Company: KYIV
Filing Date: 2025-09-05
Form Type: F-1
Source: 0001213900-25-085122
Chunk: 77

Company: Kyivstar Group Ltd.
Filing Date: 2025-09-05
Form: F-1
Chunk 77
---
 countries have additional laws that regulate the processing, retention and use of communications data (including both content and metadata), as well as health data and certain other forms of personal data which have been designated as being particularly sensitive. These laws and regulations are subject to frequent revisions and differing interpretations and are, in certain jurisdictions, becoming more stringent over time. We are subject to other data protection laws and regulations that establish different categories of information such as state secrets and personal data of our customers, which have different registration and permitted disclosure rules and require different corresponding levels of protection and safeguards. In each case, we are required to implement the appropriate level of data protection measures and cooperate with government authorities with regards to law enforcement disclosures for state secrets and personal data of our customers. In Ukraine, new laws and regulations may be introduced subjecting us to more rigorous and stringent data protection or privacy requirements, which may result in increased compliance costs and business risks or increased risk of liability and exposure to regulatory fines and sanctions. For instance, in Ukraine, draft law “On the Protection of Personal Data” No. 8153, which has already been adopted in the first reading, aligns Ukrainian legislation with EU data privacy laws and increases fines for breaches committed by operators in the personal data sphere. In addition, in the European Union and U.K. respectively, we may be subject to the EU GDPR and to the UK GDPR (the EU GDPR and UK GDPR together referred to as the “GDPR”), which applies extraterritorially to the processing of personal data related to the offering of goods or services to individuals located in the EU and U.K. or the monitoring of their behavior in the EU and U.K., notwithstanding the absence of an establishment therein. To the extent applicable, the GDPR imposes comprehensive data privacy compliance obligations in relation to our collection and use of data relating to an identifiable living individual or “personal data,” including a principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit, as well as regulating cross -bordertransfers of personal data out of the EEA and the U.K. There are also other laws that restrict cross border data transfers unless certain criteria are met and/or are developing or implementing data localization laws requiring that certain types of data be stored locally. These laws may restrict our flexibility to leverage our data and build new, or consolidate existing, technologies, databases and IT systems, limit 36 our ability to use and share personal data, cause us to incur costs (including those related to storing data in multiple jurisdictions), require us to