Data protection & privacy law in Estonia (2026)

Estonia's Data Protection Inspectorate fined Allium UPI OÜ €3,000,000 — the largest GDPR penalty in Estonian history — for failing to secure the Apotheka pharmacy chain's loyalty-programme database after a 2024 breach exposed health-related purchase histories of over 750,000 individuals. It is also the first major fine levied under the 2023 amended full-GDPR-scale penalty regime; the decision is under appeal.

Amendments to the Personal Data Protection Act and Penal Code entered into force, raising Estonia's maximum data-protection penalty from €400,000 to €20,000,000 or 4% of global annual turnover — the ceiling mandated by GDPR Article 83. Because Estonia's legal system had previously confined GDPR enforcement to the misdemeanour procedure (recital 151), this reform was the critical precondition for meaningful large-scale enforcement; the statute of limitations was also extended from 2 to 3 years.

Estonia's new PDPA (adopted by the Riigikogu on 12 December 2018) came into effect, supplementing the directly applicable GDPR with national provisions on specific processing bases, data retention, and supervisory-authority powers. A separate Implementation Act adding sector-specific derogations followed on 15 March 2019.

Researchers publicly disclosed the ROCA vulnerability in Infineon TPM chips, affecting all Estonian ID cards issued after October 2014; weak RSA key generation meant private keys could potentially be reconstructed from public keys. On 3 November 2017 the government suspended digital certificates on ~760,000 cards, temporarily disabling e-authentication and digital signing for a large share of the population, exposing the systemic privacy risk of centralised identity-based data access.

Sustained distributed-denial-of-service attacks paralysed government websites, banks, and media for nearly a month — the first known coordinated cyber assault on a nation-state's public digital infrastructure. The crisis catalysed Estonia's adoption of the world's first national Cyber Security Strategy, the establishment of NATO CCDCOE in Tallinn, and a permanent elevation of data-security standards as an integral part of the data-protection framework.

AKI was reorganised from an agency under the Ministry of Internal Affairs to one operating under the Ministry of Justice, repositioning it as a civil-rights and rule-of-law body and reducing the structural tension between data protection and law-enforcement interests — a step that aligned Estonia's supervisory model more closely with European best practice.

Estonia deployed X-Road, a decentralised, cryptographically secured data-exchange layer that connects government agencies, hospitals, banks, and other organisations without creating a central data repository. By distributing data across source systems and enforcing access logging, X-Road embedded data-minimisation and auditability into the architecture of the entire Estonian digital state, processing over 2.2 billion transactions annually at its peak.