Home
Resources
Video analytics and personal data in Ukraine: what's allowed and required

Video analytics and personal data in Ukraine: what's allowed and required

9 min read · For: business owners and directors, lawyers, HR managers, and data protection officers · Updated 2026-10-14

Summary

Video recording of people on the shop floor is processing of personal data, so it falls under «Про захист персональних даних» (Law of Ukraine “On Personal Data Protection”) No. 2297-VI.
An employer needs a documented purpose, a lawful basis, a proportionality assessment, a retention period, and a list of who has access.
Employees are informed before video monitoring starts: a clause in the internal labor regulations, a video surveillance policy, and a signed acknowledgment.
Biometric data is a special category (Article 7), so face recognition needs a separate legal basis and, as a rule, notification of the Ombudsman.
According to the Ombudsman's guidance, filming in toilets, showers, and changing rooms is prohibited. The Civil Code allows covert filming only in cases established by law.

Is this legal advice?

This is not legal advice. This article explains which provisions of current Ukrainian law apply to video analytics at a company and links to the primary sources. Your specific case should be assessed by a lawyer who sees your documents, processes, and cameras. We checked the article numbers against the text of the law on the Verkhovna Rada website as of October 14, 2026.

Is video footage personal data?

Yes. Article 2 of Law No. 2297-VI defines personal data as information about a natural person who is identified or can be specifically identified. A person on video can be recognized by face, build, clothing, workstation, and shift time, so recording employees falls under the law. The Ukrainian Parliament Commissioner for Human Rights (Ombudsman) gives the same answer in its guidance on cameras.

Video analytics that looks for a hair cap or a crate on the floor and does not identify anyone still processes frames with people in them. An event card with a frame, time, and workstation makes it possible to work out who it was. So the law applies even when the system does not recognize faces.

On what legal basis can an employer run video monitoring?

Article 11 of the law lists six grounds for processing. For video monitoring in production, two are usually considered:

fulfilling an obligation of the controller established by law (clause 5). For example, under Law No. 771/97-VR «Про основні принципи та вимоги до безпечності та якості харчових продуктів» (Law of Ukraine “On Basic Principles and Requirements for Food Safety and Quality”), a food business must ensure staff hygiene and keep HACCP records;
protecting the legitimate interests of the controller (clause 6), unless the employee's rights override those interests.

Employee consent is a weak basis in an employment relationship. In its guidance on cameras, the Ombudsman notes that consent must be freely given, while an employee in practice depends on the employer. So employers justify video monitoring by working conditions and legitimate interests and keep consent for what a person can genuinely refuse.

Article 6 adds three general requirements. The purpose of processing must be set out in the controller's documents (part 1). The data must be adequate and not excessive for that purpose (part 3). Data in a form that allows identification is kept no longer than that purpose requires (part 8).

Which documents does a company need?

In its guidance «Камери відеоспостереження: що варто знати кожному, щоб захистити свою приватність» (“Surveillance cameras: what everyone should know to protect their privacy”), the Ombudsman lists the minimum for an employer. We put it into a table.

Document	What it covers
Legitimate interests assessment	The purpose of video monitoring, why less intrusive means cannot achieve it, and how employees' rights are balanced
Clause in the internal labor regulations	Video monitoring stated as a working condition
Video surveillance policy	Camera layout, camera capabilities (audio recording, analytics), operating hours, retention period, access and deletion procedure
Signed acknowledgment	Confirmation that each employee read the rules before monitoring starts
Order appointing responsible persons	Who is responsible for data processing and who has access to recordings
Training for responsible persons	Regular, with records of each session

The Standard Procedure for Personal Data Processing (Ombudsman Order No. 1/02-14) also requires defining the retention period and conditions, the access procedure, and a procedure for recording operations with data. For video analytics this means a log of who opened an event card, when, and what they did with it.

How do you inform employees?

Article 12 of the law requires informing a person at the time of data collection about the controller, the data collected, the purpose, their rights, and the parties the data is transferred to. Article 29 of the Labor Code of Ukraine requires the employer to inform an employee about working conditions and internal labor regulations before work begins.

According to the Ombudsman's guidance, a notice about video monitoring should state at least the purpose, the legal basis, the number and location of cameras and their capabilities, monitoring hours, employee rights, the processing and protection procedure, access conditions, and the retention period.

Inform employees before the cameras are installed. Give new hires the document to sign during onboarding.
Place signs at the entrances to camera zones with the controller's name and the responsible person's contact.
If the system counts people, breaks, or presence at the workstation, say so directly in the policy. A “security” purpose does not cover working time tracking.
Changing the purpose to one incompatible with the original requires new approval (Article 6, part 1).

Why does face recognition need special attention?

