Estonia

A controller must notify the Estonian Data Protection Inspectorate (AKI) without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Estonia, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No Estonia-specific narrowing of this timeline is independently confirmed.

The Personal Data Protection Act (PDPA) gives the General Data Protection Regulation (GDPR) domestic effect in Estonia and is enforced by the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI). Estonia's official gazette serves the Act's own text as a client-rendered page whose text is not machine-extractable, so the Act's specific derogation sections are not independently confirmed and are not restated here; the regime is instead described at the GDPR-baseline level.

Distinctively, Estonia's Information System Authority (RIA) operates a citizen-facing Data Tracker (Andmejalgija) that lets a person see, in one place, which public-sector systems connected via X-Road have processed their data, an operational implementation of the GDPR Article 15 access right rather than a separate statutory right.

Transferring personal data of a person in Estonia outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. Secondary commentary reports Estonia imposes no additional derogation beyond this General Data Protection Regulation (GDPR) Chapter V baseline; not independently confirmed against the Act's own text.

General Data Protection Regulation (GDPR) Articles 15 to 21 apply directly: access, rectification, erasure, restriction, portability, and objection, exercisable against the controller. Article 22 gives a qualified right against a decision based solely on automated processing with legal or similarly significant effect, applied in Estonia through the Personal Data Protection Act.

The public sector's access right is distinctively implemented as unified infrastructure through RIA's Data Tracker service, letting a citizen see which public-sector systems have processed their data in one place rather than requesting this separately from each controller. No Estonia-specific derogation narrowing these rights is independently confirmed.

The Estonian Data Protection Inspectorate (AKI) is the supervisory authority.

Estonian law does not recognize an administrative fine in the ordinary sense used elsewhere in the EU; Isikuandmete kaitse seadus Sections 66 to 70 and 73 instead make AKI itself the extrajudicial adjudicator of a General Data Protection Regulation (GDPR) Article 83 fine as an Estonian misdemeanor (vaartegu), applying the GDPR's own EUR 20,000,000 or 4 percent ceiling directly; a 2023 amendment reported by secondary commentary to have extended the limitation period is not independently confirmed against primary legislative text.

GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. No Estonian statutory enumeration or illustrative list narrowing or expanding this definition was read, and none is asserted; the Personal Data Protection Act's own text is not machine-extractable from the official gazette, and the Estonian Data Protection Inspectorate's thematic-inspection page serves no usable content. No AKI guidance or enforcement decision naming facial recognition or voice data specifically was located.

Illegal obtaining of access to a computer system by elimination or avoidance of a means of protection is punishable by a pecuniary punishment or up to three years' imprisonment. The offense escalates to up to five years' imprisonment where the act causes significant damage, reaches a computer system holding a state secret or classified information, or reaches a computer system of a vital sector.

Because the base offense requires eliminating or avoiding an established means of protection, accessing a page that carries no such protection, the ordinary case of public-web crawling, does not fall within Section 217 on the text of the section alone.

Section 206 punishes illegal alteration, deletion, damaging or blocking of data in a computer system with a pecuniary punishment or up to three years' imprisonment, rising to five years where the act is committed against numerous systems, by a group, against a vital-sector system, or causes significant damage.

Section 207 punishes illegal interference with or hindering of the functioning of a computer system by uploading, transmitting, deleting, damaging, altering or blocking data on the same three-year and five-year tiers. Unlike Section 217, neither offense is limited to access obtained by circumventing a protective measure, so a scraper that overloads, disrupts or corrupts a target system can fall within these sections even against a page with no access controls.

A maker of a database who has made a substantial investment, evaluated qualitatively or quantitatively, in collecting, obtaining, verifying, arranging or presenting its contents may prohibit extraction or re-utilisation of the whole or a substantial part of that database, per Section 75-3 and 75-4.

The right runs for fifteen years from the first of January of the year following completion of the database, restarting if the database is made available to the public before that term expires, per Section 75-7.

A lawful user of a database made available to the public may extract or re-utilise a substantial part without authorization or payment for private non-electronic use, for teaching or scientific research to the extent justified by the non-commercial purpose and with the source indicated, or for public security or an administrative or judicial procedure, per Section 75-6.

Section 7 requires an essential or important entity to apply, on an ongoing basis, appropriate and proportionate technical, operational and organisational security measures, based on its own risk analysis, to manage the risks to the system it uses in its activities or to provide its service, to prevent or minimise a cyber incident's impact on the recipients of its service and on other services, and to prevent, detect or resolve a cyber incident.

It must account for its own needs and security requirements, current European and international standards where relevant, the cost of the measures, their proportionality to its risk exposure and to the likelihood and severity of an incident including its societal and economic impact, and a systemic, comprehensive approach protecting both the systems and their physical environment.

A service provider that delegates system management to, or hosts its system with, another person remains responsible for ensuring that person applies the security measures.

The specific technical, methodological and sector-specific content of these measures, including the Estonian Information Security Standard (Eesti infoturbestandard, E-ITS), is set by a Government or ministerial regulation issued under Section 7, subsections 5 to 7, or by a European Commission implementing act under Directive (EU) 2022/2555 Article 21(5) where one applies to the service; that regulation's own content is not read here.

Section 6-1, also added by the 2025 amendment, requires a service provider to designate at least one management board member, or for a single-member board that member, or the equivalent office-holder for a provider with no board, who approves the security measures, monitors their implementation, is accountable for that duty, and completes regular training to understand and assess cyber risk.

