LogoRegulatory Alerts
2025-06-27 | 17/21/2490/К03

Added · Updated

Decision on Approving the Procedure for Protection and Processing of Personal Data by the National Securities and Stock Market Commission

The National Securities and Stock Market Commission of Ukraine approved a mandatory procedure for the protection and processing of personal data held by the Commission. The regulation defines the categories of data subjects, including market participants, employees, and citizens, and specifies the types of personal data processed for each. It establishes strict rules for data collection, storage periods (ranging from two to five years depending on the subject), and access controls, requiring staff to sign non-disclosure agreements. The procedure also outlines the grounds for processing, the rights of data subjects to request corrections or deletion, and the technical and organizational measures required to ensure data security.

National Securities and Stock Market Commission logo

Ukraine

National Securities and Stock Market Commission

Click to view thumbnail

NATIONAL SECURITIES AND STOCK MARKET COMMISSION DECISION May 20, 2025 Kyiv No. 17/21/2298/K03 On Approval of the Procedure for Protection and Processing of Personal Data Processed by the National Securities and Stock Market Commission in Connection with the Performance of Its Assigned Tasks

In accordance with paragraphs 1 and 28 of Part One of Article 7 of the Law of Ukraine "On State Regulation of Capital Markets and Organized Commodity Markets", Law of Ukraine "On Protection of Personal Data"

The National Securities and Stock Market Commission HAS DECIDED:

  1. Approve the Procedure for Protection and Processing of Personal Data Processed by the National Securities and Stock Market Commission in Connection with the Performance of Its Assigned Tasks, attached hereto.

  2. The Department of Information Technology shall ensure the submission of this decision for state registration to the Ministry of Justice of Ukraine.

  3. The Administration Department shall ensure the publication of this decision on the official website of the National Securities and Stock Market Commission.

  4. The Department of Legal Support and Internal Compliance Control, after state registration with the Ministry of Justice of Ukraine, shall ensure the publication of this decision on the official website of the National Securities and Stock Market Commission.

  5. Control over the implementation of this decision shall be entrusted to a member of the National Securities and Stock Market Commission, Yu. Shapoval.

Chairman of the Commission Ruslan MAGOMEDOV

Protocol of the Commission meeting of June 27, 2025 No. 69

APPROVED Decision of the National Securities and Stock Market Commission ___ _________ 2025 No. 17/21/____/K03

PROCEDURE for protection and processing of personal data processed by the National Securities and Stock Market Commission in connection with the performance of its assigned tasks

I. General Provisions

  1. This Procedure establishes general requirements for organizational and technical measures for the processing and protection of personal data, the owner and administrator of which is the National Securities and Stock Market Commission (hereinafter – NSSMC), during their processing in the information and communication systems of the NSSMC and on paper carriers.

  2. This Procedure is mandatory for compliance by employees of the NSSMC, enterprises, institutions, and organizations that fall within the sphere of management of the NSSMC, which have been granted access to information containing personal data, within the framework of performing their powers.

  3. Personal data includes any information or set of information about a person who is identified or can be specifically identified.

Terms used in this Procedure are used in the meaning provided for in the Laws of Ukraine "On State Regulation of Capital Markets and Organized Commodity Markets", "On Capital Markets and Organized Commodity Markets", "On Protection of Personal Data", "On Appeals of Citizens", "On Information", "On Access to Public Information", and "On Protection of Information in Information and Communication Systems".

  1. Personal data, the owner of which is the NSSMC (except for anonymized personal data), is information with limited access, except in cases provided for by Article 5 of the Law of Ukraine "On Protection of Personal Data".

  2. Personal data in the information systems of the NSSMC is processed automatically in electronic form using software tools and in paper form (storage of appeals, requests for information, requests for verification of information about candidates for positions, which were received in paper form; documents containing personal data of NSSMC employees or candidates for vacant positions, appointment to which is carried out by the NSSMC).

  3. The NSSMC is the owner and/or administrator of personal data that are received and processed by the NSSMC in accordance with legislation.

  4. The NSSMC may designate an administrator of personal data, the owner of which it is, an enterprise (institution) of state ownership that belongs to the sphere of management of the NSSMC.

