Ukraine lacks independent regulator for personal data protection, shadow report concludes

The current state supervision model in the sphere of personal data protection fails to meet European standards, according to a new shadow report by a coalition of civil society organisations, in partnership with the Human Rights Centre ZMINA on the implementation of European Commission recommendations within the “Fundamentals of EU Accession” cluster. In Ukraine, control of personal data protection is assigned to the Ombudsman, who lacks the authority to impose fines. This differs significantly from the European model of independent regulators with powers to impose sanctions.

Personal data protection is a fundamental human right guaranteed by Article 32 of the Constitution of Ukraine, which ensures the inviolability of private and family life. However, the current system of legal regulation and state supervision in this sphere fails to meet modern European standards, the report notes.

In particular, the 2010 Law “On Protection of Personal Data” is outdated and fails to account for a significant portion of risks associated with the development of electronic services, digital technologies and cybersecurity.

The function of control in the sphere of personal data protection in Ukraine is exercised by the Ombudsman, who is not empowered to impose administrative penalties independently, the report’s authors noted.

In 2025, the Office of the Ombudsman received 2,262 appeals from individuals and legal entities. 1,422 of them concerned unlawful processing of personal data; 157 concerned the right of access to information about oneself; 361 concerned the provision of recommendations and explanations of legislation on personal data protection; and 322 concerned issues regarding organisational processes of data processing.

Within the framework of the control function, 98 inspections regarding compliance with legislation were conducted, and 75 orders to eliminate violations were issued. Protocols on administrative offences were not drawn up in 2025. At the same time, based on materials sent by the Secretariat of the Commissioner to pre-trial investigation bodies, information on 35 violations in this sphere was entered into the Unified Register of Pre-trial Investigations.

Experts point out that the two-stage response model, in which the Ombudsman merely records a violation and initiates proceedings while a court makes the decision, creates a significant time gap between the detection of an offence and holding the offender accountable.

“Because of this, the effectiveness of the enforcement mechanism is reduced. This differs significantly from the European model of independent regulators endowed with direct corrective and sanctioning powers,” the shadow report notes.

In Ukraine, the effectiveness of this mechanism is reduced due to the heavy workload of the judicial system. This necessitates the creation of an independent state supervisory body for effective control at all levels.

In 2021, Bill No 6177, “On the National Commission for Personal Data Protection and Access to Public Information”, was developed, providing for the creation of an independent executive body with a special status to supervise compliance with legislation in these spheres. For five years, this draft law has not advanced to the next stage of consideration in the parliament.

In the 2025 report, the European Commission noted that Ukraine has not achieved significant changes in the sphere of personal data protection, meaning current legislation and the institutional capacity of state supervision do not meet EU standards.

The government’s roadmap for EU accession stipulates that the National Commission for Personal Data Protection and Access to Public Information must be launched in Ukraine by the end of 2026.

ZMINA previously wrote that Ukraine must align its legislation on personal data protection with European standards and establish a corresponding independent body during its accession to the EU. Currently, control functions are assigned to the Ombudsman and his secretariat.

According to experts’ assessments, Ukraine lacks a mechanism and laws that would help effectively protect personal data. In particular, Maksym Shcherbatiuk, programme director of the Ukrainian Helsinki Human Rights Union, drew attention to this.

Join us on  X, Bluesky and LinkedIn for daily human-rights updates – and help shape ZMINA’s English coverage by sharing your thoughts here.