Personal Data Protection Act (Isikuandmete kaitse seadus)

Isikuandmete kaitse seadus, RT I, 04.01.2019, 11, adopted 12 December 2018

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 January 2019.

A comprehensive regime rule binding public and private bodies.

As of 24 August 2026.

What it requires

Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Estonia, including data collected by crawling.
Honor a request made through, or equivalent to, RIA's Data Tracker service for an overview of operations performed on a person's data by a public-sector controller connected via X-Road, as an implementation of the GDPR Article 15 access right.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Personal Data Protection Act (PDPA) gives the General Data Protection Regulation (GDPR) domestic effect in Estonia and is enforced by the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI). Estonia's official gazette serves the Act's own text as a client-rendered page whose text is not machine-extractable, so the Act's specific derogation sections are not independently confirmed and are not restated here; the regime is instead described at the GDPR-baseline level.

Distinctively, Estonia's Information System Authority (RIA) operates a citizen-facing Data Tracker (Andmejalgija) that lets a person see, in one place, which public-sector systems connected via X-Road have processed their data, an operational implementation of the GDPR Article 15 access right rather than a separate statutory right.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

Riigi Teataja official gazette listing
RIA (Estonian Information System Authority), Data Tracker service page

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app