TheArtOfService
Back to Frameworks

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019)

Self-Assess
Estonia
v2019 (GDPR implementation)
7 domains
25 controls

Estonia's national Personal Data Protection Act (Isikuandmete kaitse seadus, RT I, 04.01.2019, 11, in force from 15 January 2019). The Act applies in conjunction with the GDPR: Chapter 2 implements the GDPR Article 85-89 derogations for journalistic, academic, scientific/historical research and archiving purposes; Chapter 3 covers national specifications including the child's age of consent (set at 13), processing after death of the data subject, processing in connection with violations of obligations, and processing in public places; Chapter 4 implements Directive (EU) 2016/680 (Law Enforcement Directive) for processing by law enforcement authorities, including processing principles, data subject rights, controller/processor obligations, the data protection specialist, security measures, breach notification, and transmission to third countries; Chapter 5 establishes the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) and its competence; Chapters 6-7 set liability, penalties and implementing provisions.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (7)

Estonia PDPA - Estonian Data Protection Inspectorate

2 controls
Controls in the Estonia PDPA - Estonian Data Protection Inspectorate domain of Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) — 2 controls
CodeTitle
EST-IKS-§51-55Formation of the Estonian Data Protection Inspectorate and Head appointment
EST-IKS-§56-61Exercise of state and administrative supervision by the Inspectorate

Estonia PDPA - GDPR Derogations for Specific Purposes

4 controls
Controls in the Estonia PDPA - GDPR Derogations for Specific Purposes domain of Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) — 4 controls
CodeTitle
EST-IKS-§4Processing for journalistic purposes (GDPR Art.85 derogation)
EST-IKS-§5Processing for academic, artistic and literary expression
EST-IKS-§6Processing for scientific and historical research and official statistics
EST-IKS-§7Processing for archiving in the public interest

Estonia PDPA - General Provisions and GDPR Application

3 controls
Controls in the Estonia PDPA - General Provisions and GDPR Application domain of Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) — 3 controls
CodeTitle
EST-IKS-§1Scope of regulation of the Act
EST-IKS-§2Specifications for application of the Act and Regulation (EU) 2016/679
EST-IKS-§3Application of the Administrative Procedure Act

Estonia PDPA - Law Enforcement Directive Implementation

7 controls
Controls in the Estonia PDPA - Law Enforcement Directive Implementation domain of Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) — 7 controls
CodeTitle
EST-IKS-§12-13Application of the Law Enforcement chapter and terms
EST-IKS-§14-21Principles of processing by law enforcement authorities
EST-IKS-§22-28Rights of data subjects in law enforcement processing
EST-IKS-§29-39Obligations of controllers and processors in law enforcement processing
EST-IKS-§40-42Data Protection Specialist for law enforcement processing
EST-IKS-§43-45Security measures and breach notification in law enforcement processing
EST-IKS-§46-50Transmission of personal data to third countries and international organisations

Estonia PDPA - Liability and Implementing Provisions

2 controls
Controls in the Estonia PDPA - Liability and Implementing Provisions domain of Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) — 2 controls
CodeTitle
EST-IKS-§62-73Violations, proceedings and penalties
EST-IKS-§74-76Register, repeal and entry into force

Estonia PDPA - National Specifications under GDPR

4 controls
Controls in the Estonia PDPA - National Specifications under GDPR domain of Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) — 4 controls
CodeTitle
EST-IKS-§10Processing of personal data in connection with violation of an obligation
EST-IKS-§11Processing of personal data in public places (CCTV)
EST-IKS-§8Processing of children's personal data for information society services
EST-IKS-§9Processing of personal data after death of the data subject

Scope and Application

3 controls
Controls in the Scope and Application domain of Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) — 3 controls
CodeTitle
EPDPA-1Scope of Regulation (§1)
EPDPA-2Specifications for Application (§2)
EPDPA-3Application of Administrative Procedure Act (§3)

Your Compliance Coverage

If you comply with Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019), you already cover:

GDPR

28%

7 controls mapped

Compare →

Australian Privacy Principles (APPs)

4%

1 controls mapped

Compare →

Virginia CDPA

4%

1 controls mapped

Compare →

+ 90 more: Vietnam PDPD (4%), Uruguay DPL (4%)

