What personal data does a business use?

A name, telephone number, email address, delivery address, passport details, employee information, camera recording or purchase information may be personal data if linked to an identifiable individual. The owner determines the purpose for which it is used: entering into a contract, delivering goods, paying salary, accounting, warranty service or another lawful business need.

The law requires the purpose of processing to be defined and the amount of information collected to be proportionate to that purpose. An online shop needs a delivery address, but an ordinary informational mailing usually does not. This approach reduces the amount of confidential information employees must protect and lowers the cost of storage and access control.

An individual has the right to know who controls their data, what information has been collected, why it is used and to whom it is disclosed. In circumstances provided by law, the individual may request access, correction or cessation of use. Website notices, forms and contracts should therefore explain the business's actual practices in clear language.

The law provides specific legal grounds and enhanced requirements for health data, biometric data and other sensitive information. The owner should first determine whether such information is necessary for the business. If it is, a lawyer identifies the lawful basis, the employees who may access it and the retention period.

Article 12 of the Law provides for informing the individual about the data controller, the categories of information collected, the purpose of collection, the individual's rights and the persons to whom the data is disclosed. For a business, this means that a website or form notice should reflect actual use of the information, and customer-support staff should know where to direct a client's request.

The current version of Law No. 2297-VI remains the principal framework for Ukrainian businesses. Processing may be based on consent, law, entering into and performing a contract, and other grounds expressly provided by law; a universal consent for every business transaction is therefore unnecessary.

Employee access, contractors and data transfers

The director determines which employees need access to the customer database, HR documents, accounting software or video archive. A sales manager needs customer contact details, an accountant needs information for accounting purposes, and HR staff need employee information. This allocation protects individuals without obstructing the company's normal work.

When data is transferred to a cloud provider, delivery service, accountant, marketing agency or another contractor, the owner should understand exactly what information the partner receives and why. The contract defines the partner's role, permitted use, confidentiality and actions after the service ends. Cross-border transfers additionally require consideration of Article 29 of the Law and the conditions applicable to the relevant country or contract.

Consent is one possible legal basis for processing, but businesses may also rely on other grounds expressly provided by law. For example, some data is required to enter into and perform a contract, meet an employer's obligations or maintain statutory records. A lawyer matches the legal basis to the actual business activity instead of using a universal consent for every document.

If an employee sends a file to an unauthorised third party, loses a laptop or grants excessive access, the director needs a prompt response: restrict access, preserve information about the incident, assess the possible impact on individuals and comply with any obligations that arise in the particular case. Pre-defined responsible persons reduce response time and potential losses.

The retention period depends on the purpose and the applicable legal obligation. Accounting and HR records have their own retention periods, while marketing lists have different ones. The owner determines when information is no longer needed for the contract, accounting or protection of rights, after which the employee deletes it or archives it appropriately in accordance with the established rules.

Documents a business owner needs

For most companies, a clear set of documents is sufficient: notices for customers and employees, access rules, contractual provisions for contractors, retention periods, and procedures for responding to an individual's request or a data breach. The amount of paperwork depends on the actual activity and the number of rules genuinely required.

UBC can help the owner identify data categories, lawful bases, recipients and employee access rights. A lawyer can prepare documents for the CRM, website, HR records, CCTV or other systems actually used. The director receives a clear package for day-to-day operations and discussions with customers and partners.

For an international business, the requirements of the customer's or partner's country are assessed separately. If a Ukrainian business works with EU residents through an undertaking or uses a European service provider, additional contractual and information requirements may arise. A consultant will explain which of them apply to the particular sales and data-transfer model.

Proper organisation of personal-data processing gives an owner two practical benefits: employees use only the information they need, and customers understand to whom they provide their data. This reduces errors, simplifies connection of new services and strengthens trust in the business.