GDPR and Personal Data Protection: A Checklist for Ukrainian Business

Many Ukrainian entrepreneurs believe that European laws are something distant that does not concern them. However, there is one regulation that easily crosses borders and can “knock” on the door of any Ukrainian IT company or online store. This is GDPR (General Data Protection Regulation) — one of the strictest personal data laws in the world.

When exactly does your business fall under the scope of GDPR? It is quite simple. If you:

• Offer your goods or services (even for free) to customers located in the EU.
• Monitor the behavior of users from the EU on your website (for example, using Google Analytics or advertising pixels).

If at least one point applies to you, ignoring GDPR can lead to colossal fines. In this article, we will break down the key principles of the Regulation and provide a practical checklist for GDPR for Ukrainian companies, which will help protect your business.

Section 1. Key Principles of Data Processing

GDPR is not just a set of dry rules. It is a philosophy, a “constitution” for handling personal data, based on respect for human privacy. To comply with the Regulation, it is not enough to just check a box in your website settings. These principles must be integrated into the very logic of your business processes. Let’s look at the three main groups of these fundamental rules.

1.1. Lawfulness, Fairness, and Purpose Limitation

This trio of principles is the foundation of any interaction with user data. They require you to be honest, open, and act within the framework of the law.

• Lawfulness: you cannot collect data just “in case.” For any processing of personal data, you must have one of six legal bases. For online business, three are most commonly applied:
  1. Consent: the user has knowingly, voluntarily, and unambiguously allowed you to process their data (e.g., checked a “Subscribe to newsletter” box).
  2. Performance of a contract: you need data to provide the service ordered by the client (e.g., you cannot deliver goods without knowing the recipient’s address and name).
  3. Legitimate interest: you can process data without explicit consent if it is necessary for your activities and does not violate the user’s rights (e.g., analyzing user behavior on the site to improve its performance).
• Transparency: you are obliged to inform people about what you do with their data. All information must be stated in simple and clear language in your Privacy Policy. No complex legal terms or hidden clauses.
• Purpose limitation: data collected for one specific purpose cannot be used for another without the user’s consent. If a person left their email to receive an e-book, you do not have the right to automatically add them to your weekly promotional newsletter. This requires separate consent.

1.2. Data Minimization and Storage Limitation

These two principles are aimed at fighting “digital hoarding.” GDPR assumes that personal data is not so much an asset as a responsibility.

• Data minimization: this principle says: “Don’t be greedy.” You must collect only the minimum amount of data that is absolutely necessary to achieve a specific goal. If only an email is needed for webinar registration, do not ask the user for their phone number, date of birth, and home address. Every additional field in a form must be justified.
• Storage limitation: you do not have the right to store personal data forever. It should be kept only as long as necessary for the purpose for which it was collected. Your company must have a clear policy on data retention periods. For example: “Customer order data is stored for 3 years to fulfill warranty obligations and for accounting purposes, after which it is anonymized or deleted.” Keeping a database of customers who haven’t bought anything from you in the last 10 years is a direct violation of this principle.

1.3. Integrity and Confidentiality

This principle concerns security. It places a direct duty on you to protect the personal data entrusted to you by users from any threats. You are responsible for ensuring that data is not accidentally lost, altered, or, worst of all, falls into the hands of malicious actors.

What this means in practice for an IT business:

• Technical measures: you are obliged to implement appropriate technical security measures. This may include:
  • Data encryption (using HTTPS on the site is the absolute minimum).
  • Regular software updates.
  • Using strong passwords and two-factor authentication.
  • Conducting security audits.
• Organizational measures: this concerns internal processes in the company. For example:
  • Restricting access to data (only employees who need it for their work should have access to the customer database).
  • Conducting cybersecurity training for staff.
  • Signing non-disclosure agreements (NDAs) with employees and contractors.

Essentially, you should treat your customers’ personal data with the same care as a bank treats their money.

Section 2. GDPR Compliance Checklist

GDPR compliance is not an abstract goal, but a set of concrete, sequential actions. It is like car maintenance: you need to regularly check and adjust various systems to ensure safety and reliability. We have prepared a basic four-step checklist for you to start with.

2.1. Conduct an audit of the data you collect

Before protecting anything, you need to understand what you have. The first step is a complete “inventory” of all personal data flows in your company. Create a simple table (e.g., in Excel or Google Sheets) and methodically answer the following questions:

• What data do you collect? (Email, name, phone, IP address, order history, cookie data, etc.).
• Where do you get it from? (Registration form on the site, newsletter subscription, order form, Google Analytics).
• For what purpose do you collect it? (For order fulfillment, marketing newsletters, analytics).
• Where do you store it? (CRM system, email marketing service, Google Drive, local server).
• Who has access to it? (Sales department, marketers, developer contractor).
• How long do you store it?

This process may seem boring, but it will give you a complete picture and allow you to identify “weak spots.” Often, during such an audit, companies discover that they have been collecting and storing data for years that they absolutely do not need. A professional GDPR compliance audit by lawyers will help make this process as effective as possible.

2.2. Develop a transparent Privacy Policy

Privacy Policy is your main public document regarding GDPR. It is not a formality that can be copied from another site. It is your official statement where you explain to users in simple and clear language everything you do with their data.

