--- title: "Estonia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/estonia/ source_html: /jurisdictions/estonia/index.html description: "Estonia data protection and privacy regulation: 10 categories, 60 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 37d0204c64f2ee14c17840eb3dff47ef625e9f60edee6368f42ec4dd7f85f9a5 generator: "fe-fleet/md-twin@1.0" --- # Estonia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/estonia/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 60 claims · 44 sources in the cumulative register Download report (PDF) Expand all Estonia's first full GDPR baseline this cycle carries one dominant signal. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Sectoral Watch, AdTech & Commercial Privacy (2 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ESTONIA)[Build Report](/reports/?j=ESTONIA)[Compare](/compare/?j=ESTONIA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 60 Claims 16 Tier-1 sources Traffic-light mix 5 green 5 amber (sums to 10 rendered categories; click to filter) No red categories; 15 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Estonia is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Estonia’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 985 Full executive summary 443 ###### Latest update · 25 October 2026 #### Lead Signal Estonia's new financial fraud prevention and combating law, 936 SE, passed by the Riigikogu on or about 21 October 2026, creates a sectoral personal-data-sharing gateway that sits beside, rather than fully inside, the ordinary data-protection framework. The Act gives credit institutions and payment and e-money institutions the right to exchange fraud-suspicion data, which will often include personal data, with each other, with the Police and Border Guard Board, and with CERT-EE, Estonia's computer emergency response team; a parallel exchange right extends to credit providers and credit intermediaries for loan fraud specifically. The Act is understood to have been adopted but not yet in effect, pending publication in the Riigi Teataja. The specific GDPR legal-basis provision that the Act itself relies on for this sharing has not been confirmed from the Act's own text, so the precise interaction between the new sectoral gateway and the general lawful-processing framework remains to be established. #### Other Developments A conduct-facing transposition bill touching commercial data practices. A separate bill, 796 SE, is understood to be progressing through the Riigikogu to transpose the EU's distance-marketing-of-financial-services directive. As described, it would prohibit manipulative online-interface design, sometimes called dark patterns, in distance contracts for financial services, and would introduce a right for a consumer to be redirected to a human adviser rather than being confined to a chatbot. The current Riigikogu reading stage and the bill's expected adoption date have not been confirmed from a primary dated source. #### Cross-Monitor Connections The fraud-data-sharing gateway created by 936 SE is, in substance, a financial-sector anti-fraud and anti-money-laundering mechanism built on a personal-data foundation, and its operational detail is more fully tracked on the financial-integrity and payments side; readers following those implications are directed there rather than to a parallel analysis here. Similarly, 796 SE's dark-pattern prohibitions and human-contact right respond to a payments conduct and consumer-protection concern as much as a data-protection one, and the payments-sector reading of that same instrument is tracked separately. #### Outlook The item to watch for the sectoral gateway is confirmation of the GDPR legal basis the Act itself relies on, together with publication of 936 SE in the Riigi Teataja fixing its date of effect, expected toward the end of 2026 as at the close of this cycle. For the commercial-privacy dimension, progress of 796 SE through the Riigikogu to a confirmed reading stage and adoption date is the near-term marker; until that is confirmed, the dark-pattern prohibitions and human-contact right remain proposed rather than binding. 3 earlier updates not shown here. ###### Standing brief · as of 26 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Estonia's first full GDPR baseline this cycle carries one dominant signal. A challenger-fold review found that a November 2023 Estonian Penal Code amendment reportedly empowered AKI to impose GDPR Article 83-style fines up to EUR 20 million or 4% of global turnover. The same review found that AKI imposed a EUR 3 million fine in September 2025 against Allium UPI OÜ over the Apotheka loyalty-programme breach, which affected more than 7 million records. Commentary describes this as AKI's largest-ever sanction. Both facts currently rest on T4 practitioner sources and await T1/T2 primary-source confirmation. #### Other Developments AKI, based in Tallinn under Director General Pille Lehis, is Estonia's EDPB-member supervisory authority. The Personal Data Protection Act has implemented the GDPR in Estonia since 15 January 2019. Estonia