EstoniaGDPR Article 9, Special Categories of Personal Data as Applied in Estonia
Regulation (EU) 2016/679, Art. 9
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 15 January 2019.
A sensitive categories rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Ground the processing of any biometric identifier of a person in Estonia, including a faceprint or voiceprint captured for unique identification, on a General Data Protection Regulation (GDPR) Article 9(2) condition such as explicit consent.
What it reaches
Excludes recording-derived identifiersNo
Who checks it
Audit expectation
none
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. No Estonian statutory enumeration or illustrative list narrowing or expanding this definition was read, and none is asserted; the Personal Data Protection Act's own text is not machine-extractable from the official gazette, and the Estonian Data Protection Inspectorate's thematic-inspection page serves no usable content. No AKI guidance or enforcement decision naming facial recognition or voice data specifically was located.
When LexLint raises it
processes_biometricsprocesses_voice
Read the law
Official Journal text, EUR-Lex, Regulation (EU) 2016/679
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.