On Personal Data Protection

In the text of the Law, the words "owner of the personal data base" and "processor of the personal data base" in all cases and numbers have been replaced, respectively, with the words "personal data owner" and "personal data processor" in the corresponding case and number pursuant to Law No. 5491-VI of 20.11.2012} Article 1. Scope of the Law This Law regulates legal relations connected with the protection and processing of personal data, and is aimed at protecting the fundamental rights and freedoms of a person and citizen, in particular the right to non-interference in private life, in connection with the processing of personal data. This Law applies to personal data processing activities carried out wholly or partly with the use of automated means, as well as to the processing of personal data contained in a filing system or intended to be entered into a filing system, with the use of non-automated means. {Part three of Article 1 was deleted pursuant to Law No. 383-VII of 03.07.2013} {Part four of Article 1 was deleted pursuant to Law No. 383-VII of 03.07.2013} {Article 1 in the wording of Law No. 5491-VI of 20.11.2012} Article 2. Definitions of Terms In this Law, the terms below are used in the following meaning: personal data base - a named set of ordered personal data in electronic form and/or in the form of personal data filing systems; personal data owner - a natural or legal person who determines the purpose of personal data processing, establishes the composition of this data and the procedures for its processing, unless otherwise determined by law; {Paragraph three of Article 2 as amended pursuant to Law No. 5491-VI of 20.11.2012; in the wording of Law No. 383-VII of 03.07.2013} consent of the personal data subject - a voluntary expression of will of a natural person (provided that the person is informed) to grant permission for the processing of his or her personal data in accordance with the formulated purpose of their processing, expressed in writing or in a form that makes it possible to conclude that consent has been given. In the field of electronic commerce, the consent of the personal data subject may be given during registration in the information and communication system of an electronic commerce entity by ticking a box confirming permission to process his or her personal data in accordance with the formulated purpose of their processing, provided that such a system does not create opportunities for the processing of personal data before the box is ticked; {Paragraph four of Article 2 in the wording of Law No. 1262-VII of 13.05.2014; as amended pursuant to Laws No. 675-VIII of 03.09.2015, No. 1089-IX of 16.12.2020} {Paragraph five of Article 2 was deleted pursuant to Law No. 383-VII of 03.07.2013} depersonalization of personal data - removal of information that makes it possible to directly or indirectly identify a person; {Paragraph six of Article 2 as amended pursuant to Law No. 5491-VI of 20.11.2012} filing system - any structured personal data accessible by specified criteria, regardless of whether such data is centralized, decentralized or divided on a functional or geographical basis; {Article 2 was supplemented with a term pursuant to Law No. 5491-VI of 20.11.2012} personal data processing - any action or set of actions, such as collection, registration, accumulation, storage, adaptation, alteration, renewal, use and dissemination (distribution, sale, transfer), depersonalization, destruction of personal data, including with the use of information (automated) systems; {Paragraph of Article 2 in the wording of Law No. 5491-VI of 20.11.2012} recipient - a natural or legal person to whom personal data is provided, including a third party; {Article 2 was supplemented with a term pursuant to Law No. 5491-VI of 20.11.2012} personal data - information or a set of information about a natural person who is identified or can be specifically identified; personal data processor - a natural or legal person who has been granted the right by the personal data owner or by law to process this data on behalf of the owner; {Paragraph eleven of Article 2 as amended pursuant to Law No. 5491-VI of 20.11.2012} personal data subject - a natural person whose personal data is processed; {Paragraph twelve of Article 2 in the wording of Law No. 383-VII of 03.07.2013} third party - any person, with the exception of the personal data subject, the personal data owner or processor, and the Ukrainian Parliament Commissioner for Human Rights, to whom the personal data owner or processor transfers personal data. {Paragraph thirteen of Article 2 in the wording of Law No. 383-VII of 03.07.2013} Article 3. Legislation on Personal Data Protection The legislation on personal data protection consists of the Constitution of Ukraine, this Law, other laws and by-laws, and international treaties of Ukraine the binding nature of which has been consented to by the Verkhovna Rada of Ukraine. Article 4. Subjects of Relations Connected with Personal Data 1. The subjects of relations connected with personal data are: the personal data subject; the personal data owner; the personal data processor; the third party; the Ukrainian Parliament Commissioner for Human Rights (hereinafter - the Commissioner). {Paragraph six of part one of Article 4 in the wording of Law No. 383-VII of 03.07.2013} {Paragraph seven of part one of Article 4 was deleted pursuant to Law No. 5491-VI of 20.11.2012} 2. Enterprises, institutions and organizations of all forms of ownership, state authorities or local self-government bodies, and natural persons - entrepreneurs who process personal data in accordance with the law may be personal data owners or processors. 3. Only an enterprise of state or communal ownership may be a personal data processor, in addition to state authorities or local self-government bodies, where the owner of the personal data is a state authority or a local self-government body. {Part three of Article 4 as amended pursuant to Law No. 5491-VI of 20.11.2012; in the wording of Law No. 1907-IX of 18.11.2021} 4. The personal data owner may entrust the processing of personal data to a personal data processor under a contract concluded in writing. {Article 4 was supplemented with part four pursuant to Law No. 5491-VI of 20.11.2012} 5. The personal data processor may process personal data only for the purpose and to the extent specified in the contract. {Article 4 was supplemented with part five pursuant to Law No. 5491-VI of 20.11.2012} Article 5. Objects of Protection 1. Personal data is the object of protection. 