rights: purposes fixed in governing documents and transparent processing, accuracy and adequacy, storage limitation, six lawful grounds including consent and legitimate interest, prohibited special categories with listed exceptions, processors only under written contract, notification of high-risk processing to the Commissioner within thirty working days, staff confidentiality, notice at collection or within thirty working days, dissemination only with consent or by law, deletion triggers, data subject rights with thirty-day answers and free access, handling third-party access requests in ten working days, notification of transfers and corrections within ten working days, protection measures and a responsible person, and cross-border transfers to adequate states (EEA, Convention 108, IOSCO signatories) or on listed grounds. Draft Law No. 8153 (GDPR alignment) passed first reading in November 2024 and is not in force.
Ukraine Law on Personal Data Protection (Law No. 2297-VI) is a compliance framework from Ukraine with 7 domains and 19 controls. The largest domains are Processing principles, dissemination and deletion – Ukraine Law on Personal Data Protection (Law No. 2297-VI) (5 controls), Data subject rights and requests – Ukraine Law on Personal Data Protection (Law No. 2297-VI) (4 controls), Governance, notification and supervision – Ukraine Law on Personal Data Protection (Law No. 2297-VI) (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Cross-border transfers – Ukraine Law on Personal Data Protection (Law No. 2297-VI)
| Code | Title |
|---|---|
| ukraine-law-on-personal-data-protection-law-no-2297-vi::29 | Cross-border transfers |
Data subject rights and requests – Ukraine Law on Personal Data Protection (Law No. 2297-VI)
| Code | Title |
|---|---|
| ukraine-law-on-personal-data-protection-law-no-2297-vi::16-19 | Handling access requests |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::20 | Correcting data |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::21 | Notifying transfers, changes and deletions |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::8.2 | Data subject rights |
Governance, notification and supervision – Ukraine Law on Personal Data Protection (Law No. 2297-VI)
| Code | Title |
|---|---|
| ukraine-law-on-personal-data-protection-law-no-2297-vi::23 | Cooperating with the Commissioner |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::6.10 | Follow the Commissioner's Typical Procedure for processing |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::9 | Notifying the Commissioner of high-risk processing |
Lawful grounds and special categories – Ukraine Law on Personal Data Protection (Law No. 2297-VI)
| Code | Title |
|---|---|
| ukraine-law-on-personal-data-protection-law-no-2297-vi::11 | Grounds for processing |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::7 | Special categories of data |
Processing principles, dissemination and deletion – Ukraine Law on Personal Data Protection (Law No. 2297-VI)
| Code | Title |
|---|---|
| ukraine-law-on-personal-data-protection-law-no-2297-vi::14 | Dissemination and transfer to third parties |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::15 | Deletion and destruction |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::6.1 | Defined, lawful purpose and transparent processing |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::6.2-3 | Accuracy and adequacy |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::6.6-8 | Confidential data, vital interests and storage limitation |
Security, confidentiality and processors – Ukraine Law on Personal Data Protection (Law No. 2297-VI)
| Code | Title |
|---|---|
| ukraine-law-on-personal-data-protection-law-no-2297-vi::10 | Conditions for use and staff confidentiality |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::24 | Protecting data and a responsible person or unit |
| ukraine-law-on-personal-data-protection-law-no-2297-vi::4.4-5 | Processors under written contract |
Transparency – Ukraine Law on Personal Data Protection (Law No. 2297-VI)
| Code | Title |
|---|---|
| ukraine-law-on-personal-data-protection-law-no-2297-vi::12.2 | Informing data subjects at collection |
What is Ukraine Law on Personal Data Protection (Law No. 2297-VI) and who does it apply to?
Ukraine Law on Personal Data Protection (Law No. 2297-VI) is a compliance framework from Ukraine with 7 domains and 19 controls. Ukraine's Law on Personal Data Protection No. 2297-VI (2010, current edition 14 June 2025), supervised by the Ukrainian Parliament Commissioner for Human Rights: purposes fixed in governing documents and transparent processing, accuracy and adequacy, storage limitation, six lawful grounds including consent and legitimate interest, prohibited special categories with listed exceptions, processors only under written contract, notification of high-risk processing to the Commissioner within thirty working days, staff confidentiality, notice at collection or within thirty working days, dissemination only with consent or by law, deletion triggers, data subject rights with thirty-day answers and free access, handling third-party access requests in ten working days, notification of transfers and corrections within ten working days, protection measures and a responsible person, and cross-border transfers to adequate states (EEA, Convention 108, IOSCO signatories) or on listed grounds. Draft Law No. 8153 (GDPR alignment) passed first reading in November 2024 and is not in force. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Ukraine Law on Personal Data Protection (Law No. 2297-VI) actually require?
Ukraine Law on Personal Data Protection (Law No. 2297-VI) has 19 controls organised across 7 domains. The largest domains are Processing principles, dissemination and deletion – Ukraine Law on Personal Data Protection (Law No. 2297-VI) (5 controls), Data subject rights and requests – Ukraine Law on Personal Data Protection (Law No. 2297-VI) (4 controls), Governance, notification and supervision – Ukraine Law on Personal Data Protection (Law No. 2297-VI) (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Ukraine Law on Personal Data Protection (Law No. 2297-VI) do I already cover?
Ukraine Law on Personal Data Protection (Law No. 2297-VI) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Ukraine Law on Personal Data Protection (Law No. 2297-VI)?
Start your Ukraine Law on Personal Data Protection (Law No. 2297-VI) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Ukraine Law on Personal Data Protection (Law No. 2297-VI) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 19 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required