EstoniaPersonal Data Protection Act (Isikuandmete kaitse seadus)
Isikuandmete kaitse seadus, RT I, 04.01.2019, 11, adopted
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Estonia, including data collected by crawling.
These lines are LexLint's reading of the law's text. Also read by: Andmekaitse Inspektsioon (the Estonian Data Protection Inspectorate) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.aki.ee/isikuandmed/andmetootlejale/tootlemise-oiguslikud-alused
- Guidance body
- Andmekaitse Inspektsioon (the Estonian Data Protection Inspectorate)
- Open questions
- What evidence beyond a stated adult-only policy shows that a general-audience service is offered 'otse lapsele' under section 8(1) of the Isikuandmete kaitse seadus, given that the Board's guidelines point to the content of the site and marketing plans?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Logging duty
In Chapter 4, which governs processing by law-enforcement authorities, the controller and the processor log at least collection, alteration, reading, disclosure, transfer, combining and erasure in automated systems. The logs of reading, disclosure and transfer must show the reason, the date and time, the person who read, disclosed or transferred the data and the recipients' names. The controller sets the retention periods of the logs (Section 36(5)). Section 37 adds a written register of processing operations, Section 44(6) documentation of every personal data breach and Section 50(2) documentation of each transfer to a third country; the register and the transfer documents are made available to the Data Protection Inspectorate on request (Sections 37(4) and 50(3)).
- Kind
- Explicit
- As of
- Provision
- Personal Data Protection Act (Isikuandmete kaitse seadus), Section 36 (logging by authorities processing for law-enforcement purposes), with Section 37, Section 44(6) and Section 50(2)
- Trigger
- personal_data_processing
What this law does
The Personal Data Protection Act (PDPA) gives the General Data Protection Regulation (GDPR) domestic effect in Estonia and is enforced by the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI). Section 8 of the PDPA sets the age at which a child can consent to information society services at 13, below the GDPR default of 16.
Distinctively, Estonia's Information System Authority (RIA) operates a citizen-facing Data Tracker (Andmejalgija) that lets a person see, in one place, which public-sector systems connected via X-Road have processed their data, an operational implementation of the GDPR Article 15 access right rather than a separate statutory right.
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .