On June 22, 2012, the Ministry of Justice of Ukraine issued its Order No 947/5 approving
the Procedure for Execution by the State Service of Ukraine on Personal Data Protection of
State Control over the Observance of Legislation on Personal Data Protection (hereinafter
- the “Procedure”).

The Procedure establishes a mechanism for the State Service of Ukraine on Personal Data
Protection (hereinafter – the “Service”) to exercise state control over the observance of
legislation on personal data protection by conducting inspections of individuals, private
entrepreneurs, enterprises, institutions and organizations of all forms of ownership, state
authorities that are owners and/or administrators of personal data (hereinafter – the “subjects of
inspection”), and for formalizing and reviewing the inspection results.

The Service controls the observance of legislation on personal data protection by conducting
scheduled and unscheduled inspections, field inspections and remote inspections based on the
Service’s relevant ordinance.

The commission tasked to conduct an inspection shall consist of not less than three officials of
the Service.

Before starting an inspection the Service shall send a notice accompanied by a copy of the order
on conducting an inspection to the location or residence address of the subject of inspection by
registered mail within 10 calendar days prior to the commencement of inspection.
The period of inspection shall not exceed 10 business days. In some cases this period may be
extended, but not more than for 5 business days.

On the first day of inspection, the head of the commission shall give an inspection schedule to
the head of the subject of inspection.

According to the Procedure, the commission shall be entitled to have free access to storage
media, including computers, magnetic media, etc., to obtain copies of such information, while
the subject of inspection is to provide the commission with complete, comprehensive and
objective information on all matters referred to in the inspection schedule and to ensure
appropriate conditions for inspecting that information. The Procedure regulates the rights of the
commission and of the subjects of inspection.

In case of a remote inspection the subject of inspection shall provide the required documents
within the period specified in the written request of the Service.

Scheduled inspections shall be carried out only once in 5 years from the end date of the previous
scheduled inspection, according to quarterly or annual plans of the Service, which shall be
published on the regulator’s website.

An unscheduled inspection shall be conducted under certain circumstances: at the request of a
subject of inspection; application of individuals or legal entities on the violation of legislation on personal data protection by a subject of inspection; failure to provide the documents requested by the Service within the prescribed period; detection and confirmation of unreliability of data with the findings of remote inspection results provided at the request of the Service; to check compliance with the regulator’s written instructions. Information on an unscheduled inspectionshall be published on the regulator’s website 10 calendar days prior to the inspection.

Upon the results of inspections conducted, the commission shall make a statement of compliance
with legislation on personal data protection as provided by the annex to the Procedure. Also, the
Procedure establishes requirements to the formalization and contents of such a statement.

If violations of law have been revealed, an instruction is made to eliminate them as provided by
the annex to the Procedure. Also, the Procedure establishes requirements to the formalization andcontents of such an instruction.

If an administrative offense has been revealed in the course of inspection, the commission shall
make a protocol on administrative offense as provided by the annex to the Procedure. Also, the
Procedure establishes requirements to the formalization and contents of such a protocol. The
protocol shall be sent to the local court within three days from the date of its execution.

The Procedure was registered with the Ministry of Justice of Ukraine on 26 June 2012 and shall
come into force after its publication.

Should you have any questions regarding the processing and protection of personal data, please
do not hesitate to contact us.

Oleksander Plotnikov
Counsel
E-mail: Oleksander.plotnikov@arzinger.ua