The framework
Ukraine regulates personal data through Law No. 2297-VI on Personal Data Protection, dating from 2010 and supervised by the Parliament Commissioner for Human Rights.
For advertisers the consent posture matters most, and Ukraine sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Law No. 2297-VI on Personal Data Protection
Ukraine's 2010 law predates the GDPR but a full GDPR-aligned rewrite (draft law 8153) has been advancing as part of the EU accession agenda; expect the regime to converge with EU rules. Wartime data realities have also made Ukraine unusually attentive to data security.
Marketing and advertising
Consent is the primary basis under the 2010 law; a GDPR-aligned replacement (draft 8153) is pending. Most channel decisions here follow from that consent rule.
Cross-border transfers
Permitted to states with adequate protection; consent or contract otherwise.
Enforcement and penalties
Modest administrative fines; the pending bill would raise them sharply.