See all 93 mapped frameworks ↓

Maps to 93 other frameworks

25 total controls
GDPR
7 source controls mapped|8 target controls covered
28%
Australian Privacy Principles (APPs)
1 source controls mapped|3 target controls covered
4%
Virginia CDPA
1 source controls mapped|1 target controls covered
4%
Vietnam PDPD
1 source controls mapped|1 target controls covered
4%
Uruguay DPL
1 source controls mapped|2 target controls covered
4%
UNICEF Policy Guidance on AI for Children (2021)
1 source controls mapped|1 target controls covered
4%
UK GDPR (UK General Data Protection Regulation)
1 source controls mapped|2 target controls covered
4%
Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter
1 source controls mapped|1 target controls covered
4%
South Africa Promotion of Access to Information Act (PAIA)
1 source controls mapped|1 target controls covered
4%
UK AI Regulation Framework
1 source controls mapped|1 target controls covered
4%
Turkey KVKK
1 source controls mapped|1 target controls covered
4%
Trinidad and Tobago Data Protection Act 2011
1 source controls mapped|4 target controls covered
4%
TISAX - Trusted Information Security Assessment Exchange
1 source controls mapped|1 target controls covered
4%
Texas Data Privacy Act
1 source controls mapped|1 target controls covered
4%
Tanzania Personal Data Protection Act (Draft)
1 source controls mapped|4 target controls covered
4%
Taiwan PDPA
1 source controls mapped|2 target controls covered
4%
Student Privacy Pledge 2020
1 source controls mapped|1 target controls covered
4%
SASB Standards
1 source controls mapped|1 target controls covered
4%
Qatar DPL
1 source controls mapped|2 target controls covered
4%
Privacy Act 2020
1 source controls mapped|2 target controls covered
4%
POPIA
1 source controls mapped|2 target controls covered
4%
Peru DPL
1 source controls mapped|2 target controls covered
4%
Personal Data Act (personopplysningsloven)
1 source controls mapped|2 target controls covered
4%
PDPA Thailand
1 source controls mapped|2 target controls covered
4%
PDPA Singapore
1 source controls mapped|2 target controls covered
4%
OWASP Top 10 for LLM Applications 2025
1 source controls mapped|1 target controls covered
4%
Oregon Consumer Privacy Act
1 source controls mapped|3 target controls covered
4%
Oman National Cybersecurity Framework
1 source controls mapped|1 target controls covered
4%
OECD AI Principles
1 source controls mapped|1 target controls covered
4%
NRF Cybersecurity and Data Privacy Framework (National Retail Federation)
1 source controls mapped|1 target controls covered
4%
Notifiable Data Breaches Scheme (Australia)
1 source controls mapped|1 target controls covered
4%
NIST SP 800-122
1 source controls mapped|3 target controls covered
4%
NIST Privacy Framework
1 source controls mapped|5 target controls covered
4%
NIST AI 600-1: Generative AI Profile
1 source controls mapped|1 target controls covered
4%
Nigeria Open Banking Regulatory Framework (CBN, 2023)
1 source controls mapped|3 target controls covered
4%
Nigeria Data Protection Regulation (NDPR)
1 source controls mapped|1 target controls covered
4%
Nigeria Data Protection Act 2023 (NDPA)
1 source controls mapped|5 target controls covered
4%
Nebraska Data Privacy Act
1 source controls mapped|5 target controls covered
4%
New Jersey Data Privacy Act
1 source controls mapped|2 target controls covered
4%
New Hampshire Data Privacy Act
1 source controls mapped|3 target controls covered
4%
Nevada Gaming Control Board Cybersecurity Requirements
1 source controls mapped|1 target controls covered
4%
NAIC Insurance Data Security Model Law (MDL-668)
1 source controls mapped|1 target controls covered
4%
Montana Consumer Data Privacy Act
1 source controls mapped|2 target controls covered
4%
Minnesota Consumer Data Privacy Act
1 source controls mapped|2 target controls covered
4%
Mexico LFPDPPP
1 source controls mapped|2 target controls covered
4%
Mauritius DPA
1 source controls mapped|2 target controls covered
4%
Maryland Online Data Privacy Act of 2024
1 source controls mapped|2 target controls covered
4%
MARS-E
1 source controls mapped|1 target controls covered
4%
Malaysia PDPA 2010
1 source controls mapped|3 target controls covered
4%
Liechtenstein DPA
1 source controls mapped|2 target controls covered
4%
LGPD
1 source controls mapped|1 target controls covered
4%
South Korea PIPA
1 source controls mapped|1 target controls covered
4%
Kids Online Safety Act (KOSA)
1 source controls mapped|2 target controls covered
4%
Kenya Data Protection Act
1 source controls mapped|1 target controls covered
4%
Kentucky Consumer Data Protection Act
1 source controls mapped|2 target controls covered
4%
Japan AI Guidelines
1 source controls mapped|1 target controls covered
4%
Jamaica Data Protection Act 2020
1 source controls mapped|3 target controls covered
4%
ITU-T X.805 - Security Architecture for End-to-End Communications
1 source controls mapped|1 target controls covered
4%
Israel Protection of Privacy Law (5741-1981)
1 source controls mapped|3 target controls covered
4%
Iowa Consumer Data Protection Act
1 source controls mapped|1 target controls covered
4%
Indonesia PDP Law
1 source controls mapped|1 target controls covered
4%
Indiana Consumer Data Protection Act
1 source controls mapped|1 target controls covered
4%
IEEE 7000
1 source controls mapped|1 target controls covered
4%
Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)
1 source controls mapped|1 target controls covered
4%
Hong Kong Personal Data (Privacy) Ordinance (PDPO, Cap 486)
1 source controls mapped|2 target controls covered
4%
FTC GLBA Safeguards Rule (16 CFR Part 314)
1 source controls mapped|1 target controls covered
4%
Florida Digital Bill of Rights (FDBR)
1 source controls mapped|3 target controls covered
4%
Family Educational Rights and Privacy Act (FERPA)
1 source controls mapped|3 target controls covered
4%
FedRAMP Rev 5
1 source controls mapped|1 target controls covered
4%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
1 source controls mapped|3 target controls covered
4%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
1 source controls mapped|3 target controls covered
4%
Azerbaijan Law on Personal Data (2010)
1 source controls mapped|3 target controls covered
4%
APPI
1 source controls mapped|3 target controls covered
4%
Barbados Data Protection Act 2019
1 source controls mapped|3 target controls covered
4%
Armenia Law on Protection of Personal Data (2015)
1 source controls mapped|3 target controls covered
4%
ISO/IEC 27400:2022
1 source controls mapped|2 target controls covered
4%
ISO/IEC 38500:2024 - Governance of IT
1 source controls mapped|1 target controls covered
4%
Bahrain PDPL
1 source controls mapped|3 target controls covered
4%
ISO/IEC 29100:2024
1 source controls mapped|3 target controls covered
4%
ISO/IEC 29134:2023
1 source controls mapped|3 target controls covered
4%
ISO/IEC 27014:2020
1 source controls mapped|2 target controls covered
4%
Azure Security Benchmark
1 source controls mapped|1 target controls covered
4%
Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014)
1 source controls mapped|1 target controls covered
4%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
1 source controls mapped|2 target controls covered
4%
Illinois Biometric Information Privacy Act (BIPA)
1 source controls mapped|1 target controls covered
4%
ISO/IEC 23837 - Security Requirements for Quantum Key Distribution
1 source controls mapped|1 target controls covered
4%
COSO Internal Control - Integrated Framework (2013)
1 source controls mapped|1 target controls covered
4%
SSAE 18 - Attestation Standards (SOC Reporting)
1 source controls mapped|2 target controls covered
4%
AICPA Privacy Management Framework (PMF)
1 source controls mapped|3 target controls covered
4%
NIST AI Risk Management Framework (AI RMF 1.0)
1 source controls mapped|3 target controls covered
4%
ISO/IEC 23894:2023
1 source controls mapped|1 target controls covered
4%
MARS-E - Minimum Acceptable Risk Standards for Exchanges
1 source controls mapped|1 target controls covered
4%
SOC 2
1 source controls mapped|3 target controls covered
4%
Compare Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) with GDPR

