Cybersecurity law & regulation in Estonia (2026)

Legal framework

Cybersecurity Act (Küberturvalisuse seadus, 2018, amended January 2026 for NIS2 transposition); supervised by the Information System Authority (RIA) / CERT-EE as national competent authority

NIS2 & cybersecurity law in Estonia

In Estonia, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Estonia implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Estonia

1. 01NIS2 Transposition

   Amendments to the Cybersecurity Act implementing NIS2 Directive (EU) 2022/2555 entered into force on 1 January 2026. Estonia layered NIS2 obligations onto the existing 2018 Act rather than enacting new primary legislation, covering energy, transport, health, digital infrastructure, and public administration.

   digital-strategy.ec.europa.eu riigiteataja.ee

2. 02Incident Reporting Obligations

   Regulated entities must submit an early alert to CERT-EE within 24 hours of becoming aware of a significant incident, a full notification within 72 hours, and a final incident report within 30 days. Reports are submitted through the CERT-EE/NCSC portal. Separately, personal data breaches must be reported to the Data Protection Inspectorate (AKI) within 72 hours under GDPR.

   ria.ee ria.ee

3. 03Supervisory Authority (RIA/CERT-EE)

   The Estonian Information System Authority (RIA) is the sole national competent authority for cybersecurity, combining regulatory supervision, policy coordination, and incident response via CERT-EE. RIA carries out supervision over state and local government network/information systems and providers of digital services, with powers to impose corrective measures.

   ria.ee ria.ee

4. 04Phased Compliance Timeline

   Entities newly in scope must self-register with CERT-EE by 1 April 2026; governance and management controls are required by 1 January 2027; full technical security measures and first audits are mandated by 1 January 2028. Entities are classified as 'essential' or 'important' in line with NIS2 criteria.

   lexmundi.com digital-strategy.ec.europa.eu

5. 05National Cybersecurity Strategy 2024-2030

   Estonia's fourth national cybersecurity strategy, 'Cyber-Conscious Estonia' (2024-2030), sets policy objectives across four domains: resilient digital infrastructure, capable workforce, international cooperation, and managing national cybersecurity development. Cybersecurity funding grew from €3.9 million (2020) to €16.1 million (2024). In 2024, CERT-EE registered a record 6,515 cyber incidents.

   enisa.europa.eu ria.ee

6. 06Estonian Information Security Standard (E-ITS)

   RIA maintains the Estonian Information Security Standard (E-ITS), a national baseline security framework applicable to public sector bodies and critical infrastructure operators, requiring risk-based security measures including supply-chain controls, vulnerability management, and business continuity planning consistent with NIS2 requirements.

   ria.ee

NIS2 in Estonia: FAQ

Timeline of decisions

1. 1 Feb 2026Incident · official
   RIA Yearbook 2026 Documents All-Time-High 10,185 Incidents in 2025

   Estonia's annual cybersecurity yearbook recorded 10,185 cyber incidents with impact during 2025, a 56% jump over 2024's prior record, driven by intensified pro-Russian hacktivist DDoS campaigns and state-linked intrusion activity. The report also outlined RIA's expanding role as a government security-operations centre.

   RIA (Estonian Information System Authority)

2. 1 Jan 2026Law · official
   NIS2 Transposition: Cybersecurity Act Amendments Enter Into Force

   Amendments to Estonia's Cybersecurity Act (bill passed by Riigikogu on 10 December 2025) transposing the EU NIS2 Directive entered into force, expanding covered organisations from roughly 3,500 to 6,500 and requiring self-registration with CERT-EE by 1 April 2026. Estonia missed the EU's October 2024 deadline by over a year.

   Riigi Teataja (Estonian State Gazette)

3. 1 Jan 2026Law · official
   NIS2-Based Obligations Become Fully Effective; Self-Registration Opens

   The expanded scope of Estonia's amended Cybersecurity Act took full legal effect, sweeping an estimated 5,500-7,000 organisations (up from ~3,500 under NIS1) into mandatory risk-management and incident-reporting requirements; self-registration with CERT-EE was required by 1 April 2026, with governance controls due January 2027 and full technical compliance by January 2028.