Part 1 of Article 7 prohibits processing biometric and genetic data, health data, and other special categories. Part 2 lists exceptions, including a person's unambiguous consent (clause 1) and processing necessary for the employer's rights and obligations in employment relations in accordance with the law, with safeguards in place (clause 2).

Article 9 requires notifying the Ombudsman within 30 working days of processing that poses a special risk. The Notification Procedure classifies biometric data and “the location and/or movement routes of a person”, among others, as such processing. The procedure provides an exception for processing necessary in employment relations in accordance with the law. Whether your system qualifies is a question for a lawyer. Under Article 24, a controller subject to notification also appoints a responsible person or unit.

Here is our approach. We do not recognize faces on the shop floor. Our rules assess workwear, actions, and objects. We use biometrics only at the staff entrance and only with the employee's written consent.

Where must cameras not be installed?

Toilets, showers, changing rooms, and other places where people expect privacy. The Ombudsman names them directly.
The Ombudsman advises against filming rooms where one person works alone without compelling grounds, because such recording effectively tracks a specific individual.
Hidden cameras. Article 307 of the Civil Code of Ukraine allows filming a person without consent, including covertly, only in cases established by law.

Limit each camera's field of view to the zone it is needed for. If a break room falls into the frame and the rule only concerns the conveyor, cover the extra area with a privacy mask in the camera settings.

How long should recordings and event frames be kept?

The law does not set a specific number of days. The controller sets the period in its policy based on the purpose, and Article 15 requires deleting the data once it expires. It helps to separate the categories.

What is stored	What drives the retention period
Continuous camera recording	How long it takes to notice an incident and pull the recording. Usually a short loop archive
Event card with a frame in the log	For food businesses, HACCP records under Article 21 of Law No. 771/97-VR are kept for at least three months after the product's shelf life ends. If the card is such a record, its retention is tied to that period
Frames for training an AI model for your tasks	A separate purpose that must be named in the policy, with its own retention period and restricted access

Who has access, and how do you prove it?

Article 10 allows the controller's employees to use personal data only in line with their job duties. Article 24 requires protecting data from loss and unlawful access.

Assign roles: who sees live video, who reviews cards, who exports recordings.
Keep a log of access and exports.
Decide where frames are processed. We deploy on your premises, in your cloud or in our secure cloud; processing on site reduces the number of transfers. Transfer of data to foreign parties, such as a cloud abroad, is governed by Article 29 of the law.
A vendor who configures the system and has access to frames is a processor. Set out in a contract what the vendor does with the data and when it deletes it.

What about cameras on a private house and the neighbors?

Part 2 of Article 25 allows an individual to process data exclusively for personal or household needs without applying the other provisions of the law. A camera over your own yard usually falls under this exception.

The Ombudsman warns that filming a neighbor's property without permission may violate the right to private and family life. If a camera covers a road or another public space, a video surveillance sign is required. A camera in a stairwell that sees neighbors' doors or a shared landing needs their agreement. The household exception does not apply to condominium associations (OSBB) or property management companies.

Does GDPR apply if we export to the EU?

Under Article 3, EU Regulation 2016/679 (GDPR) applies to organizations with an establishment in the EU, and to those that offer goods or services to people in the EU or monitor their behavior there. Video monitoring of your own employees in Ukraine, as a rule, does not fall under GDPR directly. EU buyers and their auditors may still require a comparable level of protection by contract.

Biometric data used for unique identification is a special category (Article 9 GDPR).
Large-scale systematic monitoring of publicly accessible areas requires a data protection impact assessment, DPIA (Article 35).
The European Data Protection Board issued Guidelines 3/2019 on video devices. The Ombudsman's office published a Ukrainian translation.

Ukraine ratified Council of Europe Convention No. 108 for the protection of individuals with regard to automatic processing of personal data (Law No. 2438-VI). As of October 14, 2026, Bill No. 8153 «Про захист персональних даних» (“On Personal Data Protection”), which brings Ukrainian law closer to GDPR, has the status «готується на друге читання» (“being prepared for second reading”) on its Verkhovna Rada card. Law No. 2297-VI remains in force.

What are the penalties for violations?

Article 28 of the law refers to liability established by other laws. Article 188-39 of the Code of Ukraine on Administrative Offenses provides for fines, including for failing to notify or late notification of the Ombudsman about processing subject to notification, and for failing to comply with the Ombudsman's orders. Fines are set in multiples of the tax-free minimum income and increase for a repeat violation within a year.

Short checklist before launching video analytics

A documented purpose for each rule and a legal basis under Article 11.
A legitimate interests and proportionality assessment.
A clause in the internal labor regulations and a video surveillance policy.
Signed employee acknowledgments and signs at entrances.
An order appointing responsible persons, access roles, and an access log.
Retention periods for recordings, cards, and training frames.
A lawyer's decision on notifying the Ombudsman if biometrics or movement tracking is involved.
A contract with the vendor as data processor.