Compliance FrameworksEurope
Ukraine Law on Protection of Personal Data (2297-VI)
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | UA PDPL |
| Region | Europe |
| Country or scope | Ukraine |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers UA PDPL
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
UA-PDPL-24 Protection of Personal Data in Processing Systems | Owners, managers, and third parties handling personal data must protect it against accidental loss or destruction and against unlawful processing; integrity hashes on the software components that process the data evidence this safeguard (Law No. 2297-VI Art. 24). | Scan |
UA-PDPL-24V Defence Against Unlawful Alteration | The duty to prevent unlawful destruction or alteration of personal data requires the processing software to be maintained in a known, assessable state, with each component carrying an identified version (Law No. 2297-VI Art. 24). | Scan |
UA-PDPL-6 Purpose-Bound, Documented Processing | Personal data may only be processed lawfully and for declared, specific purposes, which presupposes the owner knows and can enumerate the software systems and components through which the data flows (Law No. 2297-VI Art. 6). | Scan |
UA-PDPL-DLG Delegated Processing Accountability | Processing may be entrusted to a manager (processor) only under a written agreement that fixes responsibilities, so third-party software components in the processing chain must have identifiable suppliers (Law No. 2297-VI, delegation-of-processing provisions). | Scan |
UA-PDPL-24R Responsible Data-Protection Unit | Owners and managers processing significant volumes of personal data must designate a responsible unit or officer for data-protection arrangements; an identified, timestamped record of the software estate is core evidence such a function exists and works (Law No. 2297-VI Art. 24). | Scan |
Policy templates
All 22 from the standard set, adapted to UA PDPL.