Estonia

Estonia's own privacy law is the Personal Data Protection Act (Isikuandmete kaitse seadus, IKS). It says it only adds detail to the European privacy rules. It does not set its own test for who is covered. So the European rules decide that, and they are also what makes you name a representative inside Europe. Estonia's cybersecurity law goes further for one group. The Cybersecurity Act is called Kueberturvalisuse seadus, or KueTS. Under it, a digital service provider with no place of business in the European Union must name a representative. It must give that representative's address to the Estonian Information System Authority. The Gambling Act is stricter again. A company can only hold an Estonian remote gambling permit if it is registered in Estonia or another European Economic Area country. So foreign gambling operators cannot serve Estonia from outside at all.

Industry by industry, checked 18 August 2026. PHONE AND INTERNET: the Electronic Communications Act is called Elektroonilise side seadus, or ESS. It says stored traffic and location data must be kept inside a European Union member state. Three kinds of record must be kept in Estonia itself. Those are police data requests and the answers to them, interception log files and applications, and single court requests. This is a real ban on moving the data, not a paperwork step. GAMBLING: the Gambling Act lets the Tax and Customs Board refuse a remote gambling permit if the server sits outside Estonia. The same applies if the server sits outside the countries that signed the Convention on Cybercrime. It also applies if the server sits outside countries whose supervisors have a cooperation agreement with the Tax and Customs Board and the Financial Intelligence Unit. Player identity and session data held on that server must also be open to law enforcement without restriction. HEALTH: we found no rule in the Health Services Organisation Act forcing health data to stay in Estonia. Records must be kept for at least 30 years, and the state Health Information System is a national database. GOVERNMENT: we found no explicit ban on hosting abroad. Public bodies must exchange data through the state data-sharing system and must apply the Estonian Information Security Standard. BANKING, PAYMENTS, INSURANCE, SECURITIES: we found no rule forcing data to stay in the country. The Financial Supervision and Resolution Authority sets guidance on outsourcing and cloud use, and the European Union's financial resilience rules apply. EDUCATION, MAPPING AND GEOSPATIAL, DEFENCE PROCUREMENT: we found no rule forcing data to stay in the country, checked 18 August 2026, medium confidence.

The Estonian Data Protection Inspectorate's own guidance sets out the order to try. First, an official decision that the destination country is safe enough. Then the European standard contract, group-wide internal rules, an approved code of conduct, or a certification. After that, only a few narrow exceptions. The guidance says the standard contract and approved codes of conduct need no permission. Group-wide internal rules need the Inspectorate's approval where the group's lead company is in Estonia. A contract you wrote yourself needs the Inspectorate's approval, after it consults the European Data Protection Board. The guidance also notes that no certification scheme is running for transfers outside Europe. You can send data freely only to approved countries, and that approved list is real. The European Commission's list currently runs to sixteen countries and territories plus one international organisation. It includes the United States only for organisations signed up to the European Union-United States Data Privacy Framework.

The Inspectorate (Andmekaitse Inspektsioon) is headed by Pille Lehis. She was appointed on 19 August 2019 and confirmed for a second term on 16 May 2024. Its published statistics page was last updated on 22 April 2026. It shows 889 complaints, challenges and misdemeanour reports in 2024, and 1,568 in 2025. Orders were 26 in 2024 and 13 in 2025. Misdemeanour cases concluded were 7 in 2024 and 6 in 2025. Fines and non-compliance levies were 7 in 2024 and 5 in 2025. Four orders were published in 2026 up to 17 June 2026. The Personal Data Protection Act makes the Inspectorate a non-court body for minor criminal cases, with a three-year time limit. That is why penalty amounts stay small, even though the Act allows up to 20 million euros or 4 per cent of worldwide turnover. The Estonian Information System Authority is called Riigi Infosueesteemi Amet. It polices four things. The Cybersecurity Act, the state data-sharing system under the Public Information Act, the Emergency Act, and the security duties in the Electronic Communications Act. It publishes its enforcement orders. Those in 2025 and 2026 cover schools, municipalities, health providers, utilities and state agencies. Other active regulators are the Consumer Protection and Technical Regulatory Authority for telecoms, the Financial Supervision and Resolution Authority for banks and insurers, the Tax and Customs Board for gambling, and the Financial Intelligence Unit for money laundering.

