Andmeturbe

Andmeturbe is the practice of protecting personal and organizational data from unauthorized access, use, disclosure, alteration, or destruction. It encompasses policies, processes, and technical controls across the data lifecycle—from collection and storage to sharing, retention, and deletion—and applies to all information systems, networks, and business processes that handle data.

Key principles include legality, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Data subjects have rights such as access to personal data, correction, erasure, restriction, objection, and data portability. Data controllers determine purposes and means; data processors handle data on their behalf; organizations may appoint a data protection officer.

Legal framework includes GDPR in the European Union, supplemented by national laws such as Estonia's Personal Data Protection Act. Organizations must conduct risk assessments, implement DPIAs for high-risk processing, ensure appropriate technical and organizational measures, and establish breach notification procedures. Technical measures include access control, authentication, encryption, pseudonymization, secure coding, logging and monitoring, incident response, and regular audits.

Cross-border data transfers follow adequacy decisions or standard contractual clauses. In Estonia, data protection is complemented by a data-exchange infrastructure like X-Road, which enables controlled data sharing with privacy safeguards. Ongoing challenges include aligning privacy with AI and analytics, cloud adoption, supply-chain risk, and evolving regulatory expectations.