What must be in your Policy:

• Who is the data “controller” (your company name and contact details).
• What specific data you collect.
• For what purpose and on what legal basis you do it.
• How long you store the data.
• Whether you transfer data to third parties (e.g., payment systems, delivery services, analytics services) and to whom exactly.
• What rights the user has (more on this in the next point).
• How the user can contact you regarding data issues.

Professional privacy policy development is a task for lawyers, as this document must comply not only with GDPR requirements but also with local legislation. It is an integral part of other legal documents for the site, such as “Public offer agreement for the site: how to draft it to protect your business?”.

2.3. Implement a consent mechanism

GDPR sets very high standards for user consent. It must be freely given, specific, informed, and unambiguous. You can forget about old methods like “silence is consent” or pre-checked boxes.

How to implement this in practice:

• Unchecked checkboxes: for each separate action (e.g., “Subscribe to news,” “Receive personalized offers”), there must be a separate checkbox that the user must check themselves.
• Clear wording: instead of “I agree to the rules,” write “I agree to the processing of my personal data for the purpose of receiving marketing newsletters.”
• Simple withdrawal of consent: the user must have the same simple ability to withdraw their consent as they had to provide it (e.g., an “Unsubscribe” button in every email).

2.4. Ensure user rights (access, deletion)

GDPR grants users a wide range of rights regarding their data. You, as a business, are obliged to create internal procedures to ensure these rights are realized.

Main user rights:

• Right of access: the user can ask you what specific information you store about them, and you are obliged to provide them with a copy of this data.
• Right to rectification: if the data is inaccurate, the user can demand it be updated.
• Right to erasure (“right to be forgotten”): this is one of the most famous rights. The user can demand the complete deletion of their data if there is no legal basis for further storage.
• Right to data portability: the user can request their data in a structured, machine-readable format to transfer it to another service.

You must be prepared to process such requests and respond to them within the time limits established by law (usually within one month). More details on how to implement the right to be forgotten can be found in our article “Right to be forgotten: how to remove information about yourself from Google search?”.

Section 3. What happens if you ignore GDPR

Many companies still operate on the principle of “wait until the thunder strikes.” It seems that Europe is far away and European regulators are busy with large corporations like Google or Meta. This is a dangerous illusion. Ignoring GDPR requirements can lead not only to theoretical but also to very real and extremely painful consequences that can jeopardize the reputation and even the existence of your business.

3.1. Reputational risks for your business

In the modern world, trust is a key currency. Especially in online business. Users are becoming more aware of privacy issues and more demanding about how companies handle their data. A data breach or even just an accusation of negligence regarding privacy can cause irreparable damage to your reputation.

• Loss of customer trust: if customers find out that you collect excessive data, transfer it to third parties without permission, or protect it poorly, they will simply go to competitors. Restoring trust is much harder than losing it.
• Problems with partners and investors: if you plan to attract foreign investment, enter European markets, or integrate with large international services, the first thing their lawyers will check is your GDPR compliance. The absence of transparent policies and procedures is a huge “red flag” that can derail any deal. No serious investor will invest money in a company with potential multi-million fines.
• Public scandals: one dissatisfied EU customer who complains to a regulator, or one article in a trade publication about your app “leaking” data, can create a wave of negativity that will be extremely difficult to handle.

GDPR compliance is not just about avoiding fines. It is a powerful signal to the market that you are a modern, transparent, and reliable company that can be trusted.

3.2. What fines are provided for violations

And now about the most painful part — money. Financial sanctions provided by the Regulation are among the highest in the world. They are designed to be felt even by the largest global corporations, let alone small and medium-sized businesses.

There are two levels of fines for GDPR violations:

1. Up to 10 million euros or up to 2% of the company’s annual global turnover (whichever is higher).
   This level of fines applies to less serious, “technical” violations. For example:
   • Violation of rules for processing children’s data.
   • Failure to conduct a Data Protection Impact Assessment (DPIA) when necessary.
   • Failure to appoint an EU representative.
2. Up to 20 million euros or up to 4% of the company’s annual global turnover (whichever is higher).
   This is the maximum level applied for violations of the fundamental principles of the Regulation. For example:
   • Processing data without a legal basis (e.g., without user consent).
   • Violation of fundamental data subject rights (right of access, deletion, etc.).
   • Illegal transfer of data outside the EU.

How does this work in practice? Of course, a company won’t be fined 20 million immediately. The regulator evaluates the nature, severity, and duration of the violation, the number of affected persons, and the level of damage caused each time. But even a fine of several tens of thousands of euros can be fatal for a startup. And mechanisms for collecting such fines from foreign companies exist and are constantly improving. Do not hope that they “won’t reach you.”

Conclusions

So, GDPR for business is not a distant European whim, but a very real part of the modern digital economy. Ignoring it means consciously exposing your business to reputational and financial risks.

• GDPR is not a one-time setup, but a constant process. You cannot “do GDPR” once and forget about it. GDPR Compliance is continuous work: regular review of policies, team training, auditing new data collection processes. This must become part of your corporate culture.
• Seek consultation for a professional audit. It is extremely difficult to understand all the nuances of the Regulation and implement them correctly on your own. To be sure of your business’s security, the best solution is a GDPR consultation. Specialized lawyers will help conduct a full audit of your processes, develop the necessary documents, and build a reliable personal data protection system that meets the highest global standards.