Draft Law No. 8153, personal data breach notification

Draft Law No. 8153, 72 hour breach notification to the National Commission

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Proposed: draft date not recorded.

A breach notification rule binding public and private bodies.

As of 19 September 2026.

What it requires

This draft has passed only a first reading and is not yet law; no breach notification duty currently attaches to it, and the following describe what enactment would require.
Once enacted, notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it.
Once enacted, include in that notification the nature of the breach, the number of affected individuals, the data types involved, the likely consequences, and the remedial measures taken.

What it reaches

Obligation class

Breach notice, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Draft Law No. 8153 would introduce a mandatory personal data breach notification duty the current 2010 law does not state at all. A controller would notify the new supervisory authority within 72 hours of becoming aware of a breach affecting personal data security, and the notification would cover the nature of the breach, the number of affected individuals, the data types involved, the likely consequences, and the remedial measures taken.

The source describes this as a significant change from the current law, which it says contains no mandatory breach notification obligation. None of this binds today: the draft has passed only a first reading and remained in second reading preparation as of the most recent source located, dated May 2026.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
processes_biometrics

Read the law

recordinglaw.com
"Ukraine Data Privacy Laws: Personal Data Protection, Draft Law 8153, and the GDPR Reform," read in full (41,934 characters, not truncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app