What Is Law of Ukraine "On Personal Data Protection" No. 2297-VI?
Ukraine's current general privacy statute is the 2010 Law of Ukraine "On Personal Data Protection" No. 2297-VI, in force since 1 January 2011. The current consolidated edition is dated 14 June 2025. The Ombudsman is the current regulator. A GDPR-alignment bill, Bill No. 8153, was adopted as a basis in November 2024 and remains in preparation for second reading. Bill No. 6177, concerning a new regulator commission, also remains a legislative project. Neither has replaced the current framework. The law provides access, correction or destruction, objection, complaint, consent, and automated-decision safeguards, but no unconditional GDPR-style erasure right was identified. Cross-border rules include adequacy mechanisms and a specific wartime foreign-telemedicine exception during martial law and for six months afterward.
At a glance
- Full name
- Law of Ukraine "On Personal Data Protection" No. 2297-VI
- Short code
- Law No. 2297-VI
- Jurisdiction
- Ukraine
- Enacted
- 2010
- Last major update
- Current consolidated edition dated 14 June 2025; Bill No. 8153 remains in preparation for second reading and Bill No. 6177 remains a legislative project
- Regulator
- Ukrainian Parliament Commissioner for Human Rights (Ombudsman)
- Private right of action
- Limited
- Statutory citation
- Law of Ukraine "On Personal Data Protection" No. 2297-VI
Scope, who Law No. 2297-VI covers
Protected data
Data subject rights
Right to information about the source and purpose of personal-data collection
Right of access, including confirmation within 30 days
Right to object to processing
Right to correction or destruction of inaccurate or unlawfully processed data
Deletion rights under Article 15 for retention expiry, relationship termination, an Ombudsman prescription, or a court decision
Right to control or withdraw consent where applicable
Protection against specified automated decisions
Right to complain to the Ombudsman
Right to court review
Access-review procedure generally within 10 working days, with fulfillment generally within 30 days and third-party access capped at 45 days
Notable features
Ukraine is an EU candidate country but is not an EU member state. Its current law remains distinct from the pending GDPR-alignment Bill No. 8153. The framework lacks an unconditional GDPR-style erasure right, uses tiered complaint timelines, and contains a wartime exception permitting specified foreign telemedicine transfers during martial law and for six months afterward, excluding Russian and Belarusian citizens.
Enforcement & penalties
Regulator: Ukrainian Parliament Commissioner for Human Rights (Ombudsman)
Penalties: Article 28 delegates penalties to the Code of Administrative Offenses, including Articles 188-39 and 188-40. The identified penalty range is 100-2,000 tax-free minimum incomes, without converting the figures into a currency amount.
Private right of action: Court routes alongside complaints to the Ombudsman, including routes connected with access, correction or destruction, consent, automated decisions, and Article 25 restrictions, are the identified mechanisms. A general private damages action was not located in the report.
Relevance to data brokers
Not located. No dedicated data-broker, people-search, or public-record route was identified; the general Articles 8, 15, 18, 20, and 23 mechanisms and Ombudsman or court routes are the identified tools instead.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
Has Ukraine enacted its GDPR-alignment bill?+
No. Bill No. 8153 was adopted as a basis in November 2024 and remains in preparation for second reading. Bill No. 6177 concerning a new regulator commission also remains a legislative project.
Does Ukraine provide an unconditional right to erase personal data?+
No unconditional GDPR-style erasure right was identified. Correction or destruction is tied to inaccurate or unlawful data, while Article 15 separately lists grounds including retention expiry, relationship termination, an Ombudsman prescription, or a court decision.
Does Ukraine have a wartime exception for international transfers?+
Yes. During martial law and for six months afterward, Article 30 permits foreign telemedicine transfers, excluding transfers involving Russian or Belarusian citizens.
Official sources & citations
Other international privacy regimes
Law No. 2297-VI sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: