General definitions and scope
List of personal data databases
Purpose of personal data processing
Procedure for processing personal data: obtaining consent, informing subjects, actions with personal data
Location of the personal data database
Conditions for disclosure of personal data to third parties
Protection of personal data: methods, responsible person, employees with access, storage period
Rights of the personal data subject
Procedure for handling requests from the personal data subject
State registration of the personal data database
Personal data database — a named set of structured personal data in electronic form and/or in card files.
Responsible person — a designated individual organizing work related to the protection of personal data during processing, in accordance with the law.
Owner of the personal data database — an individual or legal entity authorized by law or the subject’s consent to process personal data.
The owner determines the purpose, scope, and procedure of data processing unless otherwise established by law.
State Register of Personal Data Databases — a unified state information system for collecting, storing, and processing data on registered personal data databases.
Public sources of personal data — directories, address books, registers, lists, catalogues, and other systematic collections of publicly available information.
Social networks and websites where users enter their personal data are not considered public sources, unless explicitly stated by the data subject.
Consent of the personal data subject — documented, voluntary permission of an individual for processing their personal data according to the defined purpose.
Anonymization — removal of data that allows a person to be identified.
Processing of personal data — any action or set of actions related to the collection, registration, storage, adaptation, modification, use, distribution, anonymization, or destruction of data.
Personal data — information about an identified or identifiable individual.
Data manager — an individual or legal entity authorized by the owner to process personal data. A technical service provider without access to the content of personal data is not considered a data manager.
Personal data subject — an individual whose personal data is processed.
Third party — any person except the data subject, the database owner, the manager, or the authorized supervisory authority.
Special category data — information on racial or ethnic origin, political, religious, or philosophical beliefs, union membership, health, or sexual life.
These Provisions are mandatory for the responsible person and employees of the seller who directly process or access personal data while performing their duties.
— Personal data database of counterparties.
— the Tax Code of Ukraine;
— the Law of Ukraine “On Accounting and Financial Reporting.”
The consent of the personal data subject must be voluntary and aligned with the defined purpose of processing.
Consent may be provided as:
— a physical document containing identifying details of the person and the document;
— an electronic document with identifying attributes;
— an electronic mark (checkbox, confirmation) recorded in the information system via technical solutions.
— the consent of the personal data subject,
or
— requirements of the law.
— refuses to comply with the Law of Ukraine “On Personal Data Protection,” or
— cannot ensure proper protection.
full name and address of the applicant;
passport or identification details (for individuals);
name and address of the legal entity;
full name of the person whose data is requested;
database name or owner information;
list of requested data;
purpose or legal basis for the request.
The requester is informed whether access will be granted.
If approved, access is provided within 30 calendar days, unless otherwise required by law.
Total period — not more than 45 days.
name of the responsible person;
date of notification;
reason for postponement;
period in which the request will be fulfilled.
name of the responsible person;
date of notification;
reason for refusal.
The database owner uses systemic, software, and communication tools to prevent:
— loss,
— theft,
— unauthorized destruction or modification,
— copying or distortion of information.
Tools comply with national and international standards.
The responsible person is appointed by internal order.
Their duties are defined in the job description.
The responsible person must:
understand relevant legislation;
define employee access procedures;
enforce internal policies and legal compliance;
develop procedures for internal control;
report violations within one working day;
store consent documents and notifications to subjects.
The responsible person may:
obtain required documents;
make copies of documents and files;
participate in discussions of data protection matters;
submit proposals for improving processes;
request explanations from employees;
sign documents within their competence.
Employees who process personal data must:
— follow applicable laws and internal procedures;
— maintain confidentiality and data integrity.
Employees must not disclose personal data in any form.
This obligation continues after employment ends, unless otherwise permitted by law.
Any person who violates the Law of Ukraine “On Personal Data Protection”
bears responsibility in accordance with legislation.
Personal data must not be stored longer than necessary for its processing purpose,
and not longer than specified in the subject’s consent.
know the location, purpose, and owner of the database;
receive information about access conditions and third-party recipients;
access their own personal data;
receive a response within 30 days confirming whether their data is stored;
object to processing by state or local authorities;
demand correction or deletion of inaccurate or unlawfully processed data;
protect personal data from illegal use, loss, or distortion;
contact state authorities responsible for personal data protection;
use legal remedies in case of violations.
without stating a purpose, unless otherwise required by law.
full name and address;
identification document details;
database name or owner information;
list of requested data.
The subject is informed whether the request will be fulfilled.
unless otherwise required by law.