2. Personal data may be classified as confidential information about a person by law or by the person concerned. Personal data relating to the exercise of official or service powers by a person authorized to perform the functions of the state or local self-government is not confidential information. {Part two of Article 5 as amended pursuant to Law No. 524-IX of 04.03.2020} 3. Personal data indicated in the declaration of a person authorized to perform the functions of the state or local self-government, completed in the form determined in accordance with the Law of Ukraine "On Prevention of Corruption", does not belong to information with restricted access, except for the information specified by the Law of Ukraine "On Prevention of Corruption". {Paragraph one of part three of Article 5 in the wording of Law No. 524-IX of 04.03.2020} Information on the receipt in any form by a natural person of budget funds, state or communal property, and on the structure, principles of formation and amount of remuneration, reward and additional benefits of the head or deputy head of a legal entity of public law, of the head, deputy head or member of the supervisory board of a state or communal enterprise or of a state or communal organization aimed at making a profit, and of a person who permanently or temporarily holds the position of a member of the executive body or is a member of the supervisory board of a business company in whose authorized capital more than 50 percent of the shares (stakes, units) directly or indirectly belong to the state and/or a territorial community, does not belong to information with restricted access, except for the cases provided for by Article 6 of the Law of Ukraine "On Access to Public Information". {Paragraph two of part three of Article 5 in the wording of Law No. 1723-IX of 08.09.2021} Information on natural persons who have tax debt, which is published on the official web portal of the central executive authority implementing the state tax policy in accordance with the requirements of paragraph 35.4 of Article 35 of the Tax Code of Ukraine, does not belong to information with restricted access. {Part three of Article 5 was supplemented with a new paragraph pursuant to Law No. 1914-IX of 30.11.2021} The classification of other information constituting personal data as information with restricted access may be prohibited by law. {Article 5 as amended pursuant to Law No. 5491-VI of 20.11.2012; in the wording of Law No. 1170-VII of 27.03.2014} Article 6. General Requirements for the Processing of Personal Data 1. The purpose of personal data processing must be formulated in laws, other regulatory legal acts, regulations, founding or other documents governing the activities of the personal data owner, and must comply with the legislation on personal data protection. Personal data is processed openly and transparently, using means and in a manner that correspond to the defined purposes of such processing. {Part one of Article 6 was supplemented with a new paragraph pursuant to Law No. 5491-VI of 20.11.2012} If the defined purpose of personal data processing is changed to a new purpose that is incompatible with the previous one, the personal data owner must, for further processing of the data, obtain the consent of the personal data subject to the processing of his or her data in accordance with the changed purpose, unless otherwise provided by law. {Paragraph three of part one of Article 6 as amended pursuant to Law No. 5491-VI of 20.11.2012; in the wording of Law No. 383-VII of 03.07.2013} 2. Personal data must be accurate, reliable and updated as necessary, as determined by the purpose of its processing. {Part two of Article 6 in the wording of Law No. 5491-VI of 20.11.2012} 3. The composition and content of personal data must be relevant, adequate and not excessive in relation to the defined purpose of its processing. {Paragraph one of part three of Article 6 as amended pursuant to Law No. 5491-VI of 20.11.2012} {Paragraph two of part three of Article 6 was deleted pursuant to Law No. 5491-VI of 20.11.2012} 4. The primary sources of information about a natural person are: documents issued in his or her name; documents signed by him or her; information that the person provides about himself or herself. 5. The processing of personal data is carried out for specific and lawful purposes defined with the consent of the personal data subject, or in cases provided for by the laws of Ukraine, in the manner established by legislation. {Part five of Article 6 in the wording of Law No. 1907-IX of 18.11.2021; as amended pursuant to Laws No. 1971-IX of 16.12.2021, No. 2075-IX of 17.02.2022} 6. The processing of data about a natural person that is confidential information without his or her consent is not permitted, except in cases determined by law and only in the interests of national security, economic well-being and human rights. {Part six of Article 6 as amended pursuant to Law No. 1170-VII of 27.03.2014} 7. If the processing of personal data is necessary to protect the vital interests of the personal data subject, personal data may be processed without his or her consent until the time when it becomes possible to obtain consent. 