In accordance with Data Protection Law, personal data may be transferred to foreign parties when there is an appropriate level of protection of personal data in the respective state of the transferee. Pursuant to the Data Protection Law, such states include member states of the European Economic Area, signatories to the EC Convention on Automatic Processing of Personal Data, and states whose regulators of financial markets are signatories to the IOSCO (International Organization of Securities Commissions) Multilateral Memorandum of Understanding of concerning Consultation and Cooperation and the Exchange of Information. The list of the states ensuring an appropriate level of protection of personal data will be determined by the Cabinet of Ministers of Ukraine.

Personal data may be transferred abroad based on one of the following grounds:

• Unambiguous consent of the personal data subject;
• Cross-border transfer is needed to enter into or perform a contract between the personal data owner and a third party in favor of the data subject;
• Necessity to protect the vital interests of the data subject;
• Necessity to protect public interest, establishing, fulfilling and enforcing of a legal requirement;
• Non-interference in personal and family life of the data subject, as guaranteed by the data owner.