Ukraine Law on Personal Data Protection (Law No. 2297-VI)

Ukraine

v2010 (GDPR alignment pending)

13 domains

24 controls

Ukraine's Law on Personal Data Protection (Law No. 2297-VI of 2010) establishes the framework for personal data processing. The Ukrainian Parliament Commissioner for Human Rights oversees data protection. Ukraine committed to aligning its data protection framework with EU GDPR as part of its EU accession process. A new draft law aligning with GDPR was under development. The current law establishes basic processing principles, consent requirements, and data subject rights.

Verified

Ukraine Law on Personal Data Protection (Law No. 2297-VI) is a compliance framework from Ukraine with 13 domains and 24 controls. The largest domains are Transparency and Data Subject Rights (4 controls), Breach Response and Impact Assessment (2 controls), Governance and Supervision (2 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (13)

Breach Response and Impact Assessment

2 controls

Controls in the Breach Response and Impact Assessment domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 2 controls
Code	Title	Description
UA-PDP-09	Breach Response and Notification	Following the 2024 amendments aligning with GDPR-style obligations, owners must notify the Ombudsperson and affected dat...
UA-PDP-15	Data Protection Impact Assessments for High-Risk Processing	Following 2024 amendments aligning with GDPR-style requirements, owners must conduct impact assessments for processing l...

Governance

1 controls

Controls in the Governance domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 1 controls
Code	Title	Description
UKRAINE-4	Governance and Enforcement	Per Ukraine Law: governance + Ombudsman cooperation + enforcement.

Governance and Supervision

2 controls

Controls in the Governance and Supervision domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 2 controls
Code	Title	Description
UA-PDP-07	Personal Data Protection Officer or Responsible Person	Owners and processors of personal data, particularly state authorities, large processors and those handling sensitive da...
UA-PDP-16	Cooperation with the Ombudsperson	Owners and processors must cooperate with the Ukrainian Parliament Commissioner for Human Rights (Ombudsperson) in inspe...

Lawful Basis and Consent

2 controls

Controls in the Lawful Basis and Consent domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 2 controls
Code	Title	Description
UA-PDP-01	Lawful Basis for Processing Personal Data	Personal data may be processed only on a defined lawful basis such as data subject consent, performance of a contract, c...
UA-PDP-02	Consent of the Data Subject	Where consent is the lawful basis, it must be a voluntary expression of the data subject's will, given knowingly with fu...

Marketing and Automated Decisions

2 controls

Controls in the Marketing and Automated Decisions domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 2 controls
Code	Title	Description
UA-PDP-14	Direct Marketing and Communications	Use of personal data for direct marketing purposes requires a lawful basis, with data subjects able to object to such pr...
UA-PDP-19	Automated Decision-Making and Profiling Safeguards	Where decisions producing legal effects are made solely on automated processing or profiling, data subjects must be info...

Records and Retention

2 controls

Controls in the Records and Retention domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 2 controls
Code	Title	Description
UA-PDP-12	Records and Inventories of Processing	Owners and processors must maintain documentation describing categories of data subjects, purposes, recipients, retentio...
UA-PDP-13	Retention and Deletion of Personal Data	Personal data must be stored only for the period necessary for the stated purposes, after which it must be deleted or an...

Rights

1 controls

Controls in the Rights domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 1 controls
Code	Title	Description
UKRAINE-2	Rights and Notice	Per Ukraine Law: data subject rights + notice.

Scope

1 controls

Controls in the Scope domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 1 controls
Code	Title	Description
UKRAINE-1	Scope, Lawful Basis (Ukraine)	Per Ukraine Law 2297-VI: scope + lawful basis. Align with Ombudsman.

Security

1 controls

Controls in the Security domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 1 controls
Code	Title	Description
UKRAINE-3	Security and Cross-Border	Per Ukraine Law: security + cross-border transfer.

Security and Confidentiality

2 controls

Controls in the Security and Confidentiality domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 2 controls
Code	Title	Description
UA-PDP-08	Security of Personal Data	Owners and processors must take organisational and technical measures to protect personal data from unlawful processing,...
UA-PDP-18	Staff Confidentiality and Authorisation	Personnel with access to personal data must be subject to obligations of confidentiality and act only on documented inst...

Sensitive and Children's Data

2 controls

Controls in the Sensitive and Children's Data domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 2 controls
Code	Title	Description
UA-PDP-06	Sensitive Data Processing Conditions	Processing of personal data revealing racial or ethnic origin, political, religious or worldview beliefs, party or trade...
UA-PDP-20	Children's Personal Data Protection	Processing of children's personal data requires the consent of a parent or legal guardian and additional safeguards prop...

Transfers and Processors

2 controls

Controls in the Transfers and Processors domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 2 controls
Code	Title	Description
UA-PDP-10	Cross-Border Transfer of Personal Data	Transfers of personal data to foreign subjects are permitted only where the receiving state provides adequate protection...
UA-PDP-11	Processor Engagement and Contracts	Where processing is delegated to a processor, the owner must put in place a written agreement defining the scope, durati...

Transparency and Data Subject Rights

4 controls

Controls in the Transparency and Data Subject Rights domain of Ukraine Law on Personal Data Protection (Law No. 2297-VI) — 4 controls
Code	Title	Description
UA-PDP-03	Notification to Data Subjects	Owners of personal data must inform data subjects at the time of collection about the owner's identity, the purposes of...
UA-PDP-04	Data Subject Rights of Access and Rectification	Data subjects have the right to know what personal data about them is processed, to receive copies, and to have inaccura...
UA-PDP-05	Rights of Objection, Erasure and Restriction	Data subjects may object to processing, request erasure of their data where conditions are met, and require restriction...
UA-PDP-17	Complaints Handling by Data Subjects	Owners must provide accessible internal complaints channels and respond to data subject grievances within statutory time...

What is Ukraine Law on Personal Data Protection (Law No. 2297-VI) and who does it apply to?

Ukraine Law on Personal Data Protection (Law No. 2297-VI) is a compliance framework from Ukraine with 13 domains and 24 controls. Ukraine's Law on Personal Data Protection (Law No. 2297-VI of 2010) establishes the framework for personal data processing. The Ukrainian Parliament Commissioner for Human Rights oversees data protection. Ukraine committed to aligning its data protection framework with EU GDPR as part of its EU accession process. A new draft law aligning with GDPR was under development. The current law establishes basic processing principles, consent requirements, and data subject rights. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Ukraine Law on Personal Data Protection (Law No. 2297-VI) actually require?

Ukraine Law on Personal Data Protection (Law No. 2297-VI) has 24 controls organised across 13 domains. The largest domains are Transparency and Data Subject Rights (4 controls), Breach Response and Impact Assessment (2 controls), Governance and Supervision (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Ukraine Law on Personal Data Protection (Law No. 2297-VI) do I already cover?

Ukraine Law on Personal Data Protection (Law No. 2297-VI) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement Ukraine Law on Personal Data Protection (Law No. 2297-VI)?

Start your Ukraine Law on Personal Data Protection (Law No. 2297-VI) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Ukraine Law on Personal Data Protection (Law No. 2297-VI) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 24 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required