8. Personal data is processed in a form that permits identification of the natural person to whom it relates for no longer than is necessary for the lawful purposes for which it was collected or subsequently processed. Further processing of personal data for historical, statistical or scientific purposes may be carried out provided that its proper protection is ensured. {Part eight of Article 6 in the wording of Law No. 383-VII of 03.07.2013} {Part nine of Article 6 was deleted pursuant to Law No. 383-VII of 03.07.2013} 10. The standard procedure for the processing of personal data is approved by the Commissioner. {Part ten of Article 6 as amended pursuant to Laws No. 4452-VI of 23.02.2012, No. 5491-VI of 20.11.2012; in the wording of Laws No. 383-VII of 03.07.2013, No. 1262-VII of 13.05.2014} Article 7. Special Requirements for the Processing of Personal Data 1. The processing of personal data concerning racial or ethnic origin, political, religious or ideological beliefs, membership in political parties and trade unions, conviction to criminal punishment, as well as data relating to health, sex life, biometric or genetic data, is prohibited. {Part one of Article 7 as amended pursuant to Law No. 5491-VI of 20.11.2012; in the wording of Law No. 383-VII of 03.07.2013} 2. The provisions of part one of this Article do not apply if the processing of personal data: 1) is carried out provided that the personal data subject has given unambiguous consent to the processing of such data; 2) is necessary for the exercise of the rights and performance of the obligations of the owner in the field of labor legal relations in accordance with the law, with appropriate protection ensured; {Paragraph 2 of part two of Article 7 as amended pursuant to Law No. 5491-VI of 20.11.2012} 3) is necessary to protect the vital interests of the personal data subject or another person in the event of legal incapacity or limited civil legal capacity of the personal data subject; {Paragraph 3 of part two of Article 7 as amended pursuant to Law No. 5491-VI of 20.11.2012} 4) is carried out, with appropriate protection ensured, by a religious organization, a public organization of an ideological orientation, a political party or a trade union established in accordance with the law, provided that the processing concerns solely the personal data of members of these associations or of persons who maintain regular contact with them in connection with the nature of their activities, and the personal data is not transferred to a third party without the consent of the personal data subjects; {Paragraph 4 of part two of Article 7 as amended pursuant to Law No. 5491-VI of 20.11.2012} 5) is necessary for the substantiation, satisfaction or defense of a legal claim; 6) is necessary for health protection purposes for: establishing a medical diagnosis, ensuring care or treatment or providing medical services, monitoring compliance with the established conditions for providing such services (including the terms of contracts for medical care of the population and reimbursement contracts under the program of medical guarantees), and the functioning of the electronic healthcare system, provided that such data is processed by a medical worker, a rehabilitation specialist or another person of a healthcare institution or rehabilitation institution, or by a natural person - entrepreneur who has obtained a license to conduct business activities in medical practice, and by his or her employees who are charged with the duties of ensuring the protection of personal data and are subject to the legislation on medical confidentiality, by employees of the central executive authority implementing the state policy in the field of state financial guarantees of medical care of the population, and by employees of an institution carrying out state sanitary and epidemiological supervision and activities in the field of public health that has obtained a license to conduct business activities in medical practice, who are charged with the duties of ensuring the protection of personal data; {Paragraph two of paragraph 6 of part two of Article 7 in the wording of Law No. 2347-IX of 01.07.2022} monitoring the quality of medical services, provided that such data is processed by employees of the central executive authority implementing the state policy in the field of quality control of medical services; {Paragraph three of paragraph 6 of part two of Article 7 enters into force on 1 January 2023} exchanging information on the financing of medical services and services in the field of healthcare, provided that such data is processed by employees of the Social Insurance Fund of Ukraine, the Pension Fund of Ukraine, the Fund for Social Protection of Persons with Disabilities, and the central executive authority ensuring the formation and implementing the state financial and budget policy, who are charged with the duties of ensuring the protection of personal data. {Paragraph 6 of part two of Article 7 in the wording of Laws No. 5491-VI of 20.11.2012, No. 2168-VIII of 19.10.2017, No. 1962-IX of 15.12.2021} 6-1) is necessary for the purposes of ensuring military registration of conscripts, persons liable for military service and reservists (in the scope of data specified in Article 7 of the Law of Ukraine "On the Unified State Register of Conscripts, Persons Liable for Military Service and Reservists"); {Part two of Article 7 was supplemented with paragraph 6-1 pursuant to Law No. 1357-IX of 30.03.2021} 7) relates to court sentences, the performance of tasks of operative-search or counterintelligence activities, the fight against terrorism, and is carried out by a state authority within the limits of its powers determined by law; {Paragraph 7 of part two of Article 7 as amended pursuant to Law No. 245-VII of 16.05.2013; in the wording of Law No. 383-VII of 03.07.2013} 8) relates to data that was manifestly made public by the personal data subject. {Paragraph 8 of part two of Article 7 as amended pursuant to Law No. 383-VII of 03.07.2013} Article 8. Rights of the Personal Data Subject 1. The personal non-property rights to personal data that every natural person has are inalienable and inviolable. 