EstoniaHuman Genetic Research Act, pseudonymisation and depseudonymisation of gene donor data (Sections 6, 12, 24 and 26)
Inimgeeniuuringute seadus, RT I, 17.03.2026, 1, §§ 4, 24 and 26
In force since .
A de-identification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- If you are the controller of the gene bank, replace with a pseudonym all data in a donor's tissue sample and personal data that allow the donor to be identified directly (Section 24(3)).
- If you are the controller of the gene bank, an authorised processor or the controller of a research study, mark tissue samples and personal data, including the family tree, with the pseudonym the gene bank controller assigned (Section 24(4)).
- If you are the controller of the gene bank, keep the right to pseudonymise and depseudonymise donors' personal data to yourself and do not give it to an authorised processor (Section 12(2)).
- If you are the controller of the gene bank, depseudonymise a donor's personal data without an assessment by the research ethics committee only in the cases Section 26(1) lists.
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Sections 12, 24 and 26 set pseudonymisation and depseudonymisation duties. This row's cited provisions state no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Section 6 of the Inimgeeniuuringute seadus (Human Genetic Research Act) names the University of Tartu as the controller of the gene bank (geenivaramu). Section 24(3) requires the controller to replace, in a donor's tissue sample and personal data, all data that allow the donor to be identified directly with a pseudonym.
Section 24(4) requires the controller, the authorised processor and the controller of a research study to mark tissue samples and personal data, including the family tree, with the pseudonym assigned by the controller of the gene bank. Section 12(2) bars the controller from giving an authorised processor the right to pseudonymise and depseudonymise the personal data of gene donors.
Section 26(1) allows the controller to depseudonymise a gene donor's personal data without an assessment by the research ethics committee only in the cases the paragraph lists.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .