🇪🇪Personal Data Protection Act

← Back to laws in Estonia

Personal Data Protection Act

Estonia applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Act supplements the GDPR, transposes the Law Enforcement Directive and adds Estonian provisions for expression, research, archiving, children, deceased persons, debt data, public recording, supervision and offences.

National additions and variations

• Section 8 sets 13 as the age for consent-based information-society services offered directly to a child.
• Sections 4 and 5 permit journalistic and academic, artistic or literary processing only under the stated public-interest or expression conditions and where disclosure does not cause excessive damage.
• Sections 6 and 7 require pseudonymisation or equivalent protection for research, statistics and archiving, with additional ethics-committee or Inspectorate review where identifiable or special-category data is used without consent.
• Section 9 extends consent for ten years after death, or twenty years for a minor, subject to statutory exceptions and successor rights.
• Sections 10 and 11 add accuracy, legal-basis, registration and prejudice safeguards for debt data and permit public-place recording for later disclosure only where notice and the statutory conditions are satisfied.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.