   European Commission – Digital Strategy

4. 8 Apr 2025Law · official
   NIS2 Amendment to Cybersecurity Act Enters into Force

   The Riigikogu adopted 'Küberturvalisuse seaduse ja teiste seaduste muutmise seadus' on 4 April 2025; it entered into force 8 April 2025, transposing EU Directive 2022/2555 (NIS2). Estonia missed the EU's 17 October 2024 deadline but the law significantly broadens sectoral scope, strengthens supply-chain security obligations, and raises supervisory and sanctioning powers for RIA.

   Riigi Teataja (Estonian State Gazette)

5. 1 Feb 2025Incident · official
   RIA Yearbook 2025 Documents Record 6,515 Incidents in 2024

   Estonia's annual cybersecurity report recorded 6,515 cyber incidents with impact in 2024, roughly double 2023, including 580 DDoS attacks, a ransomware-driven data breach at Apotheka exposing ~700,000 customer records, and accelerating targeting of critical infrastructure by Russian-affiliated actors.

   RIA (Estonian Information System Authority)

6. 1 Jan 2024Guidance · official
   Cybersecurity Strategy 2024-2030 'Cyber-Conscious Estonia' Adopted

   Estonia's fourth national cybersecurity strategy sets goals through 2030 across four pillars: resilient digital infrastructure, cyber-literate society, capable public-sector cyber defence, and strong international cooperation. It mandates zero-trust architecture in government systems and post-quantum cryptography readiness.

   ENISA (hosting official Estonian strategy text)

7. 17 Aug 2022Incident · official
   Record DDoS Wave After Narva Monument Removal, Most Extensive Since 2007

   Pro-Russian group Killnet launched 66 DDoS attacks in a single day against Estonian government portals, banks, and private-sector targets following Estonia's relocation of a Soviet T-34 tank in Narva; RIA described it as the most extensive cyber offensive since 2007. All attacks were successfully mitigated with no significant service outage.

   RIA (Estonian Information System Authority)

8. 1 Jan 2019Guidance · official
   Cybersecurity Strategy 2019-2022 Adopted

   Estonia's third national cybersecurity strategy deepened integration with NATO and EU cyber defence frameworks, prioritised resilience of critical information infrastructure, and set the policy context for phased implementation of the 2018 Cybersecurity Act (with key provisions entering force in 2020 and 2022).

   Estonian Ministry of Justice and Digital Affairs

9. 9 May 2018Law · official
   Cybersecurity Act Enacted, NIS Directive Transposition

   The Riigikogu passed Estonia's Cybersecurity Act, transposing EU NIS Directive 2016/1148. The Act established binding risk-management and incident-reporting obligations for operators of essential services and digital service providers, formally designated RIA as the national competent authority and CSIRT, and phased in requirements through 2022.

   Riigikogu (Estonian Parliament)

10. 3 Nov 2017Incident · official
    Government suspends digital certificates of 760,000 Estonian ID cards, including all e-Residency cards, over Infineon chip flaw

    Estonian authorities block the security certificates of 760,000 ID and e-Residency cards after Czech researchers reveal a critical cryptographic flaw in Infineon RSA chips used in all cards issued since autumn 2014. Remote company management and digital signing are disrupted until cardholders update certificates; Estonia restores full functionality by early 2018, and publishes a public post-mortem.

