Applicability of the Ukrainian Law on Protection of Personal Data (PDPL)

Ukraine's data protection framework is established through dedicated legislation that governs the processing of personal data within the country. The primary role of this framework is fulfilled by the Law of Ukraine "On Protection of Personal Data" (Закон України "Про захист персональних даних"), which serves as the principal legal instrument regulating personal data protection in Ukraine.

The Law of Ukraine "On Protection of Personal Data" was adopted on June 1, 2010 and became effective on January 1, 2011. This legislation established the foundational legal framework for personal data protection within Ukraine's legal system.

The most recent amendments to the act were introduced through the Law of Ukraine № 4240-IX, which was adopted on February 12, 2025 and became effective on June 14, 2025. This amending act represents the latest legislative updates to Ukraine's personal data protection framework.

Material Applicability

The Ukrainian Personal Data Protection Law (PDPL) establishes three key material applicability factors: Automated Means Criterion, Filing System Criterion, and Prospective Filing System Inclusion.

Relevant Legal Provisions

PDPL Art.1(1):

"This Law shall be applied to the activities associated with personal data processing by automated means in whole or in part, as well as with the processing of personal data contained in or to be entered into the filing system by non-automated means."

Original (Ukrainian):

"Цей Закон регулює правові відносини, пов'язані із захистом і обробкою персональних даних, і спрямований на захист основоположних прав і свобод людини і громадянина, зокрема права на невтручання в особисте життя, у зв'язку з обробкою персональних даних."

Automated Means Criterion

The law applies to data processing carried out "by automated means in whole or in part". This encompasses:

• Fully automated processing operations
• Partially automated processing activities
• Any combination of manual and automated processes

Filing System Criterion

The PDPL covers personal data processing by non-automated means when the data is:

• Structured in a filing system
• Organized for systematic retrieval
• Accessible according to specific criteria

Prospective Filing System Inclusion

The law extends to data processing activities where personal data is:

• Currently contained in a filing system
• Intended to be entered into a filing system
• Subject to future systematic organization

Territorial Applicability

No territorial applicability information was provided in the law.