In June 2011 the Parliament of Ukraine adopted the Law strengthening administrative and criminal liability for failure to comply with the data protection laws (the "Law"). The Law establishes greater sanctions (in particular, financial sanctions) for failure to comply with certain rules. For example, evasion by the data controller from the state registration of the data bases containing personal data, failure to inform the data subject about his/her rights in connection with personal data processing as well as failure to comply with the established order of personal data protection could trigger fines of up to UAH 17,000 (ca. EUR 1,700). Moreover, illegal collection, storing, or dissemination of personal data could lead to criminal liability, such as high fines or even imprisonment for up to five years.

Initially, the Law became effective on 1 January 2012. However, on 13 January 2012 the Parliament amended the Law to postpone its coming into effect until 1 July 2012. The amended Law was recently signed by the President of Ukraine and became effective on 4 February 2012.

Although the liability for the breach of data protection regulations will come into force later than initially expected, there is no reason for businesses to relax. In fact, it is a good opportunity for those companies who have not done this yet to make their internal policies and documents fully compliant with applicable data protection laws.

A further development in the area of data protection was the adoption by the Ministry of Justice of Ukraine of the Sample Order of Processing of Personal data in Databases (the "Order"). The Order sets out general requirements for organisational and technical means for personal data protection, including data in electronic form and manually processed data.

One more important document announced in January 2012 and related to data protection matters was the Decision of the Constitutional Court of Ukraine dated 20 January 2012 (the "Decision") which provided the official interpretation of the information about personal and family life of an individual and confirmed the rule requiring the data subject's consent for collection, storing, use and dissemination of such information to be obtained by any person, including state and local bodies. The Decision has a status of the law and is mandatory.


  1. Law of Ukraine On Amendments to Section II of the Law of Ukraine "On Amendments to Certain Legislative Acts Regarding Strengthening of the Liability for the Breach of Personal Data Protection Laws" Regarding Shifting the Term of its Coming into Force, No. 4343-VI, dated 13 January 2012;
  2. Order of the Ministry of Justice of Ukraine on Approval of the Sample Order of Processing of Personal data in Databases, No. 1/20314, dated 30 December 2011;
  3. Decision of the Constitutional Court of Ukraine dated 20 January 2012.

This article was written for Law-Now, CMS Cameron McKenna's free online information service. To register for Law-Now, please go to

Law-Now information is for general purposes and guidance only. The information and opinions expressed in all Law-Now articles are not necessarily comprehensive and do not purport to give professional or legal advice. All Law-Now information relates to circumstances prevailing at the date of its original publication and may not have been updated to reflect subsequent developments.

The original publication date for this article was 13/02/2012.