has no general controller registration regime; AKI instead operates a national DPIA-trigger list adopted under GDPR Article 35(4). In a 2022 decision, AKI rejected a ride-hailing controller's reliance on contractual necessity for processing rider-rating data and ordered the processing suspended and the data deleted. AKI separately found the same controller had failed GDPR transparency obligations toward riders. In a 2020 case, AKI held that a third party's self-declared authorisation is not equivalent to voluntary, verifiable consent, and issued a precept with a one-day deadline and a EUR 100,000 penalty threat against three e-pharmacy chains. AKI issued a EUR 5,000 penalty precept against a Facebook-group administrator for disclosing debt data to thousands of unidentified members. AKI issued a EUR 10,000-per-point precept against Krediidiregister OÜ over unlawful disclosure of non-payment data. The EU Digital Omnibus, under EDPB/EDPS consultation since 25 November 2025, proposes amendments to the GDPR, EUDPR and ePrivacy Directive. EDPB and EDPS support raising the Article 30(5) records-of-processing exemption threshold from under-250 to under-750 employees. EDPB and EDPS also support easing the breach-notification risk threshold and deadline. EDPB and EDPS urged rejection of a proposal to narrow the Article 4(1) personal-data definition for pseudonymised data. A leaked Council compromise on 20 February 2026 reportedly already removed that narrower definition from the text. A related Omnibus strand would extend high-risk AI Act obligations, due August 2026, to a cap of December 2027. Estonia's Riigikohus lodged CJEU Case C-222/25 over a dispute between the Financial Intelligence Unit and GDPR/AML processing rules, with AKI as an involved party. The EU-UK adequacy decision, applicable to Estonia as an EEA state, remains valid until 27 December 2031. Estonia's specific national digital-consent age threshold under GDPR Article 8(1) could not be confirmed this cycle. #### Cross-Monitor Connections CJEU Case C-222/25 concerns the Estonian Financial Intelligence Unit's AML data processing and its GDPR interface, and is being routed to the financial-integrity monitor for AML-CFT assessment. The Digital Omnibus's proposed AI Act timeline extension is being routed to the artificial-intelligence monitor for AI-Act-first analysis; this brief retains only the profiling and automated-decision-making transparency angle from AKI's ride-hailing decision. #### Outlook AKI's reported fining-power expansion and its EUR 3 million Apotheka fine require primary-source confirmation before they can be treated as settled. The Digital Omnibus negotiation remains fluid on ROPA thresholds, breach-notification triggers and AI Act timelines even as the personal-data-definition change appears to have been dropped. The pending CJEU ruling in Case C-222/25 adds further uncertainty at the GDPR/AML interface. Read full brief · 985 words ###### Latest update · 25 October 2026 #### Regulatory Status Estonia's data-protection-adjacent landscape moved through two financial-sector instruments rather than through the core data-protection authority's own activity. The financial fraud prevention and combating law, 936 SE, passed by the Riigikogu on or about 21 October 2026, is understood to create a statutory gateway for credit institutions, payment and e-money institutions, and credit providers to exchange fraud-suspicion personal data with each other, the Police and Border Guard Board, and CERT-EE. The Act appears adopted but not yet published in the Riigi Teataja, and the precise GDPR legal basis it relies on for this sharing has not been confirmed from its own text. Separately, a bill transposing the EU's distance-marketing-of-financial-services directive, 796 SE, is understood to be progressing through the Riigikogu; it would prohibit manipulative interface design in distance financial-services contracts and introduce a right to reach a human adviser rather than only a chatbot, though its reading stage and adoption date remain unconfirmed. #### Outlook Confirmation of the GDPR legal basis underlying 936 SE's data-sharing gateway, together with the Act's publication in the Riigi Teataja expected toward the end of 2026, are the near-term markers for the sectoral development. Progress of 796 SE through the Riigikogu to a confirmed reading stage is the corresponding marker for the commercial-privacy development. ###### Standing brief · as of 26 August 2026 #### Regulatory Status AKI, based in Tallinn under Director General Pille Lehis, is Estonia's EDPB-member GDPR supervisory authority, operating under the Personal Data Protection Act in force since 15 January 2019. AKI's enforcement record includes strict scrutiny of lawful-basis and consent claims, credit-and-debt-disclosure precepts, and a formal injunction against a ride-hailing controller's rider-rating data processing. A challenger-fold review surfaced T4 reporting that a November 2023 Penal Code amendment empowered AKI to impose GDPR Article 83-style fines up to EUR 20 million or 4% of turnover, and