II. Purpose and Grounds for Processing Personal Data

  1. Processing of personal data is carried out in accordance with the Constitution of Ukraine, Laws of Ukraine "On State Regulation of Capital Markets and Organized Commodity Markets", "On Capital Markets and Organized Commodity Markets", "On Protection of Personal Data", "On Prevention of Corruption", the Code of Laws on Labor of Ukraine, and other laws of Ukraine for the purpose of performing tasks assigned to the NSSMC.

  2. Processing of personal data is carried out for the purpose of:

  1. performing tasks assigned to the NSSMC, defined in paragraph 2 of Article 2 of the Law of Ukraine "On State Regulation of Capital Markets and Organized Commodity Markets", and implementing the requirements of sectoral legislation;
  2. ensuring labor relations, military registration, reservation, and tax registration of NSSMC employees, conducting special checks;
  3. ensuring the rights of persons who appeal to the NSSMC in the manner defined by the Laws of Ukraine "On Appeals of Citizens" and "On Access to Public Information";
  4. conducting office work in the field of personnel management, internal audit activities, administrative and legal, tax relations, and relations in the field of accounting and other information on issues within the competence of the NSSMC;
  5. forming the composition of NSSMC committees, the Consultative-Expert Council at the NSSMC, the Budget Council of the NSSMC, and other working bodies created by the NSSMC and the Consultative-Expert Council at the NSSMC.
  1. Grounds for processing personal data may be:
  1. consent of the personal data subject to the processing of their personal data;
  2. permission to process personal data granted to the owner of personal data in accordance with the law exclusively for the exercise of their powers;
  3. the need to fulfill the obligation of the owner and/or administrator of personal data, which is provided for by legislation.
  1. Consent of the subject to the processing of their personal data must be voluntary and informed. Consent may be provided by the subject in written or electronic form, which allows concluding that it was provided. The possibility of providing consent may be implemented by automated data processing tools in the subsystems of the comprehensive information and communication system of the NSSMC (hereinafter – CIS), in particular by means of the electronic cabinet of the CIS user.

III. Categories of Subjects and Composition of Personal Data

  1. The NSSMC carries out processing of personal data of the following categories of subjects:
  1. participants of capital markets and organized commodity markets, obtained as a result of submitting reporting data and other information, in accordance with regulatory legal acts of the NSSMC (hereinafter – regulated data) or provision of administrative services;
  2. employees of the NSSMC (members of their families) and candidates for vacant positions, appointment to which is carried out by the NSSMC;
  3. persons who appeal to the NSSMC in the manner defined by the Laws of Ukraine "On Appeals of Citizens" and "On Access to Public Information";
  4. persons, the processing of personal data of which is carried out during the conduct of a special check in accordance with the Law of Ukraine "On Prevention of Corruption" and in the process of checking participants of capital markets and organized commodity markets;
  5. delegated representatives of state bodies or institutions of civil society, who are candidates for inclusion in the composition of NSSMC committees, the Consultative-Expert Council at the NSSMC, the Budget Council of the NSSMC, and other working bodies created by the NSSMC and the Consultative-Expert Council at the NSSMC.

  1. The composition of personal data processed by the NSSMC depends on the category of the personal data subject.

  2. The NSSMC carries out processing of the following personal data of participants of capital markets and organized commodity markets, obtained as a result of submitting regulated data or provision of administrative services: surname, first name, patronymic (if available); date and place of birth; passport details of a citizen of Ukraine (document name, series (if available), number, date of issue, and authorized entity that issued the document); registration number of the taxpayer's account card (except for persons who, due to their religious beliefs, refuse to accept the registration number of the taxpayer's account card and have officially notified the relevant controlling body and have a corresponding mark in their passport); details of the passport of a citizen of Ukraine for travel abroad (document name, series (if available), number, date of issue, and authorized entity that issued the document); information about the declared/registered place of residence (stay); contact phone number, email address (email address); education information; other personal data, the necessity of processing of which is associated with legislative requirements for the position and/or performance of functional powers.

  3. The NSSMC carries out processing of the following personal data of employees (members of their families), candidates for vacant positions, appointment to which is carried out by the NSSMC, and persons dismissed from the NSSMC (within the storage period provided for by legislation): surname, first name, patronymic (if available); date and place of birth; passport details of a citizen of Ukraine (document name, series (if available), number, date of issue, and authorized entity that issued the document); registration number of the taxpayer's account card (except for persons who, due to their religious beliefs, refuse to accept the registration number of the taxpayer's account card and have officially notified the relevant controlling body and have a corresponding mark in their passport); details of the passport of a citizen of Ukraine for travel abroad (document name, series (if available), number, date of issue, and authorized entity that issued the document); information about the declared/registered place of residence (stay); information about communication means; information about labor activity; information about education, presence of special knowledge or training; information contained in the state certificate of the level of proficiency in the state language issued by the National Commission for Standards of the State Language; information about marital status and family composition; information about the absence of a criminal record; military registration data; biographical data; information about the presence of rights to benefits and compensation; photographic images; other personal data, the necessity of processing of which is determined by legislation.

  4. The NSSMC carries out processing of the following personal data of persons who appeal in the manner defined by the Laws of Ukraine "On Appeals of Citizens" and "On Access to Public Information": data relating to the person and provided by them in applications, court requests (mandates, motions), requests, appeals, lawyer's requests.

  5. The NSSMC carries out processing of personal data during the conduct of a special check in the volumes and manner defined by the Law of Ukraine "On Prevention of Corruption".

  6. The NSSMC carries out processing of personal data during the conduct of checks of participants of capital markets and organized commodity markets, in particular: surname, first name, patronymic (if available), date and place of birth, information about education, presence of special knowledge or training, periods of work and positions held, registration number of the taxpayer's account card (except for persons who, due to their religious beliefs, refuse to accept the registration number of the taxpayer's account card and have officially notified the relevant controlling body and have a corresponding mark in their passport), information about communication means.

  7. The NSSMC carries out processing of the following personal data of delegated representatives of state bodies or institutions of civil society, who are candidates for inclusion in the composition of NSSMC committees, the Consultative-Expert Council at the NSSMC, the Budget Council of the NSSMC, and other working bodies created by the NSSMC and the Consultative-Expert Council at the NSSMC: surname, first name, patronymic (if available), date and place of birth, information about education, information about labor and/or public activity, communication means, biographical data, photographic images.