2. The personal data subject has the right to: 1) know about the sources of collection and the location of his or her personal data, the purpose of its processing, the location or place of residence (stay) of the personal data owner or processor, or give an appropriate instruction to persons authorized by him or her to obtain this information, except in cases established by law; {Paragraph 1 of part two of Article 8 as amended pursuant to Law No. 5491-VI of 20.11.2012; in the wording of Law No. 383-VII of 03.07.2013} 2) receive information on the conditions of access to personal data, in particular information on third parties to whom his or her personal data is transferred; {Paragraph 2 of part two of Article 8 as amended pursuant to Law No. 5491-VI of 20.11.2012} 3) access his or her personal data; {Paragraph 3 of part two of Article 8 as amended pursuant to Law No. 5491-VI of 20.11.2012} 4) receive, no later than thirty calendar days from the date of receipt of the request, except in cases provided for by law, a response as to whether his or her personal data is being processed, and receive the content of such personal data; {Paragraph 4 of part two of Article 8 in the wording of Law No. 383-VII of 03.07.2013} 5) present a reasoned demand to the personal data owner objecting to the processing of his or her personal data; {Paragraph 5 of part two of Article 8 in the wording of Law No. 5491-VI of 20.11.2012} 6) present a reasoned demand to any personal data owner and processor to change or destroy his or her personal data if this data is processed unlawfully or is inaccurate; {Paragraph 6 of part two of Article 8 as amended pursuant to Law No. 5491-VI of 20.11.2012} 7) protect his or her personal data from unlawful processing and from accidental loss, destruction, damage due to deliberate concealment, failure to provide or untimely provision of it, as well as protection from the provision of information that is inaccurate or that discredits the honor, dignity and business reputation of a natural person; 8) file complaints about the processing of his or her personal data with the Commissioner or with a court; {Paragraph 8 of part two of Article 8 in the wording of Law No. 5491-VI of 20.11.2012; as amended pursuant to Law No. 383-VII of 03.07.2013} 9) apply legal remedies in the event of a violation of the legislation on personal data protection; 10) make reservations regarding the restriction of the right to process his or her personal data when giving consent; {Part two of Article 8 was supplemented with paragraph 10 pursuant to Law No. 5491-VI of 20.11.2012} 11) withdraw consent to the processing of personal data; {Part two of Article 8 was supplemented with paragraph 11 pursuant to Law No. 5491-VI of 20.11.2012} 12) know the mechanism of automatic processing of personal data; {Part two of Article 8 was supplemented with paragraph 12 pursuant to Law No. 5491-VI of 20.11.2012} 13) be protected from an automated decision that has legal consequences for him or her. {Part two of Article 8 was supplemented with paragraph 13 pursuant to Law No. 5491-VI of 20.11.2012} {Part three of Article 8 was deleted pursuant to Law No. 383-VII of 03.07.2013} Article 9. Notification of the Processing of Personal Data 1. The personal data owner notifies the Commissioner of the processing of personal data that poses a special risk to the rights and freedoms of personal data subjects within thirty working days from the date of commencement of such processing. The types of personal data processing that pose a special risk to the rights and freedoms of personal data subjects, and the categories of subjects to which the notification requirement applies, are determined by the Commissioner. 2. The notification of the processing of personal data is submitted in the form and in the manner determined by the Commissioner. 3. The personal data owner is obliged to notify the Commissioner of every change in the information subject to notification within ten working days from the date of such change. 4. The information notified in accordance with this Article is subject to publication on the official website of the Commissioner in the manner determined by the Commissioner. {Article 9 as amended pursuant to Law No. 5491-VI of 20.11.2012; in the wording of Law No. 383-VII of 03.07.2013} Article 10. Use of Personal Data 1. The use of personal data involves any actions of the owner regarding the processing of this data, actions regarding its protection, as well as actions regarding the granting of a partial or full right to process personal data to other subjects of relations connected with personal data, which are carried out with the consent of the personal data subject or in accordance with the law. {Part one of Article 10 as amended pursuant to Law No. 5491-VI of 20.11.2012} 2. The use of personal data by the owner is carried out provided that the owner creates conditions for the protection of this data. The owner is prohibited from disclosing information regarding personal data subjects whose personal data is made accessible to other subjects of relations connected with such data. {Part two of Article 10 as amended pursuant to Law No. 5491-VI of 20.11.2012} 3. The use of personal data by employees of the subjects of relations connected with personal data must be carried out only in accordance with their professional, official or employment duties. These employees are obliged not to allow the disclosure in any way of personal data that has been entrusted to them or that has become known to them in connection with the performance of professional, official or employment duties, except in cases provided for by law. Such obligation remains valid after they cease activities connected with personal data, except in cases established by law. {Part three of Article 10 as amended pursuant to Law No. 1170-VII of 27.03.2014} 4. Information about the private life of a natural person may not be used as a factor confirming or refuting his or her business qualities. 5. If a person who is a resident of Diia City in accordance with the Law of Ukraine "On Stimulating the Development of the Digital Economy in Ukraine" acts as a subject of relations connected with personal data, the use of such personal data by gig specialists of the Diia City resident must be carried out only in accordance with their duties under gig contracts. These gig specialists are obliged not to allow the disclosure in any way of personal data that has been entrusted to them or that has become known to them in connection with the performance of duties under a gig contract, except in cases provided for by law. Such obligation remains valid after they cease activities connected with personal data, except in cases established by law. {Article 10 was supplemented with part five pursuant to Law No. 1667-IX of 15.07.2021} Article 11. Grounds for the Processing of Personal Data 1. The grounds for the processing of personal data are: 1) the consent of the personal data subject to the processing of his or her personal data; 2) permission to