that AKI imposed a EUR 3 million fine in September 2025 against Allium UPI OÜ, its largest-ever sanction; both facts await primary-source confirmation. Estonia's Riigikohus has lodged CJEU Case C-222/25 over the GDPR/AML data-processing interface, with AKI as an involved party. The renewed EU-UK adequacy decision, applicable to Estonia as an EEA state, remains valid until 27 December 2031. Estonia's specific national digital-consent age threshold under GDPR Article 8(1) could not be confirmed this cycle. #### Outlook Estonia's enforcement posture is escalating pending primary-source confirmation of AKI's expanded fining power, while the EU Digital Omnibus negotiation and the pending CJEU ruling in Case C-222/25 remain the two live threads most likely to reshape this jurisdiction's compliance landscape over the coming year. Read full brief · 443 words Key regulatory facts for Estonia Regulatory Dimension Estonia Standing Position Jurisdiction Estonia (EE) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 60 sourced findings) Regulator & Framework Fully GDPR-aligned EU Member State regime with an operational, EDPB-integrated supervisory authority and a settled national implementing act in force since 2019. Lawful Processing & Special Data Core lawful-basis and special-category rules are GDPR-aligned and actively enforced; only prospective, non-binding EU-level reform (Digital Omnibus) is pending. Data Subject Rights GDPR rights framework in force with clear escalation path to AKI/courts; no Estonia-specific restriction identified. Controller/Processor Duties Core GDPR controller/processor obligations are enforced and operative; only prospective Digital Omnibus amendments to ROPA and breach thresholds remain unresolved. Primary Instruments Cited EDPB, OneTrust DataGuidance, EUR-Lex, EDPB, Estonia Official Instrument (dataprotection.gi estonia) Last Confirmed / Updated 2026-10-25 (44 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Estonia: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Fully GDPR-aligned EU Member State regime with an operational, EDPB-integrated supervisory authority and a settled national implementing act in force since 2019. Primary framework GDPR (Regulation (EU) 2016/679) as implemented by the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus, PDPA, in force 15 January 2019) Supervisory authority [Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI)](http://www.aki.ee/) Traffic-light rationale — Green Fully GDPR-aligned EU Member State regime with an operational, EDPB-integrated supervisory authority and a settled national implementing act in force since 2019. #### Sub-modules (5) #### Regulator And AuthorityGreen AKI (Tatari 39, Tallinn) is the competent EU GDPR supervisory authority for Estonia, currently led by Pille Lehis. Claims (3): - The Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), based at Tatari 39, 10134 Tallinn, is Estonia's EDPB-member supervisory authority, currently headed by Ms Pille Lehis. - Andmekaitse Inspektsioon (AKI) — AKI is Estonia's GDPR supervisory authority, headed by Director General Pille Lehis. - Andmekaitse Inspektsioon (Tatari 39, 10134 Tallinn), headed by Pille Lehis, is Estonia's single EDPB-member supervisory authority under GDPR Art 51. #### Act And InstrumentsGreen The PDPA entered into force 15 January 2019 and implements/supplements the GDPR at national level. Claims (2): - Data protection in Estonia is primarily governed by the GDPR, implemented into Estonian law via the Personal Data Protection Act (PDPA), which entered into force on 15 January 2019. - Isikuandmete kaitse seadus (PDPA) — The Personal Data Protection Act has been in force since 15 January 2019 to implement/derogate GDPR provisions in Estonian national law. #### Material ScopeGreen Material scope follows GDPR Art 2 (processing of personal data wholly or partly by automated means, or manual processing forming part of a filing system), applied directly as EU law in Estonia. #### Territorial ScopeGreen GDPR's extraterritorial scope (Art 3) applies directly: non-EU controllers offering goods/services to, or monitoring the behaviour of, individuals in Estonia fall within scope. Claims (1): - Under GDPR rules applicable in Estonia, non-EU-established businesses must apply the same rules when they offer goods or services, or monitor the behaviour, of individuals in the EU. #### Regulator Registration And FilingGreen No general controller registration/filing regime exists under GDPR or the PDPA; obligations instead run through records of processing (Art 30) and prior consultation for high-risk DPIA outcomes (Art 36). AKI maintains a published Art 35(4) list of processing operations requiring DPIA. Claims (1): - AKI adopted (per EDPB Opinion 6/2018) a national list of processing operations subject to the mandatory DPIA requirement under GDPR Article 35(4), in place of a general controller-registration/filing regime. #### Key findings (1) - AKI/PDPA baseline confirmed, EDPB-integrated, in force since 2019. — source on file Estonia's data-protection regime is anchored in the GDPR, which applies directly as EU law, and the national Personal Data Protection Act (Isikuandmete kaitse seadus, PDPA), which entered into force on 15 January 2019 to implement/derogate GDPR provisions. The supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), headed by Director General Pille Lehis. AKI participates in EDPB one-stop-shop and coordinated enforcement mechanisms alongside the other 26 EU DPAs. