Data protection & privacy law in Estonia (2026)

Legal framework

GDPR (EU 2016/679) directly applicable since 25 May 2018; supplemented by Estonia's Personal Data Protection Act (Isikuandmete kaitse seadus, in force 15 January 2019) and the Personal Data Protection Act Implementation Act (PDPAIA). National supervisory authority: Andmekaitse Inspektsioon (AKI) / Data Protection Inspectorate.

GDPR & data protection in Estonia

In Estonia, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Data Protection Inspectorate (AKI).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Data Protection Inspectorate (AKI)

Applies to

any organisation processing the personal data of people in Estonia, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Estonia supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Estonia

1. 01Primary Legal Basis

   The GDPR has applied directly in Estonia since 25 May 2018. The national PDPA (2019) operates only where the GDPR does not directly govern a matter or explicitly permits Member State derogations; it does not duplicate but supplements the Regulation.

   riigiteataja.ee dlapiperdataprotection.com

2. 02National Derogations & Special Provisions

   The PDPA primarily transposes the Law Enforcement Directive (EU 2016/680) for police and criminal-justice processing, and specifies additional lawful grounds for journalistic, scientific, historical-research, archiving-in-public-interest, and creditworthiness-assessment purposes.

   riigiteataja.ee linklaters.com

3. 03Supervisory Authority: AKI

   The Andmekaitse Inspektsioon (AKI) is Estonia's GDPR Article 51 supervisory authority and also the freedom-of-information regulator. AKI received 4,162 inquiries in 2024 according to its annual report published March 2026, and participates in the European Data Protection Board.

   aki.ee edpb.europa.eu

4. 04Sanctions & Enforcement

   AKI may impose administrative fines up to €20 million or 4% of global annual turnover (whichever is higher). Estonia's misdemeanor procedural framework historically produced very low fine levels, but in September 2025 AKI issued a record €3 million fine against Allium UPI OÜ (Apotheka pharmacy) after a 2024 breach exposed data of over 750,000 individuals.

   dlapiperdataprotection.com gdprhub.eu

5. 05Data Subject Rights

   Estonian residents hold the full GDPR suite of rights, access, rectification, erasure, portability, objection, and restriction of processing, and may lodge complaints with AKI. Estonia's mature e-government infrastructure (eesti.ee portal, digital ID) supports practical exercise of these rights.

   eesti.ee aki.ee

6. 06EU-Level Overlay

   As an EU member state Estonia is fully subject to the EDPB's binding decisions and consistency mechanism. Cross-cutting EU frameworks, NIS2 (cybersecurity incident reporting to AKI as competent authority), the EU AI Act (high-risk AI obligations), and the DSA (online-platform transparency), layer additional data-handling requirements on top of the GDPR/PDPA baseline.

   edpb.europa.eu dlapiperdataprotection.com

GDPR in Estonia: FAQ

Timeline of decisions

1. 5 Sept 2025Enforcement · official
   AKI imposes record €3 million GDPR fine on Apotheka loyalty-programme operator

   Estonia's Data Protection Inspectorate fined Allium UPI OÜ €3,000,000 — the largest GDPR penalty in Estonian history — for failing to secure the Apotheka pharmacy chain's loyalty-programme database after a 2024 breach exposed health-related purchase histories of over 750,000 individuals. It is also the first major fine levied under the 2023 amended full-GDPR-scale penalty regime; the decision is under appeal.

   Andmekaitse Inspektsioon (AKI)

2. 1 Nov 2023Law · official
   PDPA and Penal Code amendment unlocks full GDPR-scale administrative fines

   Amendments to the Personal Data Protection Act and Penal Code entered into force, raising Estonia's maximum data-protection penalty from €400,000 to €20,000,000 or 4% of global annual turnover — the ceiling mandated by GDPR Article 83. Because Estonia's legal system had previously confined GDPR enforcement to the misdemeanour procedure (recital 151), this reform was the critical precondition for meaningful large-scale enforcement; the statute of limitations was also extended from 2 to 3 years.

   Riigi Teataja (Estonian Official Gazette)

3. 15 Jan 2019Law · official
   New Personal Data Protection Act Enters Into Force

   Estonia's updated Personal Data Protection Act entered into force, supplementing GDPR with national rules governing online data processing, defining the powers of the Data Protection Inspectorate, and establishing enforceable privacy rights for users of internet services — a core pillar of online safety for Estonian residents.

   Riigi Teataja (Estonian State Gazette)

4. 15 Jan 2019Law · official
   Revised Personal Data Protection Act enters into force

   Estonia's new PDPA (adopted by the Riigikogu on 12 December 2018) came into effect, supplementing the directly applicable GDPR with national provisions on specific processing bases, data retention, and supervisory-authority powers. A separate Implementation Act adding sector-specific derogations followed on 15 March 2019.

   Riigi Teataja — RT I, 04.01.2019, 11

5. 14 Feb 2007Decision · official
   Data Protection Inspectorate transferred to Ministry of Justice, strengthening independence

   AKI was reorganised from an agency under the Ministry of Internal Affairs to one operating under the Ministry of Justice, repositioning it as a civil-rights and rule-of-law body and reducing the structural tension between data protection and law-enforcement interests — a step that aligned Estonia's supervisory model more closely with European best practice.

   Andmekaitse Inspektsioon (AKI) — Institutional History

6. 1 Jan 2001Decision · official
   X-Road data-exchange platform launched — privacy-by-design backbone of e-government

   Estonia deployed X-Road, a decentralised, cryptographically secured data-exchange layer that connects government agencies, hospitals, banks, and other organisations without creating a central data repository. By distributing data across source systems and enforcing access logging, X-Road embedded data-minimisation and auditability into the architecture of the entire Estonian digital state, processing over 2.2 billion transactions annually at its peak.

   X-Road Global / Nordic Institute for Interoperability Solutions (NIIS)

Sources

1. 1.riigiteataja.ee/en/eli/523012019001/consolide
2. 2.aki.ee/en
3. 3.edpb.europa.eu/our-work-tools/our-documents/member-state/estonia_en
4. 4.dlapiperdataprotection.com/?t=law&c=EE
5. 5.dlapiperdataprotection.com/index.html?t=authority&c=EE
6. 6.dlapiperdataprotection.com/index.html?t=enforcement&c=EE
7. 7.gdprhub.eu/Data_Protection_in_Estonia
8. 8.linklaters.com/en/insights/data-protected/data-protected---estonia
9. 9.eesti.ee/en/security-and-defense/safety-and-security/protection-of-personal-da
10. 10.gdprhub.eu/AKI_(Estonia)
11. 11.aki.ee/en/guidelines-legislation/how-can-we-help-foreign-persons-and-authori