Estonia

The Personal Data Protection Act (Isikuandmete kaitse seadus, IKS) says in section 1 that it only 'elaborates and supplements' the General Data Protection Regulation; it does not restate the territorial test, so Article 3 of the Regulation governs and Article 27 supplies the in-Europe representative duty. Estonia's cybersecurity law goes further for one group: under section 4 of the Cybersecurity Act (Kueberturvalisuse seadus, KueTS) a digital service provider with no place of business in the European Union must give the Estonian Information System Authority the address of its representative. Separately, the Gambling Act only lets a company hold an Estonian remote gambling permit if it is registered in Estonia or another European Economic Area state, so foreign gambling operators cannot serve Estonia from outside at all.

Sector by sector, checked 18 August 2026. TELECOMS: section 111-1(5) of the Electronic Communications Act (Elektroonilise side seadus, ESS) says the retained traffic and location data 'shall be preserved in the territory of a Member State of the European Union', and that three specific categories — the law-enforcement data requests and the answers to them, the interception log files and applications, and single court requests — must be preserved in Estonia. This is a hard wall, not a paperwork step. GAMBLING: sections 23 and 30(2) of the Gambling Act let the Tax and Customs Board refuse a remote gambling permit if the server sits outside Estonia, outside the parties to the Convention on Cybercrime, and outside states whose supervisors have a cooperation agreement with the Tax and Customs Board and the Financial Intelligence Unit. Section 55 also requires that player identification and session data held on that server be accessible to law enforcement without restriction. HEALTH: no localisation rule found in the Health Services Organisation Act, but a 30-year minimum retention applies and the state Health Information System is a national database. GOVERNMENT: no explicit ban on foreign hosting found, but public bodies must exchange data through the state data exchange layer and must apply the Estonian Information Security Standard. BANKING, PAYMENTS, INSURANCE, SECURITIES: no localisation rule found; the Financial Supervision and Resolution Authority regulates outsourcing and cloud use through advisory guidelines, and the European Union's financial resilience rules apply. EDUCATION, MAPPING AND GEOSPATIAL, DEFENCE PROCUREMENT: no localisation rule found, checked 18 August 2026, confidence medium.

The Estonian Data Protection Inspectorate's own guidance sets out the ladder: an adequacy decision, then standard contractual clauses, binding corporate rules, an approved code of conduct or a certification, then the narrow exceptions. It states explicitly that standard contractual clauses and approved codes of conduct need no authorisation, that binding corporate rules need the Inspectorate's approval where the group's lead is in Estonia, and that a bespoke set of clauses needs the Inspectorate's approval after consulting the European Data Protection Board. It also notes that no certification scheme is operational for third-country transfers. The model is an allowlist and the list is populated: the European Commission's approved-destination list currently runs to sixteen countries and territories plus one international organisation, and includes the United States only for organisations self-certified under the European Union-United States Data Privacy Framework.

The Inspectorate (Andmekaitse Inspektsioon) is headed by Pille Lehis, appointed 19 August 2019 and confirmed for a second term on 16 May 2024. Its published statistics page, last updated 22 April 2026, gives: complaints, challenges and misdemeanour reports 889 in 2024 and 1,568 in 2025; precepts 26 in 2024 and 13 in 2025; misdemeanour cases concluded 7 in 2024 and 6 in 2025; fines and non-compliance levies 7 in 2024 and 5 in 2025. Four precepts were published in 2026 up to 17 June 2026. Section 73 of the Personal Data Protection Act makes the Inspectorate the extra-judicial body for misdemeanour proceedings with a three-year limitation period, which is why penalty amounts stay small even though sections 65 to 71 allow up to 20 million euros or 4 per cent of worldwide turnover. The Estonian Information System Authority (Riigi Infosueesteemi Amet) supervises the Cybersecurity Act, the Public Information Act data exchange layer, the Emergency Act and the security duties in the Electronic Communications Act, and publishes its enforcement orders; those in 2025 and 2026 cover schools, municipalities, health providers, utilities and state agencies. Other live regulators: the Consumer Protection and Technical Regulatory Authority for telecoms, the Financial Supervision and Resolution Authority for banks and insurers, the Tax and Customs Board for gambling, and the Financial Intelligence Unit for money laundering.

