Data Protection Reform as a Key Factor in Ukraine’s Integration into the EU Digital Single Market

In recent years, Ukraine has been actively engaged in discussions regarding the reform of legislation in the field of personal data protection. To implement this reform, draft laws No. 8153 “On Personal Data Protection” and No. 6177 “On the National Commission for Personal Data Protection and Access to Public Information” have been developed. Both draft laws are intended to align national legislation with the requirements of the General Data Protection Regulation (GDPR) and the ePrivacy Directive, which represents an important step in Ukraine’s integration into the EU Digital Single Market. The draft law “On Personal Data Protection” was approved by the Verkhovna Rada of Ukraine in the first reading at the end of last year. The EU4DigitalUA FIAP project has provided expert opinions and participated in the working group that developed this draft law. 

One of the arguments frequently voiced in these discussions is the claim that enhanced personal data regulation allegedly hampers technological development and places Ukrainian businesses at a disadvantage compared to countries where similar standards are absent or weak. However, this argument is not sufficiently substantiated and requires a more in-depth analysis.

First, the economic aspect of this issue should be assessed in a differentiated manner. In the short term, the implementation of GDPR requirements undoubtedly imposes additional costs on businesses. However, in the long term, these costs become investments that strengthen consumer trust and enhance the reputation of companies in European and global markets. This ensures stability and long-term competitiveness.

The second aspect relates to innovation. Strengthening GDPR requirements directly stimulates innovation in Privacy-Enhancing Technologies (PET). The experience of the European Union demonstrates that GDPR has actively driven the development of innovative technologies that provide companies with competitive advantages in the digital economy. At the same time, it is necessary to consider the risks associated with excessive rigidity or formalism in regulation, which could negatively impact the pace of innovation, especially among small and medium-sized enterprises. Taking this into account, the draft laws have been developed in line with the best practices of EU member states, which have successfully balanced the protection of human rights with the flexibility needed for the development of innovative companies.

The third aspect concerns the competitiveness of Ukrainian businesses at the international level. For Ukrainian companies to enter EU markets, the implementation of GDPR standards is a necessary condition. Compliance with these standards enables the use of legal instruments for cross-border transfers of personal data, such as Standard Contractual Clauses (SCC) and Binding Corporate Rules (BCR), which significantly facilitate interaction with European partners.

It is also worth noting that modern economically developed countries, including most European countries, the United States, Canada, Australia, and several Asian countries, demonstrate a clear trend toward strengthening personal data regulation. Thus, it is strategically important for Ukraine to adapt to these trends in advance.

Finally, personal experience in the field of personal data protection over nearly 15 years provides grounds to assert that most problematic situations in this area do not result from regulation as such. In fact, most complex issues arise due to a lack of understanding of legal norms or the absence of a systematic approach. Practice shows that it is almost always possible to find a balanced, secure, and effective solution that allows for the development of technology and business while simultaneously maintaining high standards of personal data protection.

Therefore, the reform of personal data protection legislation in Ukraine is not an obstacle but a necessary condition for successful integration into the EU’s digital space and a guarantee of long-term stable development for Ukrainian society, the state, and businesses.

by Andrii Nikolaev, lawyer, lead of the personal data protection component of the EU4DigitalUA FIAP project