Estonia. Comprehensive data protection. Act
IKS / PDPAPersonal Data Protection Act (Isikuandmete kaitse seadus)
In force
Partly verified
Medium confidence.English translation URL not re-verified.
§1Summary
- Synopsis
Estonia's PDPA supplements the GDPR and transposes the Law Enforcement Directive. Because Estonian law has no administrative fines, GDPR penalties are imposed through misdemeanour proceedings.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 13. GDPR fines applied via misdemeanour procedure (GDPR Recital 151); rules on processing data of deceased persons and on publication of personal data in the public interest.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover (via misdemeanour procedure)
§3Dates
- Key dates
- Adopted
- In force
- RT I, 04.01.2019, 11
§4Text and authority
- Text
- Authoritative text riigiteataja.ee
- English text riigiteataja.ee
- Authority
- Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
§5Where it applies
- Domestic law of
- Estonia
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.English translation URL not re-verified.