Law / Estonia

Kutseõppeasutuse seadus Section 32^1, Artificial Intelligence Applications in Vocational Teaching and Pupils' Personal Data

Kutseõppeasutuse seadus, § 32^1

In force since 30 Jun 2026.

An AI sector rules rule binding public and private bodies.

As of 12 October 2026.

What it requires

If you are a school using an artificial intelligence application in teaching, process a pupil's personal data only for that purpose, keep it for no more than three months after the pupil leaves the school, and give no school representative access to the data the pupil enters while using the application (Kutseõppeasutuse seadus (Vocational Educational Institutions Act), section 32^1(1) to (5)).
If you provide an artificial intelligence application for teaching, build it so that the pupil can delete the personal data entered while using it, and so that a school representative cannot reach those data; where the kinds of data cannot be told apart, apply both rules to everything the pupil entered (section 32^1(4) and (5)).

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 32^1 of the Kutseõppeasutuse seadus (Vocational Educational Institutions Act) gives a school the right to process a pupil's personal data in order to use an artificial intelligence application in teaching. The school processes the pupil's general data, the personal data, including special categories, that the pupil enters into the application to complete the curriculum, and other personal data, including special categories, that the pupil enters while using it.

The school keeps the personal data for up to three months after the pupil leaves the school. The application must let the pupil delete the other personal data that the pupil entered while using it, which point 3 of subsection 2 describes, and where the two kinds of data cannot be told apart, must let the pupil delete all the data the pupil entered.

The application must not allow a school representative access to those other data, or, where the two kinds of data cannot be told apart, to any of the data the pupil entered. The minister responsible for the field may by regulation set further safeguards for the use of an artificial intelligence application in teaching.

When LexLint raises it

When your app profile says your app serves under-18s, generates content with AI or deploys a chatbot.

Back to the example · Lint your app