IV. Procedure for Processing Personal Data

  1. Method of collection, accumulation, and storage of personal data:
  1. collection of personal data of participants of capital markets and organized commodity markets is carried out as a result of submitting regulated data and provision of administrative services provided by the NSSMC. Accumulation and storage of such personal data is carried out in the subsystems of the CIS;
  2. collection of personal data of NSSMC employees and candidates for vacant positions, appointment to which is carried out by the NSSMC, is carried out by providing them with the relevant documents defined by legislation, in particular, labor legislation, on military registration, and anti-corruption legislation. Accumulation of such personal data is carried out in accordance with the requirements of labor legislation. Accumulation and storage of personal data is carried out in the subsystems of the CIS and/or in paper form;
  3. personal data of persons who appeal to the NSSMC in accordance with the Laws of Ukraine "On Appeals of Citizens" and "On Access to Public Information" are collected by using information about such persons indicated by them in applications, requests, appeals, lawyer's requests, and information in paper and/or electronic form received from enterprises, institutions, and organizations in response to requests submitted in accordance with legislation. Accumulation and storage of personal data of the specified category of subjects is carried out using the electronic document management system and/or in paper form;
  4. collection of personal data of delegated representatives of state bodies or institutions of civil society, who are candidates for inclusion in the composition of NSSMC committees, the Consultative-Expert Council at the NSSMC, the Budget Council of the NSSMC, and other working bodies created by the NSSMC and the Consultative-Expert Council at the NSSMC, is carried out by their submission by delegated representatives and corresponding institutions of civil society. Accumulation and storage of personal data of the specified category of subjects is carried out using the electronic document management system and/or in paper form;
  5. the personal data subject is notified about the owner of personal data, the composition and content of collected personal data, their rights defined by the Law of Ukraine "On Protection of Personal Data", the purpose of their processing, the location or place of residence (stay) of the owner or administrator of personal data in written (electronic or paper) form in a notification on the processing of personal data (Appendix 1); at the time of collection of personal data, if personal data is collected from the personal data subject. Personal data is collected by filling out in written (electronic or paper) form consent for the processing of personal data (Appendix 2); in other cases within thirty working days from the date of collection of personal data, except for cases established by law;
  6. notification on the processing of personal data (in paper form) is drawn up by the independent structural subdivision of the NSSMC in which the accumulation of these personal data is carried out.
  1. Terms and conditions for storage of personal data:
  1. personal data is processed in a form that allows identification of the physical person to whom they relate, for a period no longer than necessary for the purpose of their processing, unless otherwise provided by legislation;
  2. personal data of NSSMC employees and candidates for vacant positions, appointment to which is carried out by the NSSMC, is stored for the period defined by legislation;
  3. personal data of persons who appeal to the NSSMC in the manner defined by the Laws of Ukraine "On Appeals of Citizens" and "On Access to Public Information" and persons, the processing of personal data of which is carried out during the conduct of a special check, is stored for 5 years from the date of appeal or conduct of the special check;
  4. personal data of delegated representatives of state bodies or institutions of civil society, who are candidates for inclusion in the composition of NSSMC committees, the Consultative-Expert Council at the NSSMC, the Budget Council of the NSSMC, and other working bodies created by the NSSMC and the Consultative-Expert Council at the NSSMC, is stored by the NSSMC for two years from the date of approval of the composition of the relevant body;
  5. ensuring the preservation and integrity of personal data is carried out in accordance with the requirements of Section V of this Procedure.
  1. Introduction of changes, deletion, or destruction of personal data:
  1. employees of structural subdivisions of the NSSMC who carry out processing of personal data in the volumes defined by their job descriptions review personal data for their relevance and accuracy in accordance with legislation;
  2. changes to personal data are introduced on the basis of: updated data received as part of regulated data submitted by participants of capital markets and organized commodity markets; updated data received during the provision of administrative services; motivated written request of the personal data subject; order of the Commissioner of the Verkhovna Rada of Ukraine for Human Rights or officials of the Secretariat of the Commissioner of the Verkhovna Rada of Ukraine for Human Rights defined by him; court decision that has entered into legal force; appeal of other subjects of relations related to personal data, if there is the consent of the personal data subject;
  3. personal data is deleted or destroyed in a manner that excludes the further possibility of restoring such personal data;
  4. in the event of discovery of information about a person that does not correspond to reality, such information must be immediately changed (updated) or destroyed;
  5. personal data is subject to deletion (destruction) in the event of: expiration of the storage period of data defined by the consent of the personal data subject to the processing of this data or by law; termination of legal relations between the personal data subject and the NSSMC, unless otherwise provided by law or defined by the storage period of documents containing such personal data; issuance of a corresponding order of the Commissioner of the Verkhovna Rada of Ukraine for Human Rights or officials of the Secretariat of the Commissioner of the Verkhovna Rada of Ukraine for Human Rights defined by him; entry into legal force of a court decision on deletion or destruction of personal data;
  6. personal data collected in violation of the requirements of the Law of Ukraine "On Protection of Personal Data" is subject to deletion or destruction in the manner established by legislation;
  7. the personal data subject has the right to submit a motivated request regarding the change or destruction of their personal data to the owner and administrator of personal data, if these data are processed illegally or are inaccurate;
  8. if as a result of the consideration of such a request, specified in sub-paragraph 7 of this paragraph, it is found that the personal data of the subject are processed illegally or are inaccurate, the NSSMC stops processing the personal data of the subject and informs the personal data subject about this.
  1. Access to personal data:
  1. employees of the NSSMC who have access to personal data must be familiarized with the requirements of the Law of Ukraine "On Protection of Personal Data" and other regulatory legal acts in the field of protection of personal data;
  2. employees of the NSSMC who have access to personal data are obliged to: prevent the loss of personal data and their unlawful use; not disclose personal data that were entrusted to them or became known in connection with the performance of official duties (such obligation remains in force after termination of their activity related to personal data, except for cases established by the Law of Ukraine "On Protection of Personal Data");
  3. employees who have access to personal data provide a written commitment not to disclose personal data (Appendix 3) and submit it for storage to the Personnel Management Department of the NSSMC. Each of these employees uses access only to those personal data (their parts) of subjects that are necessary in connection with the performance of their professional, official, or labor duties;
  4. information about employees of the NSSMC who have provided a written commitment not to disclose personal data is entered into the Journal of Registration of Commitments Not to Disclose Personal Data (Appendix 4), which is kept by the Personnel Management Department of the NSSMC;
  5. the personal data subject has the right to receive from the NSSMC any information about themselves without specifying the purpose of the request, except for cases established by law.
  1. Conditions for transfer of personal data to third parties:
  1. transfer of personal data to third parties is carried out in cases provided for by legislation;
  2. transfer of personal data to foreign subjects of relations related to personal data is carried out only on condition of ensuring adequate protection of personal data by the corresponding state in cases established by law or international treaties of Ukraine.