process personal data granted to the personal data owner in accordance with the law solely for the exercise of his or her powers; 3) the conclusion and performance of a transaction to which the personal data subject is a party or which has been concluded in favor of the personal data subject or for the purpose of taking measures preceding the conclusion of a transaction at the request of the personal data subject; 4) protection of the vital interests of the personal data subject; 5) the necessity of performing an obligation of the personal data owner provided for by law; {Part one of Article 11 was supplemented with a new paragraph pursuant to Law No. 383-VII of 03.07.2013} 6) the necessity of protecting the legitimate interests of the personal data owner or of a third party to whom personal data is transferred, except where the needs of protecting the fundamental rights and freedoms of the personal data subject in connection with the processing of his or her data override such interests. {Paragraph 6 of part one of Article 11 in the wording of Law No. 383-VII of 03.07.2013} {Article 11 as amended by Law No. 5491-VI of 20.11.2012} Article 12. Collection of personal data 1. Collection of personal data is a component of the process of their processing, which involves actions for selecting or arranging information about an individual. {Part one of Article 12 as amended in accordance with Law No. 5491-VI of 20.11.2012} 2. The personal data subject shall be notified of the personal data owner, the composition and content of the personal data collected, his or her rights defined by this Law, the purpose of the collection of personal data and the persons to whom his or her personal data are transferred: at the moment of collection of personal data, if the personal data are collected from the personal data subject; in other cases, within thirty business days from the date of collection of personal data. {Part two of Article 12 as amended by Laws No. 5491-VI of 20.11.2012, No. 383-VII of 03.07.2013} {Part three of Article 12 deleted on the basis of Law No. 5491-VI of 20.11.2012} {Part four of Article 12 deleted on the basis of Law No. 5491-VI of 20.11.2012} Article 13. Accumulation and storage of personal data 1. Accumulation of personal data involves actions to combine and systematize information about an individual or a group of individuals, or to enter these data into a personal data database. 2. Storage of personal data involves actions to ensure their integrity and an appropriate regime of access to them. Article 14. Dissemination of personal data 1. Dissemination of personal data involves actions to transfer information about an individual with the consent of the personal data subject. {Part one of Article 14 as amended in accordance with Law No. 5491-VI of 20.11.2012} 2. Dissemination of personal data without the consent of the personal data subject or a person authorized by him or her is permitted in cases specified by law, and only (if necessary) in the interests of national security, economic well-being, human rights and for conducting the All-Ukrainian Population Census. {Part two of Article 14 as amended in accordance with Law No. 5491-VI of 20.11.2012; as amended by Law No. 2438-IX of 19.07.2022 - regarding entry into force see paragraph 2} 3. Compliance with the requirements of the established regime of personal data protection shall be ensured by the party disseminating these data. 4. The party to whom personal data are transferred must first take measures to ensure compliance with the requirements of this Law. Article 15. Deletion or destruction of personal data {Title of Article 15 as amended by Law No. 5491-VI of 20.11.2012} 1. Personal data shall be deleted or destroyed in the manner established in accordance with the requirements of the law. {Part one of Article 15 as amended in accordance with Law No. 5491-VI of 20.11.2012} 2. Personal data are subject to deletion or destruction in the event of: {Paragraph one of part two of Article 15 as amended in accordance with Law No. 383-VII of 03.07.2013} 1) expiry of the data storage period specified by the consent of the personal data subject to the processing of these data or by law; 2) termination of the legal relationship between the personal data subject and the owner or processor, unless otherwise provided by law; 3) issuance of a corresponding order by the Commissioner or the officials of the Commissioner's Secretariat designated by the Commissioner; {Subitem 3 of part two of Article 15 as amended by Law No. 383-VII of 03.07.2013} 4) entry into legal force of a court decision on deletion or destruction of personal data. {Part two of Article 15 supplemented with subitem 4 in accordance with Law No. 383-VII of 03.07.2013} 3. Personal data collected in violation of the requirements of this Law are subject to deletion or destruction in the manner established by legislation. {Part three of Article 15 as amended in accordance with Law No. 383-VII of 03.07.2013} 4. Personal data collected during the performance of tasks of operational-search or counterintelligence activity or of combating terrorism shall be deleted or destroyed in accordance with the requirements of the law. {Part four of Article 15 as amended in accordance with Law No. 383-VII of 03.07.2013} {Text of Article 15 as amended in accordance with Law No. 5491-VI of 20.11.2012} Article 16. Procedure for access to personal data 1. The procedure for access of third parties to personal data is determined by the terms of the personal data subject's consent to the processing of these data, given to the personal data owner, or in accordance with the requirements of the law. The procedure for access of third parties to personal data held by a public information administrator is determined by the Law of Ukraine "On Access to Public Information", except for data received from other bodies by the central executive body that ensures the formation and implements the state financial and budgetary policy, in the course of verification and monitoring of state payments. {Part one of Article 16 as amended in accordance with Laws No. 1170-VII of 27.03.2014, No. 1774-VIII of 06.12.2016; as amended by Law No. 324-IX of 03.12.2019} 2. Access to personal data shall not be granted to a third party if that person refuses to undertake obligations to ensure compliance with the requirements of this Law or is unable to ensure them. 3. A subject of relations connected with personal data submits a request for access (hereinafter - the request) to personal data to the personal data owner. 