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (7) - [EDPB](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en) — The Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), based at Tatari 39, 10134 Tallinn, is Estonia's EDPB-member supervisory authority, currently headed by Ms Pille Lehis. - [OneTrust DataGuidance](https://www.dataguidance.com/notes/estonia-privacy-overview) — Data protection in Estonia is primarily governed by the GDPR, implemented into Estonian law via the Personal Data Protection Act (PDPA), which entered into force on 15 January 2019. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/ET/TXT/?uri=celex:32016R0679) — Under GDPR rules applicable in Estonia, non-EU-established businesses must apply the same rules when they offer goods or services, or monitor the behaviour, of individuals in the EU. - [EDPB](https://www.edpb.europa.eu/our-work-tools/consistency-findings/register-decisions/2019/estonia-sas-list-kind-processing_en) — AKI adopted (per EDPB Opinion 6/2018) a national list of processing operations subject to the mandatory DPIA requirement under GDPR Article 35(4), in place of a general controller-registration/filing regime. - [https://dataprotection.gi/jurisdictions/estonia/](https://dataprotection.gi/jurisdictions/estonia/) — Isikuandmete kaitse seadus (PDPA) — The Personal Data Protection Act has been in force since 15 January 2019 to implement/derogate GDPR provisions in Estonian national law. - [noyb](https://noyb.eu/en/project/dpa/aki-estonia) — Andmekaitse Inspektsioon (AKI) — AKI is Estonia's GDPR supervisory authority, headed by Director General Pille Lehis. - [Andmekaitse Inspektsioon](https://www.aki.ee/en) — Andmekaitse Inspektsioon (Tatari 39, 10134 Tallinn), headed by Pille Lehis, is Estonia's single EDPB-member supervisory authority under GDPR Art 51. ### Estonia: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core lawful-basis and special-category rules are GDPR-aligned and actively enforced; only prospective, non-binding EU-level reform (Digital Omnibus) is pending. Primary framework GDPR Articles 6, 7, 9; Personal Data Protection Act (PDPA) Supervisory authority [Andmekaitse Inspektsioon (AKI)](http://www.aki.ee/) Traffic-light rationale — Green Core lawful-basis and special-category rules are GDPR-aligned and actively enforced; only prospective, non-binding EU-level reform (Digital Omnibus) is pending. D2 · Lawful Processing — Full Module Record 4 sub-modules · 78 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Estonia: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ GDPR rights framework in force with clear escalation path to AKI/courts; no Estonia-specific restriction identified. Primary framework GDPR Articles 12-22; PDPA Supervisory authority [Andmekaitse Inspektsioon (AKI)](http://www.aki.ee/) Traffic-light rationale — Green GDPR rights framework in force with clear escalation path to AKI/courts; no Estonia-specific restriction identified. #### Sub-modules (5) #### Access RightAmber Access requests submitted in English to Estonian controllers may be answered in Estonian, per EDPB cross-border cooperation guidance covering Estonia. Claims (1): - Where an access/rectification/erasure request is submitted in English to an Estonian controller, the controller responds to the applicant in Estonian. #### Rectification And ErasureGreen GDPR Art 16/17 rights apply directly; Estonia's national population/business registers follow the GDPR rectification/erasure regime with sector-specific notification duties. #### Restriction And ObjectionGreen GDPR Art 18/21 rights apply directly with no identified Estonian derogation. #### Data PortabilityGreen GDPR Art 20 portability right applies directly with no identified Estonian derogation. #### Deadlines And Response WindowsGreen If a controller fails to respond within 30 days, or the requester disputes the reply, the requester may lodge a free-of-charge complaint with AKI or an administrative court. Claims (1): - If the requester is not satisfied with a controller's reply, or receives no reply within 30 days of sending the request, the requester has the right to lodge a free complaint with AKI or an administrative court. #### Key findings (1) - Standard GDPR Chapter III rights with 30-day escalation path to AKI/courts. — source on file Estonia applies the GDPR's Chapter III rights directly (access, rectification, erasure, restriction, objection, portability), with the standard one-month (extendable) response window under Art 12(3). AKI's own EDPB-published guidance confirms a 30-day escalation trigger: if a controller fails to respond, or the requester is dissatisfied, the requester may complain to AKI or an administrative court. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (2) - [EDPB](https://www.edpb.europa.eu/system/files_en?file=2026-04%2Fcsc_guide_right_of_access_rectification_and_erasure_20230403_en.pdf) — Where an access/rectification/erasure request is submitted in English to an Estonian controller, the controller responds to the applicant in Estonian. - [EDPB](https://www.edpb.europa.eu/system/files_en?file=2026-04%2Fcsc_guide_right_of_access_rectification_and_erasure_20230403_en.pdf) — If the requester is not satisfied with a controller's reply, or receives no reply within 30 days of sending the request, the requester has the right to lodge a free complaint with AKI or an administrative court. ### Estonia: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core GDPR controller/processor obligations are enforced and operative; only prospective Digital Omnibus amendments to ROPA and breach thresholds remain unresolved. Primary framework GDPR Articles 24-25, 28, 30, 32-34, 35, 37-39; PDPA Supervisory authority [Andmekaitse Inspektsioon (AKI)](http://www.aki.ee/) Traffic-light rationale — Green Core GDPR controller/processor obligations are enforced and operative; only prospective Digital Omnibus amendments to ROPA and breach thresholds remain unresolved. Periodic update · new data 2026-10-11 #### Controller/Processor Duties Estonia's controller and processor duties landscape shows an escalating reported trajectory this cycle, anchored by three distinct but related developments. First, AKI received 251 personal-data breach notifications in 2025, up from 184 the prior year, a figure reported as the highest annual total since May 2018, touching a reported 3,030,325 people. This volume figure is carried at a qualified, probable confidence level: it is a reported statistic from a secondary legal-tracker source rather than a figure independently confirmed against AKI's own published annual statistics. Second, the largest single breach-notification-adjacent enforcement matter remains open. AKI found that Allium UPI OÜ, operator of the Apotheka e-pharmacy service, had failed to implement multi-factor authentication, secure database backups, activity logging and adequate access controls, with the shortfall reported to affect data belonging to over 750,000 customers. A EUR 3,000,000 fine was imposed on 5 September 2025, and the matter is understood to be under appeal, with court hearings reported to have begun 6 April 2026. Because the underlying detail here rests on a lower-tier source, the specific security-control findings are rendered with qualified rather than assertive framing, even though the fine amount and appeal status appear more firmly reported. Third, and most firmly sourced, the European Data Protection Board adopted a final decision under Article 60 of the GDPR, published in October 2026, terminating a supervisory cooperation procedure concerning an Estonian controller's phishing-attack-triggered breach affecting 2,258 customers. This primary EDPB document records that the controller submitted both preliminary and final breach notifications under GDPR Article 33(1), and took remedial steps including changing passwords, informing employees, and contacting CERT-EE and the police. Of the three developments, this is the one resting on a Tier 1 primary source, and it illustrates a comparatively well-handled breach-response sequence against which the Apotheka matter's reported control failures stand in some contrast. Taken together, these three threads describe a controller/processor environment under increasing notification pressure, with AKI handling both a record volume of smaller notifications and continuing to process the appeal of its largest reported fine, while the EDPB's own published decision shows the cooperation mechanism functioning for at least one Estonian breach matter reaching a formal conclusion. #### Outlook The Apotheka appeal's court hearings, reported to have begun 6 April 2026, are the clearest forward marker in this module: their outcome will determine whether the reported EUR 3,000,000 figure, and the specific security-control findings underlying it, are upheld, reduced, or otherwise revised. Separately, whether the reported rise in breach notifications to 251 in 2025 continues, plateaus, or reflects a one-off reporting-discipline effect is not resolved by the material available, and would be a natural point to revisit as AKI's next annual statistics become available. