tehingutingimustega

Tehingutingimustega, also known as the "Law on the Protection of Personal Data," is a legislative framework in Estonia that governs the collection, processing, and protection of personal data. Enacted in 2018, it aims to ensure that individuals have control over their personal information and that organizations handle this data responsibly. The law applies to both public and private sector entities, as well as to individuals who process personal data for professional purposes.

Key provisions of the Tehingutingimustega include:

1. Consent: Organizations must obtain explicit consent from individuals before collecting and processing their personal data. This consent must be freely given, specific, informed, and unambiguous.

2. Data Minimization: Organizations are required to collect and process only the personal data that is necessary for the intended purpose. Any additional data must be justified by a legitimate reason.

3. Data Accuracy: Organizations must ensure that the personal data they hold is accurate and up-to-date. Individuals have the right to request corrections to their data.

4. Data Security: Organizations must implement appropriate technical and organizational measures to protect personal data from unauthorized access, loss, or destruction.

5. Data Subject Rights: Individuals have the right to access their personal data, request its correction, and request its deletion. They also have the right to object to the processing of their data and to data portability.

6. Data Breach Notification: Organizations must notify the relevant supervisory authority and affected individuals within 24 hours of becoming aware of a personal data breach.

The Tehingutingimustega is enforced by the Estonian Data Protection Inspectorate, which oversees compliance and investigates complaints related to the protection of personal data. The law is part of Estonia's broader commitment to digital innovation and privacy, reflecting the country's strong emphasis on data protection and individual rights.