Legal Aspect of Electronic Document Management in Ukraine: Current Norms and Requirements

Electronic document management has long become an integral part of modern business processes. However, for this process to be legitimate and comply with all current norms, certain legal requirements must be observed. Mykhailo Vihovskyi, a member of the Supervisory Board of Intecracy Group, spoke about the legal aspect of working with electronic documents on October 19, 2023, during the Software Ukraine association conference. 

Today, the popularity of electronic document management – a set of processes for creating, processing, approving, sending, receiving, and storing electronic documents carried out in digital format – is growing daily. This is not surprising, as this technology offers numerous advantages over paper format. 

1. Legislative Regulation

Electronic document management in Ukraine is regulated by the following laws:

• “On Electronic Documents and Electronic Document Management”;
• “On Electronic Trust Services”.

According to these legislative acts, electronic documents have the same legal force as paper ones. This means that if a company initially develops a document on paper and later creates several electronic copies identical in content and requisites, each of these copies will be considered an original. In other words, in the event of court hearings, tax audits, or any other similar operations at an enterprise using electronic document management, its management will only need to provide the documentation in digital form upon request.

2. Requirements for an Electronic Document

An electronic document must contain all mandatory requisites, including:

• the document’s name;
• a timestamp registering its creation date and time;
• the name of the company that created it;
• a personal digital signature or any other information allowing the identification of the document’s author;
• other requisites necessary for a specific document type.

3. Document Storage

Current legislation requires electronic documents to be stored for a specific period, which is defined for particular types of documents. The law also requires storage systems to be protected against unauthorized access, destruction, or alteration. 

Regardless of the form in which documents are created – paper or electronic – there is a specific procedure for working with them and preparing them for archival storage in record-keeping. This is regulated by the Ministry of Justice Order No. 1886 of 11.11.2014. This document establishes general requirements for:

• the implementation of electronic document management in Ukraine using EDS (QES);
• the organization of work with e-documents in state bodies and local self-government bodies;
• the launch of electronic document management in enterprises, organizations, and institutions of various forms of ownership.

According to this Order, electronic documents must be stored on special electronic media in a format that allows their integrity to be verified at any time. Moreover, their storage period must fully coincide with the period established by current legislation for analogous documents created on paper. If there is a possibility that e-documents may be damaged during long-term storage on flash memory, hard disk, magnetic tape, etc., the enterprise management must duplicate them on several electronic media or create a paper copy.

4. Document Secrecy

The Law of Ukraine “On Access to Public Information” regulates access to documents containing public information. However, Article 6 defines what constitutes restricted access information (confidential, secret, official information) and describes the conditions for restricting access to information: 1) exclusively in the interests of national security, territorial integrity, or public order to prevent riots or crimes, to protect public health, to protect the reputation or rights of other people, to prevent the disclosure of information received confidentially, or to maintain the authority and impartiality of justice; 2) the disclosure of information may cause significant harm to these interests; 3) the harm from the disclosure of such information outweighs the public interest in obtaining it. 

Access restriction applies to information, not the document itself. If a document contains restricted access information, the information with unrestricted access is provided for review.

Confidential information is information access to which is restricted by a natural or legal person, except for subjects of authority, and which may be disseminated in the manner determined by them at their discretion in accordance with the conditions they specify. Holders of confidential information may disseminate it only with the consent of the persons who restricted access to the information, and in the absence of such consent, only in the interests of national security, economic well-being, and human rights. 

Secret information is information access to which may harm an individual, society, and the state. Secret information includes state, professional, banking secrecy, pre-trial investigation secrecy, and other legally protected secrets.

Official information may include the following:

1) contained in documents of subjects of authority that constitute internal official correspondence, memoranda, recommendations, if they are related to the development of the institution’s activities or the exercise of control and supervisory functions by state authorities, the decision-making process, and precede public discussion and/or decision-making;

2) collected during operational-search, counterintelligence activities, in the field of national defense, which is not classified as a state secret.

2. Documents containing official information are marked “for official use”. 

3. The list of information constituting official information, compiled by state authorities, local self-government bodies, and other subjects of authority, including in the exercise of delegated powers, cannot be restricted in access.

The Law of Ukraine “On Information Protection in Information and Communication Systems” regulates relations in the field of information protection in information, electronic communication, and information and communication systems (hereinafter – the system). The objects of protection in the system are the information processed therein and the software intended for processing this information. State information resources or restricted access information, the protection requirement for which is established by law, must be processed in the system using a comprehensive information protection system with confirmed compliance. Confirmation of compliance of the comprehensive information protection system is carried out based on the results of a state examination, which is conducted taking into account industry requirements and information security norms in the manner established by law.

Confirmation of compliance and state examination of technical and cryptographic information protection means are carried out in the manner established by law. To create a comprehensive system for protecting state information resources or restricted access information, the protection requirement for which is established by law, cryptographic information protection means with a positive expert opinion based on the results of a state examination in the field of cryptographic information protection, and technical information protection means with a positive expert opinion based on the results of a state examination in the field of technical information protection or a certificate of conformity issued by a conformity assessment body are used…. Responsibility for ensuring information protection in the system rests with the system owner. The owner of a system that processes state information resources or restricted access information, the protection requirement for which is established by law, establishes an information protection service or appoints individuals responsible for ensuring and controlling information protection.

5. International Integration 

Due to Ukraine’s aspiration for integration into the European space, current legislation is constantly updated to reflect international standards and practices in the field of electronic document management.

“The legal aspect of electronic document management in Ukraine is constantly evolving. Companies that use or plan to implement an electronic document management system must continuously monitor changes in legislation to ensure the legal compliance of their activities,” notes Mykhailo Vihovskyi.