Frequently Asked Questions

What is Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019)?

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) is a compliance framework from Estonia with 7 domains and 25 controls. Estonia's national Personal Data Protection Act (Isikuandmete kaitse seadus, RT I, 04.01.2019, 11, in force from 15 January 2019). The Act applies in conjunction with the GDPR: Chapter 2 implements the GDPR Article 85-89 derogations for journalistic, academic, scientific/historical research and archiving purposes; Chapter 3 covers national specifications including the child's age of consent (set at 13), processing after death of the data subject, processing in connection with violations of obligations, and processing in public places; Chapter 4 implements Directive (EU) 2016/680 (Law Enforcement Directive) for processing by law enforcement authorities, including processing principles, data subject rights, controller/processor obligations, the data protection specialist, security measures, breach notification, and transmission to third countries; Chapter 5 establishes the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) and its competence; Chapters 6-7 set liability, penalties and implementing provisions. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) have?

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) has 25 controls organised across 7 domains. The largest domains are Estonia PDPA - Law Enforcement Directive Implementation (7 controls), Estonia PDPA - GDPR Derogations for Specific Purposes (4 controls), Estonia PDPA - National Specifications under GDPR (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) map to?

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) maps to 93 other compliance frameworks. The top mapping partners are GDPR (28% coverage), Australian Privacy Principles (APPs) (4% coverage), Virginia CDPA (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) compliance?

Start your Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 25 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.

Get Started Free →

Free forever — no credit card required