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Estonia's controller and processor accountability framework tightened materially this cycle through a legislative amendment to the Isikuandmete kaitse seadus (IKS) that significantly simplified the process for imposing GDPR-type fines directly on legal persons. The amendment applies to infringements committed on or continuing from 1 November 2023, and its practical significance became concrete in this cycle's largest-ever Estonian GDPR fine (covered in the Enforcement & Redress sub-brief below), which the simplification directly enabled. Prior to this amendment, imposing GDPR-scale sanctions on a legal person in Estonia carried procedural friction that the 2023 change removed. This is a duties-side development in the sense that it does not create a new substantive obligation for controllers or processors, but it materially changes the practical consequence of failing to meet existing accountability and DPIA-adjacent obligations: a legal person that falls short of its accountability duties now faces a more straightforward path to a large fine than it did before 1 November 2023. Controllers and processors operating in Estonia should treat this as a signal that the cost of non-compliance with existing duties has risen, even though the duties themselves are unchanged in substance. No other controller/processor-duties development was surfaced this cycle beyond this fining-mechanism simplification; the accountability and DPIA substance of Estonian law otherwise tracks the GDPR baseline. #### Outlook The practical weight of this 2023 amendment will continue to be tested through the ongoing Allium UPI appeal (hearings beginning 6 April 2026); a court ruling upholding the fine would confirm the amendment has produced a durable and legally robust escalation in accountability enforcement. D4 · Controller & Processor — Full Module Record 7 sub-modules · 71 words · 11 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Estonia: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Transfer mechanisms are the standard EU GDPR toolkit with no identified Estonian derogation; localisation-specific findings are absent and flagged rather than assumed. Primary framework GDPR Articles 44-49; EU Commission adequacy decisions Supervisory authority [Andmekaitse Inspektsioon (AKI)](http://www.aki.ee/) Traffic-light rationale — Green Transfer mechanisms are the standard EU GDPR toolkit with no identified Estonian derogation; localisation-specific findings are absent and flagged rather than assumed. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 71 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Estonia: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Sectoral overlays exist mainly through case law/enforcement rather than distinct statutes; a live CJEU reference on AML/GDPR interplay introduces near-term legal uncertainty for the financial sector overlay. Primary framework GDPR; ePrivacy Directive 2002/58/EC; Estonian AML framework (Rahapesu Andmebüroo) Supervisory authority [Andmekaitse Inspektsioon (AKI)](http://www.aki.ee/) Traffic-light rationale — Amber Sectoral overlays exist mainly through case law/enforcement rather than distinct statutes; a live CJEU reference on AML/GDPR interplay introduces near-term legal uncertainty for the financial sector overlay. Periodic update · new data 2026-10-25 #### Sectoral Watch Estonia's financial fraud prevention and combating law, 936 SE, passed by the Riigikogu on or about 21 October 2026, is understood to create a personal-data-sharing gateway specific to the financial sector. Credit institutions and payment and e-money institutions gain the right to exchange fraud-suspicion data with each other, with the Police and Border Guard Board, and with CERT-EE, Estonia's computer emergency response team. Credit providers and credit intermediaries are understood to receive a parallel right confined to loan fraud. Much of the data exchanged under this gateway, suspicion flags tied to named individuals and transaction patterns, will constitute personal data in the ordinary sense, which places the new mechanism squarely within the scope of data-protection law even though the Act's primary framing is financial-crime prevention rather than privacy regulation. The Act appears to have been adopted by the Riigikogu but has not yet been published in the Riigi Teataja, so it is not yet in effect. This matters for sectoral oversight because the precise GDPR legal basis the Act itself invokes for the new sharing, whether that is legitimate interest, a legal obligation, or some other Article 6 ground, has not been confirmed from the Act's own text. Until that provision is identified, it is not possible to assess with confidence how the sectoral gateway interacts with the general lawful-processing requirements that would otherwise apply to this kind of inter-institutional data exchange, including questions of proportionality, retention, and the rights of the individuals whose suspicion-linked data is shared. This is a genuinely new development for the Estonian financial sector: it did not previously have a comparable statutory channel for sharing fraud-suspicion personal data across institutions and with law enforcement and the computer emergency response team in this coordinated form. #### Outlook The items to track are, first, confirmation of the GDPR legal basis the Act relies on for its data-sharing provisions, and second, publication of 936 SE in the Riigi Teataja, which will fix the date the gateway becomes operative; that publication was expected toward the end of 2026 as at the close of this cycle. Once the legal basis is confirmed, it will become possible to assess whether the sectoral gateway sits comfortably within ordinary lawful-processing principles or whether it represents a distinct carve-out requiring its own safeguards. