What Is Law of Ukraine "On Personal Data Protection" No. 2297-VI?
Ukraine's current general privacy statute is the 2010 Law of Ukraine "On Personal Data Protection" No. 2297-VI, in force since 1 January 2011. The current consolidated edition is dated 14 June 2025. The Ombudsman is the current regulator. A GDPR-alignment bill, Bill No. 8153, was adopted as a basis in November 2024 and the current parliamentary card shows it included in the agenda under Resolution 4958-IX, but it remains unenacted. Bill No. 6177, concerning a new regulator commission, is likewise included in that agenda but remains unenacted. Neither has replaced the current framework. The law provides access, correction or destruction, objection, complaint, consent, and automated-decision safeguards, but no unconditional GDPR-style erasure right was identified. Cross-border rules include adequacy mechanisms and a specific wartime foreign-telemedicine exception during martial law and for six months afterward.
At a glance
- Full name
- Law of Ukraine "On Personal Data Protection" No. 2297-VI
- Short code
- Law No. 2297-VI
- Jurisdiction
- Ukraine
- Enacted
- 2010
- Last major update
- Current consolidated edition dated 14 June 2025; Bills No. 8153 and 6177 are included in the parliamentary agenda under Resolution 4958-IX but remain unenacted legislative projects
- Regulator
- Ukrainian Parliament Commissioner for Human Rights (Ombudsman)
- Private right of action
- Limited
- Statutory citation
- Law of Ukraine "On Personal Data Protection" No. 2297-VI
Scope, who Law No. 2297-VI covers
Protected data
Data subject rights
Right to information about the source and purpose of personal-data collection
Right of access, including confirmation within 30 days
Right to object to processing
Right to correction or destruction of inaccurate or unlawfully processed data
Deletion rights under Article 15 for retention expiry, relationship termination, an Ombudsman prescription, or a court decision
Right to control or withdraw consent where applicable
Protection against specified automated decisions
Right to complain to the Ombudsman; the current Ombudsman materials publish a national-legislation/data-protection route and public contact channels, including hotline 1678 and an outside-Ukraine electronic contact
Right to court review
Access-review procedure generally within 10 working days, with fulfillment generally within 30 days and third-party access capped at 45 days
Notable features
Ukraine is an EU candidate country but is not an EU member state. Its current law remains distinct from Bills No. 8153 and 6177: both appear in the parliamentary agenda under Resolution 4958-IX but remain unenacted. The framework lacks an unconditional GDPR-style erasure right, uses tiered complaint timelines, and contains a wartime exception permitting specified foreign telemedicine transfers during martial law and for six months afterward, excluding Russian and Belarusian citizens.
Enforcement & penalties
Regulator: Ukrainian Parliament Commissioner for Human Rights (Ombudsman)
Penalties: Article 28 delegates penalties to the Code of Administrative Offenses, including Articles 188-39 and 188-40. The identified penalty range is 100-2,000 tax-free minimum incomes, without converting the figures into a currency amount.
Private right of action: Court routes alongside complaints to the Ombudsman, including routes connected with access, correction or destruction, consent, automated decisions, and Article 25 restrictions, are the identified mechanisms. A general private damages action was not located in the report.
Relevance to data brokers
Not located. No dedicated data-broker, people-search, or public-record route was identified; the general Articles 8, 15, 18, 20, and 23 mechanisms and Ombudsman or court routes are the identified tools instead. The Ombudsman’s current public materials list a data-protection legislation/contact route, but do not create a broker-specific deletion channel.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Has Ukraine enacted its GDPR-alignment or new-regulator bills?+
No. The current parliamentary cards show Bills No. 8153 and 6177 included in the agenda under Resolution 4958-IX, but both remain legislative projects and neither has replaced the operative 2010 law.
Does Ukraine provide an unconditional right to erase personal data?+
No unconditional GDPR-style erasure right was identified. Correction or destruction is tied to inaccurate or unlawful data, while Article 15 separately lists grounds including retention expiry, relationship termination, an Ombudsman prescription, or a court decision.
Does Ukraine have a wartime exception for international transfers?+
Yes. During martial law and for six months afterward, Article 30 permits foreign telemedicine transfers, excluding transfers involving Russian or Belarusian citizens.
Official sources & citations
Other international privacy regimes
Law No. 2297-VI sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: