Rada supports draft law “On Personal Data Protection” in first reading

On November 20, the Verkhovna Rada of Ukraine adopted draft law No. 8153, “On Personal Data Protection”, in its first reading. This document serves as a new version of the current Law “On Personal Data Protection”, originally adopted in 2010. It aims to harmonise national legislation with European standards, including the GDPR and the modernised Convention 108+.

This milestone represents an important stage in reforming Ukrainian legislation on personal data protection. According to conclusions from Council of Europe experts, the draft law incorporates key provisions from Regulation (EU) 2016/679 (GDPR), Directive (EU) 2016/680 (data processing by law enforcement agencies), and Directive 2002/58 (ePrivacy).

The EU4DigitalUA FIIAPP project welcomes this achievement, as it has provided expert opinions and participated in the working group that developed this draft law. Its adoption in the first reading marks a significant step forward in legislative reform and supports Ukraine’s integration into the European data protection system.

The new draft law establishes the foundation for a modernised approach to personal data protection in Ukraine. Key provisions include:

– Establishing clear standards and principles for personal data processing in line with contemporary international requirements.
– Expanding the rights of data subjects, such as the right to be forgotten, restriction of processing, data portability, objection to processing, and protection against automated decision-making.
– Introducing the principles of “data protection by default” and “data protection by design”, ensuring a high level of privacy throughout all stages of data processing.
– Requiring mandatory notification of supervisory authorities about personal data breaches within 72 hours.
– Regulating data transfers abroad while maintaining an adequate level of protection.
– Introducing effective financial sanctions for violations, ensuring legislative enforcement.

The draft law also strengthens citizens’ control over their personal data and enhances the protection of privacy rights. This will help build trust in data processing across both public and private sectors.

The adoption of this draft law will have a significant positive impact on personal data protection in Ukraine. Primarily, it will:

– Increase legal certainty and transparency by creating clear rules for all participants in the data processing ecosystem, enabling Ukrainian citizens to better understand and defend their rights.
– Open opportunities for Ukrainian companies, particularly in the IT sector, to expand into the European market. Compliance with GDPR and international standards will serve as a competitive advantage, enhancing trust among foreign partners and customers.
– Attract foreign investment by meeting European standards in data protection, a critical condition for integration into the EU’s Digital Single Market.
– Strengthen trust in Ukrainian businesses and state institutions that process personal data, solidifying Ukraine’s position as a reliable partner in digital initiatives.

Draft law No. 8153 is a crucial step toward modernising Ukraine’s legislative framework and aligning it with European data protection norms, benefiting citizens, businesses, and the broader economy.