Ukraine Moving Toward GDPR-Size Penalties: Key Takeaways

In the previous publication, we discussed the amounts of penalties suggested by Draft Law No. 8153 "On Personal Data Protection” ("Draft Law”). Since then, Ukraine has taken another step toward modernizing its personal data protection framework. On November 20, 2024, the Ukrainian Parliament passed the Draft Law in the first reading.

After the first reading, lawmakers returned the Draft Law for further refinement, aiming to integrate some of the proposed amendments. Among them, key proposals focus on addressing national security concerns (e.g., an explicit prohibition on transferring personal data to the aggressor state).

At the same time, public discussions on the Draft Law continue, with the private sector questioning the feasibility of implementing its new requirements and transitional period. A recent survey conducted by the American Chamber of Commerce in Ukraine highlights business sentiment on the matter:

70% of respondents believe that implementation will be either impossible or excessively burdensome in the short term.

82% of surveyed businesses consider it reasonable to implement the requirements of the new personal data protection regulations after the cancellation or conclusion of martial law in Ukraine.

Regarding the preferred transition period, 41% of businesses favor a 36-month implementation timeline, 35% support a 12-month period, and 23% advocate for a 24-month transition phase.

In any case, no penalties are expected to be imposed during the first year since the enactment of the modern data protection framework. This is because a new data protection authority should be established – the National Commission on Personal Data Protection and Access to Public Information (Draft Law No. 6177). During the first year, the National Commission is expected to be busy with its institutional formation.

As the legislative process unfolds, businesses operating in Ukraine should closely monitor regulatory developments and assess their compliance strategies accordingly. We will continue to provide updates on the legislative progress. For further insights, see our previous analysis regarding penalty provisions under the Draft Law.

Information contained in this overview is for general information purposes only, does not constitute legal or other professional advice, and should not be relied upon as a substitute for specific professional advice tailored to particular circumstances. The overview was prepared with the assistance of associate Anastasiia Havryliuk.