GPS and worker monitoring in Ucrânia: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Valid legal basis (art. 11) and prior information to workers

  Yesrequired

  Processing of workers data (including GPS) requires one of the six legal bases under art. 11 of Law 2297-VI; workers must be informed about the controller, the data, the purposes, their rights and the recipients, at the time of collection or within 30 working days.

  Legge dell'Ucraina n. 2297-VI sulla protezione dei dati personali (2010)

• Prior authorisation or registration with an authority before installing

  Nonot required

  The mandatory registration of databases was abolished as of 1 January 2014; the notification of high-risk processing does not apply to employment relationship data (which are exempt).

  Legge dell'Ucraina n. 2297-VI sulla protezione dei dati personali (2010)

• Legal basis = as a rule the documented consent of the worker

  Yesrequired

  Unlike the GDPR, Ukrainian law relies heavily on consent as the main basis; for GPS it is advisable to inform in advance and document the consent, as well as to set out a written purpose.

  Legge dell'Ucraina n. 2297-VI sulla protezione dei dati personali (2010)

• Processing limited to the stated purpose (purpose limitation)

  Yesrequired

  Data must be processed only within the limits of the stated purpose; the controller employees may use it only for their own professional tasks.

  ICLG, protezione dei dati in Ucraina (basi giuridiche, DPIA)

• Impact assessment (DPIA)

  Nonot required

  The current law does not require an impact assessment; it will be required only by the possible reform aligned with the GDPR (bill 8153), which is not yet in force.

  ICLG, protezione dei dati in Ucraina (basi giuridiche, DPIA)

The procedure, step by step

1. 1

   Identify a valid legal basis (as a rule, consent) and define a written purpose.

2. 2

   Inform workers about the data, the purposes, their rights and the recipients (at the time of collection or within 30 working days).

3. 3

   Document the worker consent for geolocation.

4. 4

   Limit the processing to the stated purpose only.

5. 5

   Bear in mind the upcoming reform (bill 8153): if it comes into force, it will introduce GDPR-style rules (prior information, no solely automated decisions, DPIA).

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Legge dell'Ucraina n. 2297-VI sulla protezione dei dati personali (2010)
• Difensore civico (Garante ucraino), protezione dei dati personali
• ICLG, protezione dei dati in Ucraina (basi giuridiche, DPIA)
• Regolamento UE 2016/679 (GDPR) - riferimento comparativo