#52026XG02776EU Notice on Personal Data Processing for Ukraine-Related Sanctions
AI-generated summary for informational purposes only. Not legal advice. See the original source for the authoritative text.
This notice explains how the Council of the EU processes personal data for people listed under EU sanctions linked to actions against Ukraine’s territorial integrity, sovereignty and independence. It covers the data used to identify listed individuals, explain why they are listed, and maintain the sanctions list that supports asset freezes and travel restrictions. Affected individuals can contact the Council or its Data Protection Officer to access, correct, complete, object to, restrict, or in some cases request deletion of their data. Their data may be shared with EU bodies, Member States, and in limited cases third countries or international organisations, and is generally kept for five years after the sanctions end or after related court cases are final.
AI-generated summary. May contain errors. Refer to official sources for legal decisions.
Key Changes
- Explains the Council’s data processing for individuals listed under EU Ukraine-related sanctions
- Identifies the personal data used to maintain sanctions listings, including identification details and reasons for listing
- Sets out data subject rights, retention periods, contact points, and possible data sharing with EU bodies, Member States, third countries, or international organisations
Obligations
What this law requires
The Council of the European Union must process listed persons’ personal data only for establishing and updating the sanctions list under Decision 2014/145/CFSP and Regulation (EU) No 269/2014, including identification data, statements of reasons, and data related to listing grounds.
The Council may share listed persons’ personal data with Member States, the European Commission, and the European External Action Service as recipients in the context of EU restrictive measures.
The Council must retain personal data processed in the context of EU autonomous restrictive measures for 5 years after the data subject is removed from the asset-freeze list or the measure expires, or, if legal action is brought before the Court of Justice, until final judgment is handed down.
The Council may transfer listed persons’ personal data to a third country or international organisation without an adequacy decision or safeguards only where the transfer is necessary for important reasons of public interest or for the establishment, exercise, or defence of legal claims.
The Council must not use automated decision-making in processing the personal data of data subjects covered by the notice.