15 November 2017
Data Protection in the Health & Pharmaceutical Sector in Ukraine | contribution to DataGuidance by Viktoriya Podvorchanska


1.1. Data protection regulations

In 2010, Ukraine ratified the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data 1981 (“the Data Protection Convention”). Further to such ratification, in 2011 the Law of 1 June 2010 No. 2997-VI on Personal Data Protection (“the Personal Data Protection Law”) was enacted to become the cornerstone of national data protection legislation.

Ukrainian data protection rules generally follow the principles and standards of relevant European directives. Nevertheless, the level of public awareness and, more importantly, enforcement of such rules remains rather low. This makes Ukraine a weaker jurisdiction in terms of protection of personal data as compared to the EU member states. The strengthened rules of the General Data Protection Regulation (Regulation (EU) 2016/679) that will enter into force in the EU in 2018 have not been yet implemented into Ukrainian national laws. However, it is expected that Ukraine will be further enhancing this area as part of Ukraine’s ongoing integration or harmonization with European data protection requirements.

1.2. Data protection authority

Powers to control compliance with personal data protection rules are vested with the Ukrainian Parliament Commissioner for Human Rights (“the Commissioner”).

1.3. Pharmaceutical regulations

As similar to many other jurisdictions, pharmaceutical industry is one of the most heavily regulated in Ukraine. The core piece of such regulation is the Law of Ukraine of 4 April 1996 No, 123/96-BP on Medicinal Products, available in Ukrainian here, that was passed in 1996 and has been widely amended since then (“the Medicinal Products Law”). The Medicinal Products Law is supported by an extensive network of by-laws that are frequently subject to change.

1.4. Pharmaceutical authority

The Ukrainian Government and the Ministry of Health of Ukraine (“the MOH”) are the main policymakers for the sector. Control over the quality and safety of medicinal products is entrusted to the State Service of Ukraine for Medicinal Products and Drug Control.

1.5. Relationship between data protection law and pharmaceutical regulation

There is no separate regulation or guidance to comprehensively address data protection matters relevant for pharmaceutical industry. Therefore, usually a reference would need to be made to general provisions of the Personal Data Protection Law. Of these, special rules for processing of sensitive personal data would be of the utmost relevance. This category captures health, biometric and genetic data, which often needs to be handled as part of pharmaceutical operations. In line with the approach applied by many other jurisdictions, processing of sensitive data in Ukraine is subject to stricter requirements. Unless covered by a statutory exemption, such processing would require person’s express written consent and a notification to the Commissioner. On this issue, see also Section 5 below.

Furthermore, certain additional rules for handling of personal data are established by specific bylaws regulating separate stages and elements of pharmaceutical operations. They are discussed in more detail in the sections below.


General principles for conducting clinical research of medicinal products in Ukraine are set out in the Medicinal Products Law. More detailed regulation is established by the Procedure for the Conduct of Clinical Trials of Medicinal Products and Expert Evaluation of Clinical Trials, as approved by the Order of the Ministry of Health of Ukraine of 23 September 2009 No. 690, as amended by the Order of the Ministry of Health of Ukraine of 1 October 2015 No. 639 (“the Clinical Trial Procedure”) (the amended version is only available in Ukrainian here).

The Clinical Trial Procedure requires that trial participants’ right to privacy and protection of personal should be properly ensured. The participating patient or his/her legal representative has to provide an express permission to processing of personal data. It is included into the patient’s general informed consent to participate in the trial and should specify: i) the purpose of data processing, ii) the composition and contents of data to be collected, iii) the data controller, and iv) details on access of third parties to personal data.

Draft of the informed consent, including its personal data element, forms part of the clinical trial file that is submitted for i) assessment by an ethics commission with the medical institution performing the trial, and ii) expertise and assessment by the State Expert Center, a specialized expert institution of the MOH (“the MOH Expert Center”). Conclusion of the expertise is the basis for further approval of clinical trial by the MOH itself. Such approval has to be obtained before an interventional clinical trial is launched.

Information on participants of clinical trials should be kept confidential and processed in an anonymized form. To achieve that, each participant is assigned with a unique identification number which replaces his/her name in trial materials.

Viktoriya Podvorchanska, Counsel at EPAM Ukraine, wrote this Guidance Note as an expert contributor to DataGuidance, the global privacy platform. You can sign up to read more of the Ukraine - Health and Pharma Guidance Note and other Guidance Notes on data protection legislation at DataGuidance, using the link available here.

DataGuidance, November 14, 2017