4. The request shall specify: 1) surname, first name and patronymic, place of residence (place of stay) and details of the document certifying the identity of the individual submitting the request (for an individual applicant); 2) name and location of the legal entity submitting the request, position, surname, first name and patronymic of the person certifying the request; confirmation that the content of the request corresponds to the powers of the legal entity (for a legal entity applicant); 3) surname, first name and patronymic, as well as other information that makes it possible to identify the individual in respect of whom the request is made; 4) information about the personal data database in respect of which the request is submitted, or information about the owner or processor of personal data; {Item 4 of part four of Article 16 as amended in accordance with Law No. 5491-VI of 20.11.2012} 5) a list of the personal data requested; 6) the purpose and/or legal grounds for the request. {Item 6 of part four of Article 16 as amended in accordance with Law No. 5491-VI of 20.11.2012} 5. The period for examining a request with a view to granting it may not exceed ten business days from the date of its receipt. During this period, the personal data owner shall notify the person submitting the request that the request will be granted or that the relevant personal data are not subject to disclosure, indicating the ground specified in the relevant regulatory legal act. The request shall be granted within thirty calendar days from the date of its receipt, unless otherwise provided by law. 6. The personal data subject has the right to obtain any information about himself or herself from any subject of relations connected with personal data, provided that the information specified in item 1 of part four of this Article is provided, except in cases established by law. {Part six of Article 16 as amended in accordance with Law No. 5491-VI of 20.11.2012} Article 17. Deferral of or refusal of access to personal data 1. Deferral of the personal data subject's access to his or her own personal data is not permitted. 2. Deferral of access to personal data of third parties is permitted if the required data cannot be provided within thirty calendar days from the date of receipt of the request. In this case, the total period for resolving the issues raised in the request may not exceed forty-five calendar days. The notice of deferral shall be brought to the attention of the third party who submitted the request in writing, with an explanation of the procedure for appealing such a decision. The notice of deferral shall specify: 1) surname, first name and patronymic of the official; 2) date of sending of the notice; 3) reason for the deferral; 4) the period within which the request will be granted. 3. Refusal of access to personal data is permitted if access to them is prohibited by law. The notice of refusal shall specify: 1) surname, first name and patronymic of the official who refuses access; 2) date of sending of the notice; 3) reason for the refusal. Article 18. Appeal against a decision on deferral of or refusal of access to personal data 1. A decision on deferral of or refusal of access to personal data may be appealed to the Ukrainian Parliament Commissioner for Human Rights or to a court. {Part one of Article 18 as amended by Law No. 5491-VI of 20.11.2012; as amended in accordance with Law No. 383-VII of 03.07.2013} 2. If the request was made by the personal data subject regarding data about himself or herself, the burden of proving in court the lawfulness of the refusal of access lies with the personal data owner to whom the request was submitted. {Part two of Article 18 as amended in accordance with Law No. 5491-VI of 20.11.2012} Article 19. Payment for access to personal data 1. Access of the personal data subject to data about himself or herself is provided free of charge. 2. Access of other subjects of relations connected with personal data to the personal data of a particular individual or group of individuals may be paid if the conditions defined by this Law are met. Payment is due for the work connected with the processing of personal data, as well as for the work of consulting and organizing access to the relevant data. 3. The amount of the fee for services of providing access to personal data by public authorities is determined by the Cabinet of Ministers of Ukraine. 4. Public authorities and local self-government bodies have the right to unhindered and free access to personal data in accordance with their powers. Article 20. Amendments and additions to personal data 1. Personal data owners or processors are obliged to amend personal data on the basis of a reasoned written demand of the personal data subject. {Part one of Article 20 as amended in accordance with Law No. 383-VII of 03.07.2013} 2. Personal data owners or processors are also obliged to amend personal data upon the request of other subjects of relations connected with personal data, if the personal data subject has consented to this, or the relevant amendment is made in accordance with an order of the Commissioner or the officials of the Commissioner's Secretariat designated by the Commissioner, or by a court decision that has entered into legal force. {Part two of Article 20 as amended by Law No. 383-VII of 03.07.2013} 3. Personal data that are inaccurate shall be amended without delay from the moment the inaccuracy is established. Article 21. Notification of actions with personal data 1. The personal data owner shall notify the personal data subject of the transfer of personal data to a third party within ten business days, if this is required by the terms of his or her consent or unless otherwise provided by law. 2. The notifications specified in part one of this Article shall not be made in the case of: 1) transfer of personal data upon requests in the performance of tasks of operational-search or counterintelligence