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 79 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Estonia: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie/ePrivacy rules are GDPR/ePrivacy-aligned and in force; several US-style adtech constructs (dark patterns codified separately, GPC, clean rooms) have no confirmed Estonian equivalent, driving amber/red sub-module ratings and explicit gaps. Primary framework ePrivacy Directive 2002/58/EC; GDPR Supervisory authority [Andmekaitse Inspektsioon (AKI)](http://www.aki.ee/) Traffic-light rationale — Amber Cookie/ePrivacy rules are GDPR/ePrivacy-aligned and in force; several US-style adtech constructs (dark patterns codified separately, GPC, clean rooms) have no confirmed Estonian equivalent, driving amber/red sub-module ratings and explicit gaps. Periodic update · new data 2026-10-25 #### AdTech & Commercial Privacy A bill, 796 SE, is understood to be moving through the Riigikogu to transpose the EU's distance-marketing-of-financial-services directive into Estonian law. As described, the bill would prohibit manipulative online-interface design, the pattern commonly referred to as dark patterns, in distance contracts for financial services, and would introduce a right for a consumer to request redirection to a human adviser rather than being confined to an automated channel such as a chatbot. This is squarely a commercial-privacy and consumer-facing-design measure: it reaches into how financial-services firms structure their digital sales interfaces and automated customer-contact flows when selling or servicing products at a distance, which is precisely the kind of interface-design question that commercial-privacy oversight is concerned with. The current reading stage the bill has reached in the Riigikogu, and its expected date of adoption or commencement, have not been confirmed from a primary dated source as at the close of this cycle. The transposition obligation derives from an EU directive, so the substantive content of the dark-pattern prohibition and the human-contact right is set at EU level even though the precise Estonian implementing timetable remains open. This is a proposed rather than an enacted measure. No enforcement or supervisory activity specific to this bill has been identified, and none should be inferred from its progress through the legislature. #### Outlook The item to track is 796 SE's progress to a confirmed Riigikogu reading stage and adoption date, which will determine when the dark-pattern prohibitions and the human-contact right become binding obligations for firms marketing financial services at a distance to Estonian consumers. Firms using automated or chatbot-based customer interfaces for financial-services marketing in Estonia should treat this as a measure in development rather than a current requirement, pending that confirmation. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 60 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Estonia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Baseline Art 22/ADM and surveillance carve-out rules are settled GDPR/LED law, but the AI Act's implementation timeline and scope are actively being renegotiated via the pending Digital Omnibus on AI. Primary framework GDPR Article 22; EU AI Act (Regulation (EU) 2024/1689); Law Enforcement Directive (EU) 2016/680 Supervisory authority [Andmekaitse Inspektsioon (AKI)](http://www.aki.ee/) Traffic-light rationale — Amber Baseline Art 22/ADM and surveillance carve-out rules are settled GDPR/LED law, but the AI Act's implementation timeline and scope are actively being renegotiated via the pending Digital Omnibus on AI. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Estonia's institutional architecture for AI Act enforcement remains unsettled on its most consequential point: the designation of a market-surveillance authority. The European Commission's own list of designated national market-surveillance authorities, last updated 7 September 2026, shows Estonia's designation of the Tarbijakaitse ja Tehnilise Järelevalve Amet (TTJA) as still pending final adoption. The TTJA is Estonia's consumer-protection and technical-regulatory authority, and its proposed role under the AI Act would be to supervise compliance with the Act's market-surveillance obligations within Estonia, but that role has not yet been finally confirmed as of the date stated. This designation gap sits alongside a separate, earlier development: Estonia's Ministry of Justice and Digital Affairs published guidance, reportedly around 5 August 2026, addressing the AI Act's Article 50 transparency obligations, which cover disclosure requirements for AI-generated content and deepfakes. That guidance cites the EU-level penalty structure of fines up to EUR 15 million or 3% of global annual turnover for non-compliance, but notably does not name any Estonian supervisory authority as