Digital Trust.

The association’s role

The National Cybersecurity Association of Ukraine is a collaboration platform and an association of experts and market participants. In this area it promotes literacy, the responsible use of technology and data protection at the system level.

“System level” means that trust in the digital environment is built not only by careful users but also by the organisations and developers who build security into products and processes. So the association develops collaboration between the state and the private sector and supports the exchange of experience, standards and resilience. There is no formal public-private partnership contract.

The association does not protect individuals, recover lost data or provide legal aid. An expert group for this area is only proposed.

Digital literacy: habits that work

In short: multi-factor authentication, passkeys and a recovery plan made in advance. CISA advises turning on multi-factor authentication, starting with email ⁸. The NCSC says passkeys protect against phishing ⁹.

Limit what you post, too: the FBI and the NCSC both advise reducing the public exposure of your voice, image and personal details ¹⁰¹¹.

Security built into systems

User literacy does not replace well-built systems. NIST’s digital identity guidelines (SP 800-63B-4) favour phishing-resistant authenticators and drop forced password rotation and composition rules ⁷. In other words, part of the responsibility moves from the person to the design of the system.

This is one of the conversations the association wants to support: how organisations can build services in which the safe behaviour is the easiest one.

Data protection: the legal frame

The foundation in Ukraine is the Law “On Personal Data Protection”, No. 2297-VI of 1 June 2010. The text on the Verkhovna Rada portal that was reviewed carries an edition dated 14 June 2025 ¹. The data subject’s specific rights and the supervisory body are deliberately not paraphrased here: this page does not stand in for the law. Read the current text on zakon.rada.gov.ua and talk to a lawyer, especially in the case of a leak or a dispute.

The GDPR applies outside the EU when a controller offers goods or services to people in the EU or monitors their behaviour there (Article 3(2)) ². For Ukrainian organisations with customers in Europe, that can be relevant.

The right to erasure (Article 17(1)) arises, among other cases, when the data is no longer necessary, consent is withdrawn, an objection is upheld, processing was unlawful, a legal obligation requires erasure, or the data is a child’s in online services ³. There are exceptions, including freedom of expression and information (Article 17(3)(a)) ³.

Likeness, voice and the responsible use of AI

Responsible use of generative technology means not creating or spreading realistic synthetic images or voices of a person without their consent. Platforms already treat such content as a privacy matter: YouTube’s process requires that you are uniquely identifiable and the material realistic, and it weighs disclosure of the synthetic nature, parody and public interest ⁴.

For intimate imagery, including AI-generated images, adults can use StopNCII (you must be in the image, and AI-generated images are within the service’s definition) ⁵. For images from before age 18 there is Take It Down ⁶.

Trust and freedom of expression

Erasure and moderation systems carry exceptions for freedom of expression, as both the GDPR ³ and YouTube’s practice ⁴ show. Trust in the digital environment cannot be built on removing lawful criticism, and the association takes no part in that.

Where to turn

The association offers no legal aid. For court matters and disputes you need a lawyer.

For a cyber incident, such as a stolen account or phishing, the Cyber Police takes reports through a form on its website ¹². An organisation can contact CERT-UA, which works with technical data and is not a punitive body ¹³.