MINIMUM KEEP-TIMES. Health Services Organisation Act: in-patient and out-patient records 30 years after the data are approved. Medical images 30 years. Dental images 15 years. Autopsy reports 30 years. Blood and transfusion records 30 years after death. Raw genetic data 30 years. The state Health Information System keeps data with no end date. Money Laundering and Terrorist Financing Prevention Act: at least 5 years after the business relationship ends or the transaction is made. A supervisor can add a further 5 years by written notice. Electronic Communications Act: traffic and location data 1 year from the communication, and authority requests for 2 years. Interception log files and applications must be kept at least 5 years. Gambling Act: electronic record data at least 5 years. Casino visitor records up to 5 years after the last visit. Video surveillance at least 14 days. MAXIMUM KEEP-TIMES. The general limit is the European rule that you delete data once you no longer need it. Estonia adds three specific limits. Consent survives death for 10 years, or 20 years if the person died a child, and heirs decide what happens to the data until then. Data about a missed payment may be passed to credit reference agencies only after 30 days have passed. It may be passed on only for 5 years after the missed payment ends. The old register of data users is archived for up to 5 years and then erased. CLASHES. Estonia solves a clash the usual European way. A specific keep-time set by law beats the duty to delete for as long as that keep-time runs. The Act also says a keep-time set by law may not simply be extended at will. One point to watch. Three duties sit in the chapter covering police and prosecutors. They are the written delete-by date, the full usage logs, and the data protection specialist. They do not apply to ordinary businesses.

The privacy deadline is the European 72-hour rule. The Estonian Data Protection Inspectorate states it plainly on its own site. The cyber deadline comes from the Cybersecurity Act, as rewritten by an amendment published on 30 December 2025 and in force from 1 January 2026. That amendment brings the European Union's second network and information security directive into Estonian law. It requires a first notice without delay, and no later than 24 hours after you become aware of a significant incident. An update follows within 72 hours. An interim report follows if asked for. A final report is due within one month. A trust service provider has 24 hours rather than 72 for the update. If you outsource or host your system with someone else, you stay responsible for making sure they tell you within 24 hours. Penalties reach up to 10 million euros or 2 per cent of worldwide turnover for an essential entity. For an important entity they reach up to 7 million euros or 1.4 per cent. Both privacy and cyber penalties run through the minor-criminal process, with a three-year time limit. Where a cyber breach also involves personal data, the Personal Data Protection Act procedure applies.

(1) The Personal Data Protection Act sets the digital consent age at 13. Below that age a parent or guardian must consent. (2) The same Act protects a dead person's data. (3) The Act requires names to be stripped out before data are handed over for research and statistics. The company handing the data over must name one person who can access the key that links the data back to people. An ethics committee must check sensitive research in advance. Changes in force from 1 October 2025 extended these rules to government policy analysis. (4) The Act makes the Inspectorate a non-court body for minor criminal cases, with a three-year time limit. It also creates a separate personal offence for an employee who looks up personal data outside their duties, worth up to 200 fine units. Crimes in the Penal Code sit alongside it. (5) A change in force from 1 January 2025 lets the Inspectorate bring group claims for affected people, in Estonia and across borders. (6) The Cybersecurity Act requires a service provider to name at least one management board member. That person approves and oversees security measures, and gets regular training. If nobody is named, the duty falls on every board member, and on a sole trader personally. Two more points are worth knowing. When you record people in public places you do not need consent, but you must give people a visible chance to avoid being recorded. And reporting a missed payment to credit agencies before 30 days have passed, or after 5 years, is against the law.

DATED ITEMS. 1 October 2026: an unidentified change starts across at least eight Estonian laws. The evidence is the end date printed on every current consolidated text in Riigi Teataja. 12 January 2027: the European Union Data Act cuts cloud switching charges and data export fees to zero. 1 January 2029: the three-year window in the Cybersecurity Act closes and every essential and important entity must be fully compliant. At European level, the European Union-United States Data Privacy Framework is still legally valid but under pressure. The European Data Protection Board wrote to the Commission on 31 July 2026 asking it to re-examine the decision. The Latombe appeal is pending before the Court of Justice. POWERS THAT COULD BE USED WITHOUT A NEW LAW. These matter more than pending bills. First, the Electronic Communications Act lets the Government extend the one-year telecoms keep-time by order, for public order or national security. It only has to tell the European Commission afterwards. Second, the Gambling Act lets the Tax and Customs Board order internet providers to block gambling websites. Third, the Cybersecurity Act lets the Government or a minister add binding security requirements, including the Estonian Information Security Standard, without a new law. Fourth, the part of the Personal Data Protection Act on research and policy analysis was widened this way as recently as 1 October 2025.