Personal Data Law art. 8 — protection from automated decisions, and a right to know the mechanism
Binds Володільці та розпорядники персональних даних — the owner and the processor of personal data under Law No. 2297-VI, with no size, sector or turnover threshold, so enterprise, SME and public body alike. Art. 1 extends the Law to processing carried out wholly or partly by automated means and to personal data held in or destined for a card index by non-automated means. Art. 25 excludes processing by a natural person exclusively for personal or household needs and processing exclusively for journalistic and creative purposes subject to a balancing test.. Ukraine's automated-decision rule is the oldest in this tracker's CIS set — binding since December 2012, thirteen years before Kazakhstan, Uzbekistan and Kyrgyzstan legislated. Art. 8(2)(13) gives a right to protection from an automated decision having legal consequences, with no 'solely automated' qualifier and no exceptions of any kind, and art. 8(2)(12) gives a standing right to know the mechanism of automatic processing — a logic-transparency right its neighbours withhold. There is no procedure, no deadline and no human-review right attached, and the only penalty route reaches natural persons alone.
In force since 20 December 2012 and unamended since. Points 12 and 13 were added to part two of art. 8 of the Law of Ukraine No. 2297-VI of 1 June 2010 «Про захист персональних даних» by Law No. 5491-VI of 20 November 2012, whose Final Provisions give it effect on the day after publication; the Rada record card for 5491-VI records first official publication in «Голос України» No. 241 of 19 December 2012 and the commencement event as 20 December 2012, and gives the act's state as Чинний. Neither point carries an «виключено» annotation in the consolidated text of 2297-VI (also Чинний, amended by 28 acts), so both are live. Two rights, and the drafting is unlike every peer this tracker carries. Point 13 gives the subject the right «на захист від автоматизованого рішення, яке має для нього правові наслідки» — protection from an automated decision that has legal consequences for them. There is NO exclusivity qualifier: the text says «автоматизованого рішення», not a decision based SOLELY on automated processing, so unlike GDPR art. 22, Kazakhstan's art. 19-1, Uzbekistan's art. 24 and Russia's 152-ФЗ art. 16 the trigger does not require the human to be out of the loop. It is also drafted as a bare right with NO exceptions at all — no consent exit, no contract exit, no «cases provided by law» exit — which is the widest trigger and the narrowest set of defences in the set. Against that, the effects threshold is the narrowest: «правові наслідки» only, with no «similarly significantly affects» limb and no Russian-style «иным образом затрагивающих» catch-all. Point 12 gives the subject the right «знати механізм автоматичної обробки персональних даних» — to know the MECHANISM of automatic processing. That is a standing logic-transparency right, and it is the thing the neighbouring regimes expressly do not give: the Uzbek and Kazakh entries both record that no right to disclosure of the logic exists there. What Ukraine lacks is machinery. Art. 8 attaches no procedure to either point — no objection mechanism, no time limit to answer (against Kazakhstan's three working days, Uzbekistan's ten and Russia's thirty), no duty to explain the individual decision, and no right to human intervention or re-decision. Art. 8(2)(6) supplies only the general access right and art. 16 the general access procedure with a thirty-day answer, neither specific to automated decisions. The right is enforced through the Verkhovna Rada Commissioner for Human Rights (art. 23) rather than by a dedicated supervisory authority. No AI-specific statute has been enacted in Ukraine; art. 8 is the binding hook.
Stated maximum penalty — KUpAP art. 188-39 part four — failure to observe the statutory personal-data protection procedure where it led to unlawful access to the data OR to violation of the data subject's rights — is the limb that reaches a breach of art. 8(2)(12)-(13): 100 to 500 НМДГ for citizens and 300 to 1,000 НМДГ for officials and citizens who are business entities. Part five doubles that for a repeat within a year, to 1,000-2,000 НМДГ. At 17 UAH per НМДГ (Tax Code s. XX, subdivision 1, point 5 — the carve-out to the tax social benefit is expressly limited to the QUALIFICATION of offences, not to the size of the sanction) that is roughly 1,700-8,500 UAH, 5,100-17,000 UAH and 17,000-34,000 UAH respectively, so the ceiling is about 34,000 UAH or 700 euro. The structural point matters more than the figure: the KUpAP addresses natural persons only — громадяни, посадові особи and громадяни — суб'єкти підприємницької діяльності — so a company that breaches art. 8 cannot itself be fined; only its officials can be, and there is no corporate administrative liability for personal-data breaches in Ukraine at all.