    Estonian Government (Eesti Vabariigi Valitsus)

11. 16 Oct 2017Incident · official
    ROCA cryptographic flaw forces suspension of certificates on 760,000 Estonian eID cards

    Researchers publicly disclosed the ROCA vulnerability in Infineon TPM chips, affecting all Estonian ID cards issued after October 2014; weak RSA key generation meant private keys could potentially be reconstructed from public keys. On 3 November 2017 the government suspended digital certificates on ~760,000 cards, temporarily disabling e-authentication and digital signing for a large share of the population, exposing the systemic privacy risk of centralised identity-based data access.

    e-Estonia (Republic of Estonia Government Digital Showcase)

12. 1 Sept 2014Guidance · official
    Cybersecurity Strategy 2014-2017 Approved

    The Estonian government approved its second national cybersecurity strategy, focusing on increasing state capacity, raising public cyber-risk awareness, and expanding cooperation with EU and NATO partners. It coincided with Estonia's rising influence in shaping EU NIS policy and NATO cyber doctrine.

    ENISA

13. 14 May 2008Decision · official
    NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) Opened in Tallinn

    NATO formally opened the CCDCOE in Tallinn, co-founded by Estonia, Germany, Italy, Latvia, Lithuania, Slovakia, and Spain; it was accredited as an International Military Organisation on 28 October 2008. The Centre was the direct institutional outcome of the 2007 attacks and became NATO's principal body for cyber defence research, doctrine, and exercises.

    NATO

14. 1 Jan 2008Guidance · official
    Estonia's First National Cyber Security Strategy 2008-2013 Published

    Estonia published one of the world's first national cybersecurity strategies, a direct policy response to the 2007 attacks, establishing a whole-of-government approach, cross-sector cooperation, and an international engagement model. The document influenced NATO doctrine and was widely studied by other nations crafting their own strategies.

    Council of Europe (hosting official Estonian strategy text)

15. 27 Apr 2007Incident · official
    Nation-Scale DDoS Cyberattacks on Estonia — World's First Recognised National Cyber Campaign

    Weeks of coordinated DDoS attacks overwhelmed Estonian government, parliamentary, banking, and media websites — the first recognised large-scale cyber campaign targeting an entire nation-state. The attacks catalysed Estonia's cyber defence architecture, prompted NATO to establish the Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, and established online security as a national security priority.

    RIA (Estonian Information System Authority)

16. 27 Apr 2007Incident · official
    2007 Cyberattacks on Estonia: First Known State-Targeting Cyber Offensive

    Over three weeks starting 27 April 2007, Estonia suffered coordinated DDoS and defacement attacks against government, parliament, banks, media, and ISPs triggered by the relocation of the Bronze Soldier memorial. Widely regarded as the world's first large-scale state-targeting cyber offensive, it catalysed Estonia's, NATO's, and the EU's entire modern cyber defence architecture.

    NATO CCDCOE

17. 1 Apr 2007Incident · official
    Mass DDoS cyber attacks on Estonian digital infrastructure — watershed for data-security policy

    Sustained distributed-denial-of-service attacks paralysed government websites, banks, and media for nearly a month — the first known coordinated cyber assault on a nation-state's public digital infrastructure. The crisis catalysed Estonia's adoption of the world's first national Cyber Security Strategy, the establishment of NATO CCDCOE in Tallinn, and a permanent elevation of data-security standards as an integral part of the data-protection framework.

    NATO CCDCOE Cyber Law Toolkit

Sources

1. 1.riigiteataja.ee/en/eli/523052018003/consolide
2. 2.digital-strategy.ec.europa.eu/en/policies/nis2-directive-estonia
3. 3.ria.ee/en/cyber-security/handling-cyber-incidents-cert-ee/reporting-cyber-in
4. 4.ria.ee/en/cyber-security/supervision.html
5. 5.enisa.europa.eu/sites/default/files/ncss-map/strategies/reports/EE_NCSS_2024_en.pdf
6. 6.lexmundi.com/guides/status-of-the-nis2-implementation-act-in-the-european-union/ju
7. 7.ria.ee/en/cyber-security/management-state-information-security-measures/info
8. 8.ria.ee/en/cyber-security/cyber-defence-critical-infrastructure
9. 9.ria.ee/en/estonias-cybersecurity-starts-you