V. Measures to Ensure Protection of Personal Data

  1. Processing of personal data in independent structural subdivisions of the NSSMC is carried out in accordance with legislation in the field of protection of personal data.

  2. Processing of personal data is carried out in a manner that makes it impossible for third parties to access them. Employees who, in accordance with their official duties, carry out processing of personal data, are admitted to processing only after their authorization in the relevant systems.

  3. Processing of personal data in information and communication systems of the NSSMC is carried out in accordance with legislation in the field of protection of information in information and communication systems. For the purpose of ensuring the security of processing of personal data, software, technical, and organizational protection measures are taken, including those aimed at preventing unauthorized access to personal data and

9 of the technical and software complex used to process personal data. 28. During the processing of personal data, their protection against unauthorized and uncontrolled access, modification, destruction, copying, and dissemination must be ensured. Prevention of information security incidents related to unauthorized access to personal data is carried out in accordance with the norms of the information security policy adopted by the NSSMC. 29. The organization of work related to the processing and protection of personal data in independent structural subdivisions of the NSSMC office is assigned to their heads. 30. Heads of independent structural subdivisions of the NSSMC, within their authority, ensure:

  1. control over the implementation of established legislative requirements for ensuring the protection of personal data;
  2. the preservation of personal data and the restriction of access to them by other persons;
  3. the organization of personal data processing by employees of the corresponding independent structural subdivision in accordance with their official duties, to the extent necessary for the performance of such duties and instructions from the NSSMC management.
  1. The organization and coordination of activities related to the processing and protection of personal data in the NSSMC is assigned to the responsible person designated by the Order of the Head of the NSSMC Office (hereinafter – the responsible person).
  2. The responsible person is obliged:
  1. to organize work in the NSSMC related to the protection of personal data during their processing;
  2. to know the legislation of Ukraine in the field of personal data protection;
  3. to interact with the Authorized Person of the Verkhovna Rada of Ukraine for Human Rights and officials designated by him regarding the prevention and elimination of violations of legislation on personal data protection;
  4. to inform the Chairman of the NSSMC, the Head of the NSSMC Office, or persons performing their duties, regarding compliance with legislation on personal data protection, including about identified violations (or existing information regarding possible violations) of legislation on personal data protection and/or this Procedure, for the purpose of taking necessary measures;
  5. to inform and consult NSSMC employees on issues of compliance with legislation on personal data protection;

10 6) to regularly conduct training for NSSMC employees on the implementation of norms, changes, and additions to legislation regulating legal relations related to the protection and processing of personal data; 7) to analyze threats to the security of personal data. 33. The responsible person has the right:

  1. to obtain necessary documents related to the processing of personal data;
  2. to have access to any information processed by the NSSMC related to the processing of personal data, provided this does not contradict legislation. Director of the Department of Information Technologies Andriy ZAIKA

Appendix 1 to the Procedure for the Protection and Processing of Personal Data Processed by the National Commission for Securities and Stock Markets in Connection with the Performance of Assigned Tasks (subparagraph 5 of paragraph 20 of Section IV) Notification on the Processing of Personal Data

(surname, first name, patronymic (if any) of the data subject)

