Law note · Ukraine
Law of Ukraine On the Protection of Personal Data
Law No. 2297-VI predates General Data Protection Regulation (GDPR) by six years and follows the older Council of Europe Convention 108 and EU Directive 95/46 model: the Ukrainian Parliament Commissioner for Human Rights (Ombudsperson) is the supervisory authority, rather than a dedicated data-protection agency, and biometric data is treated as one of several categories triggering a notification duty rather than a prohibited-unless-excepted special category.
A direct fetch of a legal-reference page confirms biometric and genetic data are listed among the categories requiring mandatory notification to the Ombudsperson before processing (Article 7), while the law's definitions provision (Article 2) does not itself define biometric data or distinguish voiceprints from faceprints, leaving no enumerated example to test for a recording-derived exclusion.
An attempt to read the consolidated statute directly at the official Rada site returned only a 33,942-character page shell with no article content, so this instrument's substantive findings rest on that direct fetch of a secondary legal-reference source rather than the primary statute text. Cross-border transfer is confirmed as a real, moderate regime: transfers proceed by default to Convention 108 signatories, EEA states, and the United States, with safeguards required elsewhere. A private right of action is confirmed, and breach notification's existence under the current law was not established.
What it asks of an app
- Establish a lawful basis before processing personal data of a person in Ukraine under Law No. 2297-VI.
- Notify the Ombudsperson before beginning to process biometric data, genetic data, health data, or another listed risky category of a person in Ukraine, under Article 7's notification-based mechanism; this law does not define biometric data anywhere, including in its Article 2 definitions.
- Rely on the law's Convention 108, EEA, and United States adequacy-by-default treatment, or a documented safeguard, before transferring personal data of a person in Ukraine outside the country.
- Expect a person in Ukraine to have both a complaint route to the Ombudsperson and a separate right to sue for compensation, including moral harm, for an infringement of this law.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, processes_voice, processes_biometrics
Primary source: recordinglaw.com legal-reference page, read directly through crawler infrastructure (205,050 characters, not truncated)
the official Rada text at zakon.rada.gov.ua returned only a metadata shell on the same attempt