activity or of combating terrorism; 2) performance by public authorities and local self-government bodies of their powers provided for by law; 3) processing of personal data for historical, statistical or scientific purposes; 4) notification of the personal data subject in accordance with the requirements of part two of Article 12 of this Law. {Part two of Article 21 supplemented with item 4 in accordance with Law No. 5491-VI of 20.11.2012} 3. The personal data owner shall notify the personal data subject, as well as the subjects of relations connected with personal data to whom these data were transferred, of the amendment, deletion or destruction of personal data or of the restriction of access to them within ten business days. {Part three of Article 21 as amended in accordance with Law No. 383-VII of 03.07.2013} Article 22. Control over compliance with legislation on personal data protection 1. Control over compliance with legislation on personal data protection, within the powers provided for by law, is exercised by the following bodies: 1) the Commissioner; 2) the courts. {Article 22 as amended in accordance with Law No. 5491-VI of 20.11.2012; text of Article 22 as amended by Law No. 383-VII of 03.07.2013} Article 23. Powers of the Ukrainian Parliament Commissioner for Human Rights in the field of personal data protection 1. The Commissioner has the following powers in the field of personal data protection: 1) to receive proposals, complaints and other appeals of individuals and legal entities on personal data protection issues and to make decisions based on the results of their consideration; 2) to conduct, on the basis of appeals or on his or her own initiative, on-site and off-site, scheduled and unscheduled inspections of personal data owners or processors in the manner determined by the Commissioner, ensuring, in accordance with the law, access to the premises where personal data are processed; 3) to receive upon his or her demand and have access to any information (documents) of personal data owners or processors that is necessary for exercising control over the provision of personal data protection, including access to personal data, the relevant databases or card indexes, and restricted-access information; 4) to approve regulatory legal acts in the field of personal data protection in the cases provided for by this Law; 5) following the results of an inspection or the consideration of an appeal, to issue binding demands (orders) to prevent or eliminate violations of legislation on personal data protection, including regarding the amendment, deletion or destruction of personal data, ensuring access to them, providing or prohibiting their provision to a third party, and suspending or terminating the processing of personal data; 6) to provide recommendations on the practical application of legislation on personal data protection, to explain the rights and obligations of the relevant persons upon the appeal of personal data subjects, personal data owners or processors, structural units or responsible persons for organizing the work on personal data protection, and other persons; 7) to interact with the structural units or responsible persons who, in accordance with this Law, organize the work connected with the protection of personal data during their processing; to publish information about such structural units and responsible persons; 8) to submit proposals to the Verkhovna Rada of Ukraine, the President of Ukraine, the Cabinet of Ministers of Ukraine, other state bodies, local self-government bodies and their officials on the adoption of or amendments to regulatory legal acts on personal data protection issues; 9) to provide, upon the appeal of professional, self-governing and other public associations or legal entities, opinions on draft codes of conduct in the field of personal data protection and amendments thereto; 10) to draw up reports on bringing to administrative liability and send them to the court in the cases provided for by law; 11) to inform about legislation on personal data protection issues, the problems of its practical application, and the rights and obligations of subjects of relations connected with personal data; 12) to monitor new practices, trends and technologies of personal data protection; 13) to organize and ensure interaction with foreign subjects of relations connected with personal data, including in connection with the implementation of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and the Additional Protocol thereto, and other international treaties of Ukraine in the field of personal data protection; 14) to participate in the work of international organizations on personal data protection issues. 2. The Ukrainian Parliament Commissioner for Human Rights includes in his or her annual report on the state of observance and protection of human and citizen rights and freedoms in Ukraine a report on the state of compliance with legislation in the field of personal data protection. {Article 23 as amended in accordance with Law No. 5491-VI of 20.11.2012; as amended by Law No. 383-VII of 03.07.2013} Article 24. Ensuring personal data protection 1. Personal data owners, processors and third parties are obliged to ensure the protection of these data against accidental loss or destruction, and against unlawful processing, including unlawful destruction of or access to personal data. 2. In public authorities, local self-government bodies, as well as in personal data owners or processors that carry out personal data processing subject to notification in accordance with this Law, a structural unit or a responsible person is created (designated) to organize the work connected with the protection of personal data during their processing. Information about the said structural unit or responsible person shall be communicated to the Ukrainian Parliament Commissioner for Human Rights, who ensures its publication. 3. The structural unit or responsible person that organizes the work connected with the protection of personal data during their processing: 1) informs and advises the personal data owner or processor on compliance with legislation on personal data protection; 2) interacts with the Ukrainian Parliament Commissioner for Human Rights and the officials of his or her Secretariat designated by the Commissioner on issues of preventing and eliminating violations of legislation on personal data protection. 