  1. In accordance with the requirements of Article 12 of the Law of Ukraine "On Personal Data Protection" (hereinafter – the Law), you are informed that the owner of your personal data is the National Commission for Securities and Stock Markets.
  2. Composition and content of your personal data, the owner of which is the NSSMC:
  1. The purpose of collection (including processing) of personal data is:
  1. Transfer of personal data to third parties may be carried out only after providing your written consent or in accordance with the law.
  2. As a data subject, you have the rights provided for in Article 8 of the Law, namely:
  1. to know about the sources of collection, location of your personal data, the purpose of their processing, the location or place of residence (stay) of the owner or administrator of personal data or to give an appropriate instruction to obtain this information to authorized persons, except in cases established by law;
  2. to receive information about the conditions for granting access to personal data, including information about third parties to whom your personal data are transferred;
  3. to access your personal data;
  4. to receive, no later than thirty calendar days from the date of receipt of the request, except in cases provided for by law, a response regarding whether your personal data are being processed, as well as to receive the content of such personal data;
  5. to submit a reasoned request to the owner of personal data with

2 Continuation of Appendix 1 objections to the processing of their personal data; 6) to submit a reasoned request regarding the change or destruction of their personal data by any owner and administrator of personal data, if these data are processed illegally or are inaccurate; 7) to protect their personal data from illegal processing and accidental loss, destruction, damage due to intentional concealment, non-provision, or untimely provision, as well as to protect against the provision of information that is inaccurate or defames your honor, dignity, and business reputation; 8) to file complaints about the processing of their personal data to the Authorized Person of the Verkhovna Rada of Ukraine for Human Rights or to the court; 9) to apply means of legal protection in case of violation of legislation on personal data protection; 10) to enter reservations regarding the restriction of the right to process their personal data during the provision of consent; 11) to withdraw consent for the processing of personal data; 12) to know the mechanism of automated processing of personal data; 13) to be protected from an automated decision that may have legal consequences for you.

Appendix 2 to the Procedure for the Protection and Processing of Personal Data Processed by the National Commission for Securities and Stock Markets in Connection with the Performance of Assigned Tasks (subparagraph 5 of paragraph 20 of Section IV) Consent for the Collection and Processing of Personal Data I, __________________________________________________________________________, (surname, first name, patronymic (if any)) born /__/_______, passport series (if any) ______ No ____________, by signing this consent in accordance with the Law of Ukraine "On Personal Data Protection" I give consent to the Owner of the personal data database _______________________________

(specify the full name of the legal entity) (hereinafter – the owner) for the collection, processing, and use of my personal data for the purpose of

(specify the purpose of processing personal data in accordance with the purpose of their processing) For this purpose, I transfer to the owner __________________________________________________

(specify the full name) information about surname, first name, patronymic (if any), date and place of birth, contact phone number, email address, registration number of the taxpayer's account card, address of place of residence / stay

(list other personal data necessary for the legal entity to achieve the purpose of processing) Personal data may also be used by the owner or third parties for the purpose of

(specify the purpose for which personal data will be used by third parties) I undertake, in case of changes to my personal data, to submit updated accurate information and corresponding documents for updating my personal data in the shortest possible time.

(date) (signature)

Appendix 3 to the Procedure for the Protection and Processing of Personal Data Processed by the National Commission for Securities and Stock Markets in Connection with the Performance of Assigned Tasks (subparagraph 3 of paragraph 23 of Section IV) Obligation on Non-Disclosure of Personal Data

(position)

(surname, first name, patronymic (if any)) In accordance with Article 10 of the Law of Ukraine "On Personal Data Protection", I undertake not to disclose in any way the personal data of other persons, which became known to me in connection with the performance of official duties. I confirm that the obligation will remain in force after I cease activities related to the processing of personal data, except in cases established by law. _____________ 20__ y. (date)

(signature)

Appendix 4 to the Procedure for the Protection and Processing of Personal Data Processed by the National Commission for Securities and Stock Markets in Connection with the Performance of Assigned Tasks (subparagraph 4 of paragraph 23 of Section IV) Journal of Registration of Obligations on Non-Disclosure of Personal Data No. p/o Position Surname, First Name, Patronymic (if any) Date of Providing Obligation on Non-Disclosure of Personal Data Date of Deprivation of Right of Access to Personal Data and Their Processing Reason for Deprivation of Right of Access to Personal Data and Their Processing (Dismissal, Transfer to a Position, Duties of Which Are Not Related to Processing Personal Data) 1 2 3 4 5 6

More like this from NSSMC

NSSMC published 2 documents in the last 30 days. We email you each new one the day it's published.

Topics
privacy
Share