Personal Data Protection and Data Privacy for Businesses

No. While the GDPR is one of the key regulations governing personal data protection, privacy compliance is not limited to it. Depending on the business model and the jurisdictions involved, Ukrainian legislation, the laws of other countries, clients' contractual requirements, platform rules, industry standards, and international data protection practices may also apply.

The GDPR may apply to a company established outside the EU if it processes the personal data of individuals located in the EU in connection with offering them goods or services or monitoring their behavior within the EU. As a result, Ukrainian IT companies, SaaS products, e-commerce businesses, marketplaces, and AI services may fall within the scope of the GDPR depending on their actual business model.

No. A Privacy Policy is only one element of a comprehensive privacy compliance framework. Effective personal data protection typically includes an assessment of processing activities, legal bases for processing, the roles of the parties involved, agreements with processors, international data transfers, data retention periods, technical and organizational security measures, and procedures for responding to data subject requests.

Data mapping is the process of documenting what personal data a company collects, where it comes from, for what purposes it is used, with whom it is shared, where it is stored, how long it is processed, and which services are involved in the processing. It is a fundamental step in building an effective privacy compliance framework.

The applicable legal bases depend on the relevant legislation and the specific processing activity. Under the GDPR, these include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest, and legitimate interests. An appropriate legal basis should be determined separately for each processing purpose.

No. Consent is only one of several possible legal bases for processing personal data. For example, processing may also be based on the performance of a contract, compliance with a legal obligation, or the protection of legitimate interests. Consent should be used only where it is the appropriate legal basis, rather than by default.

A Data Processing Agreement (DPA) is an agreement, or a section of an agreement, that governs the processing of personal data between parties, for example between a controller and a processor. It defines the subject matter, duration, nature, and purpose of the processing, the types of personal data, categories of data subjects, the parties' obligations, and applicable security requirements.

Not always. Whether a Data Protection Officer (DPO) must be appointed depends on the applicable jurisdiction, the nature of the company, its activities, the scale of processing, the categories of data involved, and the level of risk. For example, the GDPR requires the appointment of a DPO in certain cases, including for public authorities and organizations whose core activities involve large-scale, regular and systematic monitoring of individuals or the large-scale processing of special categories of personal data.

An EU representative may be required for companies that do not have an establishment in the EU but fall within the territorial scope of the GDPR. Whether such an appointment is required depends on the company's specific data processing activities and any applicable exemptions.

A Data Protection Impact Assessment (DPIA) is required where a particular type of processing, especially when using new technologies, is likely to result in a high risk to the rights and freedoms of individuals, taking into account the nature, scope, context, and purposes of the processing. This may be relevant for AI products, profiling, scoring, automated decision-making, the processing of special categories of personal data, or large-scale monitoring activities.

Yes. If a company uses AI tools to process the personal data of users, customers, employees, or other individuals, it should assess what data is transferred to those tools, who the service provider is, where the data is processed, whether it is used for model training, what privacy settings are available, and which contractual terms apply.

The process should begin with data mapping: identifying what personal data is collected, for what purposes, on which legal bases, with whom it is shared, where it is stored, and how long it is retained. Based on this assessment, the company can prepare the necessary documentation, review agreements with service providers, implement cookie and consent mechanisms, establish internal procedures, and develop processes for handling data subject requests.