Section 2(2) defines 'digitaalse teenuse osutaja' (digital service provider), an entity class reached by this duty, as an umbrella covering a domain name system service provider, a top-level domain name registry operator, a domain name registration service provider, a cloud computing service provider, a data centre service provider, a content delivery network service provider, a managed service provider, a managed security service provider, an operator of an online marketplace, and a provider of an online search engine or social media platform.

Section 3(2) names a central government public administration entity as an essential entity. Section 3(2) also names a local government public administration entity as an essential entity, so this duty reaches both public and private duty-bearers. Section 1(2) excludes state-secret and classified-foreign-information systems from the Act. Section 1(2) also excludes systems the Ministry of Defence needs for international military cooperation and national military defence preparation.

Estonia's security authority (julgeolekuasutus) holds the competent-authority role, instead of RIA, for an entity within the scope set out in Section 14. Both Section 7 and Section 6-1 entered into force on 1 January 2026 as part of Estonia's NIS2 transposition, amending the predecessor wording of Section 7 that had been in force since the Act's original 2018 enactment. A subject is given a three-year transition period to bring its activities into line with these requirements.

A vital-service provider under the Emergency Act instead follows a five-year deadline counted from its designation date. RIA's own account of the amendment states that from 2026 the number of Estonian undertakings subject to these requirements grew by about 3,000, to roughly 6,500.

Section 8 requires an essential or important entity, other than a security authority, to submit an initial report to RIA (Riigi Infosüsteemi Amet, the Estonian Information System Authority) without delay and no later than 24 hours after becoming aware of a cyber incident with a significant effect on system security or service continuity, or one whose significant effect is not obvious but can reasonably be expected.

Section 8(2) defines 'significant effect' by six alternative conditions: the incident rates at least severe under the entity's own Section 7 risk analysis; it prevents continuing the service beyond the maximum permitted outage in a service-level agreement or continuity requirement; it disrupts another service provider's continuity; resolving it requires extraordinary measures identified in the risk analysis or continuity documentation; it has caused or risks significant damage to the entity, another provider or the service's users; or it is significant under a European Commission implementing act adopted under Directive (EU) 2022/2555 Article 23(11).

Section 8(3) makes an incident always significant where it also disrupts the service in at least one other EU member state. Section 8, subsection 4-1, requires an incident report no later than 72 hours after becoming aware of the significant incident, updating the initial report, except a qualified trust service provider, which instead reports within 24 hours in a single stage under Section 8, subsection 4-2. Section 8, subsection 4-3, requires an interim report on RIA's request.

Section 8(7) requires a final report within one month of the incident report, treated as interim and followed by a further final report within one month of resolution if the incident remains unresolved at that point. Section 8(5) requires the entity to notify, within a reasonable time, a person whom the significant incident or a significant cyber threat may affect, or the public where affected persons cannot be individually notified.

Section 8(6) lets RIA itself inform the public after consulting the entity, or require the entity to, where public awareness serves prevention, resolution of the incident, or the public interest generally. Section 8-1 lets a service provider, or any other person, voluntarily notify RIA of a cyber incident, security vulnerability or cyber threat below the mandatory threshold, including a vulnerability report submitted anonymously, processed under the same Sections 8 and 12 procedure.

Section 5(3) designates RIA as the competent authority and single point of contact under Directive (EU) 2022/2555 Article 8, the authority for large-scale incidents and crises under Article 9, the national CSIRT under Article 10, the coordinated-vulnerability-disclosure coordinator under Article 12, and Estonia's participant in the CSIRTs network under Article 15. All these duties entered into force on 1 January 2026 as part of Estonia's NIS2 transposition.

A video-sharing platform operator must provide in its terms of service that the platform may not carry a programme, user-generated video or commercial communication that incites hatred, violence or discrimination on a protected ground endangering life, health or property, incites an offense, or depicts child pornography. Content that may impair a minor's physical, mental or moral development must carry a clear warning and an on-screen symbol throughout.

The operator must provide an easy way for users to flag such content, must remove or block access to prohibited content once aware of it, and for harmful-but-not-prohibited content must either add the warning and symbol or ensure the content is accessible only through personal identification codes or another appropriate technical solution that makes it inaccessible to a minor in the ordinary case. A user may complain to the Tarbijakaitse ja Tehnilise Järelevalve Amet (TTJA) about how these duties are applied.

A press publication's publisher holds the exclusive right to permit or prohibit an information society service provider's direct or indirect, temporary or permanent, partial or complete online reproduction of the press publication, and its making available to the public in a manner that lets people access it at a place and time individually chosen by them, per Section 73-2(1).

The right does not reach private, non-commercial use by an individual user, hyperlinking, or the use of single words or very short extracts from a press publication, per Section 73-2(3). The publisher's rights subsist for two years from the publication's publication date, per Section 74(1-1). Authors of works within the press publication are entitled to an appropriate share of the revenue the publisher receives from information society service providers for its use, per Section 73-2(5).

Without the author's consent and without paying remuneration, a research organization or cultural-heritage institution may reproduce, for scientific-research text-and-data-mining purposes, a work to which it has lawful access, per Section 19-1(1). A contractual term restricting this free use is void, per Section 19-1(4).

Separately, without prejudice to Section 19-1, reproduction of a lawfully accessible work for text-and-data-mining purposes is permitted without the author's consent or payment, but the author may expressly exclude this general free use in an appropriate manner, including by machine-readable means for content made publicly available online, per Section 19-2(1) and (2). Copies made under either section may be retained only as long as necessary for the text-and-data-mining purpose.