Processes personal data, in Estonia

Võlaõigusseadus, §§ 1061-1067 · Read the law's page

• If you produce, import into the EU, or put your name or trade mark on a product, including computer software, you answer for the death, bodily injury or damage to health it causes while defective (Arts. 1061(1), 1062(1), 1063(1)).
• If you cannot name the producer or your own supplier to the injured person within a reasonable time after being asked, you answer as the producer (Art. 1062(2)).
• Be ready to prove one of the defences in Art. 1064(1): that you did not put the product on the market, that it was probably not defective then, that it was not made for sale or distribution in your business, that the defect results from mandatory requirements in force then, or that the state of science and technology did not allow the defect to be discovered.
• If you make a raw material or component, be ready to show that the defect results from the design of the finished product or the finished-product producer's instruction (Art. 1064(2)).
• Do not rely on a contract term to limit or exclude your liability to the injured person; it is void (Art. 1067).

Isikuandmete kaitse seadus, RT I, 04.01.2019, 11, adopted 12 December 2018 · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Estonia, including data collected by crawling.

Isikuandmete kaitse seadus, § 6 · Read the law's page

• If you process personal data without the data subject's consent for scientific or historical research or official statistics, process it in pseudonymised form or in a form that gives an equivalent level of data protection, and replace the personal data with such data before you hand it over for that processing (Personal Data Protection Act, Section 6(1)).
• Re-identify pseudonymised data, or any other non-identifying data, only for further scientific or historical research or official statistics (Section 6(2)).
• Designate by name the person who has access to the data that allow depseudonymisation (Section 6(2)).

Regulation (EU) 2016/679, Arts. 12-21; Isikuandmete kaitse seadus · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Estonia within one month of receipt.

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify the Estonian Data Protection Inspectorate without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Estonia, unless the breach is unlikely to risk their rights and freedoms.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
• Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Estonia outside the European Economic Area.

Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page

• Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Inimgeeniuuringute seadus, RT I, 17.03.2026, 1, §§ 4, 24 and 26 · Read the law's page

• If you are the controller of the gene bank, replace with a pseudonym all data in a donor's tissue sample and personal data that allow the donor to be identified directly (Section 24(3)).
• If you are the controller of the gene bank, an authorised processor or the controller of a research study, mark tissue samples and personal data, including the family tree, with the pseudonym the gene bank controller assigned (Section 24(4)).
• If you are the controller of the gene bank, keep the right to pseudonymise and depseudonymise donors' personal data to yourself and do not give it to an authorised processor (Section 12(2)).
• If you are the controller of the gene bank, depseudonymise a donor's personal data without an assessment by the research ethics committee only in the cases Section 26(1) lists.

Võlaõigusseaduse ning võlaõigusseaduse, tsiviilseadustiku üldosa seaduse ja rahvusvahelise eraõiguse seaduse rakendamise seaduse muutmise seadus (uue tootevastutuse direktiivi ülevõtmine) · Read the law's page

• Treat software as a product: software you develop or supply in your business answers like any other product, whether sold alone or built into another product (draft § 1063(1)).
• Keep supplying the software updates and upgrades a product needs to stay safe while it is within your control; a defect caused by software, an update, a missing safety update or a substantial modification within your control is not excused by saying it arose after you put the product on the market (draft §§ 1061(3[1]), 1061(3[2]), 1064(2[2])).
• Keep the technical documentation you could produce if a court orders disclosure on the injured person's application; failing to produce it presumes the product defective (draft §§ 1065[1](1), 1065(2)).
• If you are outside the EU, your importer or authorized representative answers for the product in your place, then your fulfilment service provider, then a distributor or online platform that does not name the responsible business within one month (draft § 1062[1](6), (7), (9), (10)).
• Be ready to prove one of the defences in § 1064(1), including that the defect could not be discovered given the state of science and technology when the product was put on the market, put into service or under your control (draft § 1064(1) point 5).
• Do not rely on a contract term to limit or exclude your liability to the injured person; it is void (draft § 1067).