FLOORS. Health Services Organisation Act section 42: in-patient and out-patient records 30 years after the data are approved, medical images 30 years, dental images 15 years, autopsy reports 30 years, blood and transfusion records 30 years after death, raw genetic data 30 years; the state Health Information System keeps data with no end date. Money Laundering and Terrorist Financing Prevention Act section 47: at least 5 years after the business relationship ends or the transaction is made, extendable by a further 5 years on a supervisor's compliance notice. Electronic Communications Act section 111-1(4): traffic and location data 1 year from the communication, and requests made under section 112 for 2 years; section 113 requires interception log files and applications to be kept at least 5 years. Gambling Act sections 55 and 57: electronic recordkeeping data at least 5 years, casino visitor records up to 5 years after the last visit, video surveillance at least 14 days. CEILINGS. The general limit is the European storage-limitation rule. Estonia adds three specific ones. Personal Data Protection Act section 9: consent survives death for 10 years, or 20 years if the person died a minor, and heirs control processing until then. Section 10: data about a broken obligation may be passed to credit reference agencies only after 30 days have passed and only for 5 years after the breach ends. Section 74: the old register of data processors is archived for up to 5 years and then erased. Note a common misreading — sections 17, 36 and 40 of the Act, which require a written keep-until date, full processing logs and a data protection specialist, sit in the chapter covering police and prosecutors, not ordinary businesses. CONFLICTS. Estonia resolves a clash the usual European way: a specific statutory keep-time overrides the delete duty for as long as it runs, and section 17(2) says a statutory period may not simply be extended at will.

The privacy clock is the European 72-hour rule; the Estonian Data Protection Inspectorate states it plainly on its own site. The cyber clock is section 8 of the Cybersecurity Act as rewritten by the amendment published on 30 December 2025 and in force from 1 January 2026, which transposes the European Union's second network and information security directive: an initial notification 'without delay, but no later than 24 hours after becoming aware' of a significant incident, an updating incident notification within 72 hours, an interim report on request, and a final report within one month. A trust service provider has 24 hours rather than 72 for the updating notification. If you outsource or host your system with someone else, you remain responsible for making sure they tell you within 24 hours. Penalties: up to 10 million euros or 2 per cent of worldwide turnover for an essential entity, and up to 7 million euros or 1.4 per cent for an important entity. Both privacy and cyber penalties run through the misdemeanour process with a three-year limitation period, and where a cyber breach also involves personal data the Personal Data Protection Act procedure applies.

(1) Section 8 of the Personal Data Protection Act sets the digital consent age at 13; below that a legal representative must consent. (2) Section 9. (3) Section 6 requires pseudonymisation before transfer for research and statistics, requires the controller to designate a named person with access to the re-identification key, and makes an ethics committee verify special-category research in advance; amendments in force from 1 October 2025 extended this framework to government policy analysis. (4) Section 73 makes the Inspectorate an extra-judicial misdemeanour body with a three-year limitation period, and section 71 creates a separate personal offence of up to 200 fine units for an employee who looks up personal data outside their duties, sitting alongside criminal offences in sections 157 and 157-1 of the Penal Code. (5) Section 2-1, in force from 1 January 2025, makes the Inspectorate a 'competent entity' able to bring national and cross-border collective representative actions for data subjects. (6) Section 6-1 of the Cybersecurity Act requires the service provider to designate at least one management board member who approves and oversees security measures and undergoes regular training; if none is designated the duty falls on every board member, and on a sole trader personally. Two further traps worth knowing: recording people in public places, where section 11 replaces consent with a duty to give people a visible chance to avoid being recorded; and the credit-reporting window in section 10, where reporting a missed payment before 30 days have passed, or after 5 years, is unlawful.

DATED ITEMS. 1 October 2026: an unidentified amendment commences across at least eight Estonian acts, evidenced by the end date on every current consolidated text in Riigi Teataja. 12 January 2027: the European Union Data Act requires cloud switching charges and data egress fees to fall to zero. 1 January 2029: the three-year window in section 4-1 and section 28-1 of the Cybersecurity Act closes and every essential and important entity must be fully compliant. At European level, the European Union-United States Data Privacy Framework remains legally valid but is under pressure — the European Data Protection Board wrote to the Commission on 31 July 2026 asking it to re-examine the decision, and the Latombe appeal is pending before the Court of Justice. DORMANT SWITCHES, which matter more than pending bills. First, section 111-1(6) of the Electronic Communications Act lets the Government extend the one-year telecoms retention period by order, in the interest of public order or national security, with only a notification to the European Commission afterwards. Second, section 60 of the Gambling Act lets the Tax and Customs Board order internet providers to block gambling domain names by precept. Third, section 7(5) of the Cybersecurity Act lets the Government or a minister add binding security requirements, including the Estonian Information Security Standard, by regulation without primary legislation. Fourth, section 5-1 of the Personal Data Protection Act on research and policy analysis was widened by regulation-level change as recently as 1 October 2025.