Law of Ukraine "On Cloud Services" was signed

On 15 March 2022, the President of Ukraine signed the Law of Ukraine "On Cloud Services" (the "Law"), which defines the legal relations related to data processing and protection when cloud computing technology, cloud services and its features are used in the public sector.

The Law provides grounds for the development of information and communication technology platforms based on cloud computing and the implementation of the "cloud first" principle. 

It will enter into force after six months following its publication, i.e. on 16 September 2022.

Key provisions

The Law provides for the following:

• definitions of "cloud computing", "cloud services", "cloud service provider", "cloud service user", "cloud resources", "data centre";
• the list of cloud services, methods of their provision, requirements for the cloud service provider for public customers; 
• the legal basis for the provision of cloud services, the essential terms of the agreement for the provision of cloud services; and
• peculiarities of providing and consuming cloud services, processing personal data and data protection when cloud services are provided.

Definition and types of cloud services

According to the Law, a cloud service is a service that provides the user with cloud resources by means of the cloud computing technology and remote access to the cloud infrastructure through e-communication networks. The cloud services include the following:

• infrastructure as a service (IaaS) provides the user with computing resources, storage resources or e-communication systems by means of the cloud computing technology;
• platform as a service (PaaS) provides the user with access to infrastructure and sets of computer programmes by means of the cloud computing technology;
• software as a service (SaaS) provides the user with access to the software by means of the cloud computing technology through an online service or computer agent programmes;
• security as a service (SECaaS) provides the user with cybersecurity service with the use of the cloud resources; and
• any services that fall within the meaning of the 'cloud services' definition.

Cloud services shall be provided by using of a specific type of cloud. A cloud can be private, collective, public, or hybrid (a combination of two or more clouds).

Procedure for providing cloud services

Both a legal entity and a private entrepreneur included in the list of cloud service providers and / or data centre services (the "List") are allowed to be the cloud service providers. The List has to be maintained by the regulator of communication services - National Commission for the State Regulation of Electronic Communications, Radiofrequency Spectrum and the Provision of Postal Services.

The Cabinet of Ministers of Ukraine shall determine the requirements for providers of cloud services and / or data centre services to be included in the List, and the procedure that confirms compliance with these requirements.
Services shall be provided under a written agreement. The Cabinet of Ministers of Ukraine shall approve a model agreement for the provision of cloud services and / or data centre services to the public user and critical information infrastructure facility. 

Public users of cloud services, in particular public authorities and local governments, shall choose the cloud service provider from the List in accordance with the procedures under the Law of Ukraine "On Public Procurement".

The cloud service provider is obliged to (i) provide services in compliance with the requirements of the legislation on personal data protection, information protection and cyber security and (ii) provide the user with information on the protection of data in the cloud computing system from internal and external threats, cyberattacks.

What will change due to cloud services launching?

The clouds usage optimises the process of processing and storing information, as well as allows to avoid the growth of similar internal systems of state bodies, local governments, state enterprises, institutions and organisations.

Cloud data storage helps to reduce the costs for building and expanding the state's computing capacity, stimulates the transition to the cloud model of most sectors of the Ukrainian economy and creates conditions for efficient use of public resources by the introduction of modern information processing technologies.