Skip to content

Personal data in Ukraine

| Article: 4 min read | Privacy and law

Personal data in Ukrainian law is information or a set of information about an individual who is identified or can be specifically identified. Its processing is regulated by the Law of Ukraine "On Personal Data Protection" of June 1, 2010, No. 2297-VI. A new law meant to replace it had still not been adopted as of November 2026.

This is not legal advice: below is what the sources say, with links. Laws change, so check the text against the current version.

What is in force now

Law No. 2297-VI is marked as in force on the Verkhovna Rada website; at the time of checking, its version was dated 14.06.2025 (zakon.rada.gov.ua). Key provisions for a store (per the text of the law):

  • What personal data and consent are (Art. 2): consent is a voluntary and informed decision of a person to allow the processing of their data for a stated purpose, expressed in writing or in another form from which consent follows.
  • General requirements (Art. 6): the purpose of processing is defined, processing is open and transparent, the scope of data matches the purpose and is not excessive, and data is accurate and kept up to date. If the purpose changes to an incompatible one, new consent is needed, except in cases provided by law.
  • Grounds for processing (Art. 11): consent; law; a contract; protection of vital interests; an obligation provided by law; the legitimate interests of the data owner or a third party, if the person's rights do not prevail. So consent is not always needed to fulfill an order: a contract is enough.
  • Collection and notification (Art. 12): the person is told who the data owner is, what data is collected, their rights, the purpose of collection and who the data will be passed to. If the data is collected from the person directly, this is done at the moment of collection.
  • Rights of the person (Art. 8): to know where the data comes from and why, to have access, to object, to demand that inaccurate or unlawfully processed data be changed or destroyed, to withdraw consent, and to complain to the Commissioner or the court. A reply to a request is due within 30 calendar days.
  • Data protection (Art. 24): owners, processors and third parties must protect data from loss, destruction and unlawful processing.
  • Special risk (Art. 9): the owner notifies the Commissioner of processing that carries a special risk within 30 working days of the start of such processing.
  • Transfer abroad (Art. 29): allowed when the country ensures adequate protection; EEA countries and parties to Council of Europe Convention No. 108 are recognized as such.

(The article texts were checked against the publication of the law on zakon.rada.gov.ua in print view; check against the current version.)

Cookies. The law names no separate rules on cookies. Cookies that can identify a person fall under the general requirements on grounds and notification. There are no separate source-confirmed requirements for a cookie banner in Ukraine: ask a lawyer. See cookie banner.

What is coming: bill No. 8153

Bill No. 8153 "On Personal Data Protection" was registered on 25.10.2022. According to the card on the Verkhovna Rada website, it was adopted in the first reading as a basis, with revision, on 20.12.2023, and its status is "Being prepared for the second reading" (entry of 19.12.2025; the bill was put on the agenda by resolution No. 4958-IX of 01.09.2026, but adoption as a whole is not shown on the card) (Verkhovna Rada). Some outlets date the adoption as a basis to November 2024. Go by the Rada's card and check it directly.

According to a European Pravda publication of October 23, 2026, the bill has still not been adopted; the National Program for Adapting Legislation to EU Law had planned this for June 2026. It describes the bill as:

  • introducing explicit and informed consent, while consent that is not free (the person depends on the data owner or will not get the service without consent) will be invalid;
  • raising fines: the current 1,700 to 34,000 UAH, and under the bill up to 90 million UAH or 5% of a company's annual turnover;
  • adding rights to change and delete one's data (European Pravda, 23.10.2026).

A separate bill No. 6177 would create the National Commission for Personal Data Protection and Access to Public Information (same source). What exactly will change for a store depends on the final version of bill No. 8153. As of today, the 2010 law is in force.

The committee conclusions on the bill's card speak of alignment with EU requirements, in particular Regulation 2016/679 (GDPR). Participants in a BRDO discussion in December 2024 also stressed the need for a separate regulator (BRDO, 18.12.2024).

What this means for a store today

  • Collect only what is needed for the order and delivery.
  • Tell the person who you are, why you collect the data and who you pass it to: a privacy policy next to the order and subscription forms.
  • For marketing mailings and advertising, collect consent that can be proved and withdrawn.
  • Protect the customer database: access, backups, contracts with contractors who see the data (CRM).
  • If you sell in the EU, the GDPR applies in addition, even if the store is in Ukraine.

FAQ

Which personal data law is in force in Ukraine? Law No. 2297-VI of 01.06.2010 (in force, version of 14.06.2025).

Has a new personal data law been adopted? No. Bill No. 8153 has the status "Being prepared for the second reading" on the Verkhovna Rada card.

What is the fine for a violation today? According to European Pravda (October 2026), 1,700 to 34,000 UAH. The bill proposes much more; until it is adopted, this is only a proposal.

Is a cookie banner required in Ukraine? The law names no separate requirement. For visitors from the EU, EU rules apply.

Do I need to register a personal data database? Article 9 of the law provides for notifying the Commissioner of processing with a special risk. Whether this applies to your store, check against the list in the law.

Sources

Share

Related

  • Selling abroad from Ukraine: logistics, duties, payments

    | Article: 4 min read

    Cross-border e-commerce is selling goods to buyers in another country through your own site or a marketplace. For a Ukrainian store this means three separate tasks: getting the goods across the border, handling the duties and taxes of the buyer's country…

  • Returning goods to an online store

    | Article: 5 min read

    A product return is the process in which a shopper gives a purchased item back to the seller and receives money or an exchange. In Ukraine, the shopper's rights are defined by the Law "On Consumer Rights Protection," and the rules for returning an online…

  • PRRO and fiscalization for an online store

    | Article: 4 min read

    A PRRO (software cash register, "програмний реєстратор розрахункових операцій") is a program registered on the tax authority's fiscal server, through which the seller carries out a payment and creates a settlement document (a fiscal receipt) (Law No.…

  • Google Consent Mode v2

    | Article: 4 min read

    Google Consent Mode is a way to pass a visitor's choice from the cookie banner to Google tags (Analytics, Ads) so they behave accordingly: without consent they don't set cookies and don't send data that requires permission. Version 2 added two parameters for…