Personal data protection

Almost every business processes personal data — from a customer database to CCTV. The law requires a lawful basis for that processing, and documentary evidence of it.

When to get in touch

• the company collects data on customers, employees or website users
• a privacy policy and consent forms need to be drafted
• a data subject request or a complaint has arrived
• data is to be transferred to contractors or abroad

What the lawyer does

• audits the company’s personal data processing
• identifies the lawful basis for each processing activity
• drafts policies, notices and consent forms
• prepares the documents for relationships with processors
• advises on responding to data subject requests and to incidents
• handles dealings with the supervisory authorities

Legal basis

These relations are governed by the Law of Ukraine “On Personal Data Protection”: the general requirements for processing in Article 6; the rights of the data subject in Article 8; the grounds for processing in Article 11; the collection of personal data in Article 12; notification of actions with personal data in Article 21; and securing the protection of personal data in Article 24. Companies dealing with clients in the EU also have to take European legislation into account.

Legislation and case law are updated over time; this page reflects the position as of August 2026.

Frequently asked questions

Is consent always required?

No: consent is only one of the grounds for processing; the law provides others (Article 11 of the Law). We identify the basis for each activity separately.

Does the GDPR apply in Ukraine?

In Ukraine the national Law “On Personal Data Protection” applies; the GDPR becomes relevant where the company processes the data of individuals in the EU.

Need legal assistance? Call us or leave a request — a lawyer will contact you and explain what to do in your situation.