andmekaitseseadusi

Andmekaitseseadus is the Estonian data protection law that governs the processing of personal data. It provides the national framework for privacy protection in both public and private sectors and implements European Union data protection rules, including the GDPR, within Estonia. The Act defines personal data, processing activities, and the roles of data controllers and processors.

The law establishes core processing principles, such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. It sets out the legal bases for processing personal data, including consent, contract necessity, legal obligation, vital interests, public task, and legitimate interests. It also outlines data subject rights, such as access to data, correction, erasure, restriction of processing, objection, data portability, and protections against automated decision-making where applicable.

Controllers and processors must implement data protection by design and by default, maintain records of processing activities, and conduct risk assessments (DPIAs) for high-risk processing. In certain cases, a data protection officer may be required. The Act covers cross-border data transfers, requiring appropriate safeguards or legal mechanisms in line with GDPR.

Enforcement is carried out by the Data Protection Inspectorate (Andmekaitse Inspektsioon). The authority monitors compliance, provides guidance, and can impose administrative penalties and corrective measures for violations. The Act interacts with sector-specific laws and is regularly amended to reflect EU-level developments and evolving data protection practices.