4. Individual entrepreneurs, including doctors holding the appropriate license, advocates and notaries, shall personally ensure the protection of personal data that they hold, in accordance with the requirements of the law. {Article 24 as amended in accordance with Law No. 5491-VI of 20.11.2012; as amended by Law No. 383-VII of 03.07.2013} Article 25. Restriction of the effect of this Law 1. Restriction of the effect of Articles 6, 7 and 8 of this Law may be carried out in the cases provided for by law, to the extent necessary in a democratic society in the interests of national security, economic well-being or the protection of the rights and freedoms of personal data subjects or other persons. 2. Processing of personal data without application of the provisions of this Law is permitted if such processing is carried out: 1) by an individual solely for personal or household needs; 2) solely for journalistic and creative purposes, provided that a balance is ensured between the right to respect for private life and the right to freedom of expression. 3. This Law does not apply to relations concerning the receipt of archival information of repressive bodies. {Article 25 supplemented with part three in accordance with Law No. 316-VIII of 09.04.2015} {Article 25 as amended by Law No. 383-VII of 03.07.2013} Article 26. Financing of work on personal data protection Financing of work and measures to ensure the protection of personal data is carried out at the expense of the State Budget of Ukraine and local budgets, and the funds of subjects of relations connected with personal data. Article 27. Application of the provisions of this Law 1. The provisions on personal data protection set out in this Law may be supplemented or clarified by other laws, provided that they establish requirements for personal data protection that do not contradict the requirements of this Law. 2. Professional, self-governing and other public associations or legal entities may develop codes of conduct in order to ensure effective protection of the rights of personal data subjects and compliance with legislation on personal data protection, taking into account the specifics of personal data processing in various fields. When developing such a code of conduct or amending it, the relevant association or legal entity may apply to the Commissioner for an opinion. {Part two of Article 27 as amended in accordance with Law No. 5491-VI of 20.11.2012; as amended by Law No. 383-VII of 03.07.2013} Article 28. Liability for violation of legislation on personal data protection Violation of legislation on personal data protection entails liability established by law. Article 29. International cooperation and transfer of personal data {Title of Article 29 as amended by Law No. 5491-VI of 20.11.2012} 1. Cooperation with foreign subjects of relations connected with personal data is governed by the Constitution of Ukraine, this Law, other regulatory legal acts and international treaties of Ukraine. 2. If an international treaty of Ukraine, consent to the binding nature of which has been given by the Verkhovna Rada of Ukraine, establishes rules other than those provided for by the legislation of Ukraine, the rules of the international treaty of Ukraine shall apply. 3. Transfer of personal data to foreign subjects of relations connected with personal data is carried out only on condition that the relevant state ensures proper protection of personal data, in the cases established by law or an international treaty of Ukraine. States that are parties to the European Economic Area, as well as states that have signed the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, are recognized as ensuring an adequate level of personal data protection. The Cabinet of Ministers of Ukraine determines the list of states that ensure proper protection of personal data. Personal data may not be disseminated for any purpose other than the one for which they were collected. {Part three of Article 29 as amended by Law No. 5491-VI of 20.11.2012} 4. Personal data may be transferred to foreign subjects of relations connected with personal data also in the case of: 1) the personal data subject giving unambiguous consent to such transfer; 2) the necessity of concluding or performing a transaction between the personal data owner and a third party - the personal data subject - for the benefit of the personal data subject; 3) the necessity of protecting the vital interests of personal data subjects; 4) the necessity of protecting the public interest, and of establishing, exercising and securing a legal claim; 5) the personal data owner providing appropriate guarantees of non-interference in the private and family life of the personal data subject. {Article 29 supplemented with part four in accordance with Law No. 5491-VI of 20.11.2012} Article 30. Final provisions 1. This Law enters into force on 1 January 2011. 2. It is established that during the period of martial law in Ukraine and for six months after its termination or cancellation, as an exception to the provisions of paragraphs one to three of part three of Article 29 of this Law, the transfer of personal data to foreign subjects of relations connected with personal data that are necessary for the provision of medical care and/or rehabilitation care using telemedicine may be carried out with the protection of personal data ensured in accordance with the legislation of the country in which the medical worker, rehabilitation specialist or healthcare institution providing medical and/or rehabilitation care has been granted the right to practice medicine (except for citizens of the Russian Federation and the Republic of Belarus). {Article 30 supplemented with a new paragraph in accordance with Law No. 2494-IX of 29.07.2022} 3. The Cabinet of Ministers of Ukraine, within six months from the date of entry into force of this Law, shall: ensure the adoption of the regulatory legal acts provided for by this Law; ensure that its regulatory legal acts are brought into conformity with this Law. President of Ukraine V. YANUKOVYCH Kyiv 1 June 2010 No. 2297-VI