Andmetekaitse

Andmetekaitse, or data protection, is the field concerned with safeguarding personal data throughout its life cycle. It covers how personal data is collected, stored, used, shared, and deleted, with the aim of protecting individuals’ privacy and rights in an increasingly data-driven world. In the European Union, data protection is primarily governed by the General Data Protection Regulation (GDPR). National laws, such as Estonia’s Isikuandmete kaitse seadus, implement and tailor GDPR requirements to national contexts.

Key principles of data protection include lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Processing of personal data must have a lawful basis, such as consent, performance of a contract, a legal obligation, vital interests, public task, or legitimate interests.

Data subjects have a range of rights, including access to their data, correction or deletion, restriction of processing, data portability, and objection to processing or profiling. They may withdraw consent at any time where processing is based on consent. Organizations must ensure data protection by design and by default, maintain records of processing activities, conduct data protection impact assessments when needed, and implement appropriate technical and organizational safeguards.

Security measures include encryption, access controls, and incident response. In case of a personal data breach, organizations may be required to notify the relevant supervisory authority and sometimes the affected individuals within a defined timeframe.

Transfers of personal data to non-EU countries require adequate protection or safeguards such as standard contractual clauses. Supervisory authorities, including Estonia’s Data Protection Inspectorate, enforce compliance and provide guidance at national and EU levels.