responsible for enforcing those obligations. Read together, the two facts describe an enforcement architecture that is substantively specified -- the obligations exist, and the penalty ceiling is known -- but institutionally incomplete, since the body that would exercise enforcement authority under that penalty structure has not been finally designated. This is best understood as a structural governance gap rather than a transient administrative delay, because it affects the practical operability of the entire AI Act enforcement chain in Estonia, not merely one sub-element of it. Any AI system provider or deployer operating in Estonia under the AI Act's scope currently faces obligations whose substance is known but whose enforcement mechanism is not yet institutionally settled. No contrary indication -- such as an interim or provisional enforcement arrangement -- was identified in the sources reviewed this cycle. No biometric-specific or surveillance-specific development distinct from this general AI Act institutional question was identified for Estonia this cycle. The governance gap described here concerns the AI Act's market-surveillance designation generally, and the evidence available does not support narrowing the finding to any particular biometric or surveillance sub-application. #### Outlook The TTJA's final designation as Estonia's AI Act market-surveillance authority is the governance checkpoint to watch going forward; its confirmation would resolve the institutional half of the current gap, though the practical enforcement record (case volume, approach to the Article 50 transparency obligations already described in ministry guidance) would remain to be established separately once that designation is confirmed. Until the designation is finalised, Estonia's AI Act enforcement capacity cannot be assessed on the evidence available. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance The governance signal in this module concerns the institutional architecture for EU AI Act supervision in Estonia, rather than any specific algorithmic or biometric enforcement matter. Estonia has notified the Tarbijakaitse ja Tehnilise Järelevalve Amet, the Consumer Protection and Technical Regulatory Authority known as TTJA, to the European Commission as its intended market-surveillance authority under the EU AI Act. As of the Commission's own published list, dated 7 September 2026, reports suggest that this designation had not yet been finally adopted. This is an uncertain-tier finding: the reported gap concerns the formal completion of a designation process, not any substantive doubt about Estonia's stated intention to designate TTJA. The practical significance of a still-pending designation is institutional rather than substantive. Until the designation is finally adopted, questions about which Estonian body holds operational front-line market-surveillance responsibility for AI systems under the Act — including inspection powers, complaint-handling processes, and coordination with AKI on any data-protection-adjacent AI matters — remain without a fully settled institutional answer. This sits at the edge of this monitor's own remit: the designation itself, and its downstream operational detail, properly belongs to the sectoral AI-regulation tracking function, and is noted here only insofar as it defines the institutional landscape against which any future Estonian AI-system data-protection matter would be supervised. No biometric-specific or algorithmic-profiling enforcement development for Estonia was located this cycle beyond this institutional designation question. The module's signal this cycle is therefore narrow: an institutional-architecture item in formation, not yet settled, with no accompanying substantive enforcement or rule-making development to report alongside it. #### Outlook The designation of TTJA as Estonia's AI Act market-surveillance authority is the item to watch for formal completion in a subsequent reporting period; once adopted, the practical allocation of supervisory responsibility — and any interaction with AKI's own GDPR-based oversight of AI systems that process personal data — would become clearer. Until then, the institutional picture in Estonia for AI-system market surveillance remains pending as scheduled. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 92 words · 8 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Estonia: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ EU baseline (Art 8 GDPR) is confirmed, but the Estonia-specific national age-of-consent figure and minor/vulnerable-group specifics could not be confirmed from available sources in this pass; escalation recommended. Primary framework GDPR Article 8; PDPA (specific national age threshold unconfirmed in this pass) Supervisory authority [Andmekaitse Inspektsioon (AKI)](http://www.aki.ee/) Traffic-light rationale — Amber EU baseline (Art 8 GDPR) is confirmed, but the Estonia-specific national age-of-consent figure and minor/vulnerable-group specifics could not be confirmed from available sources in this pass; escalation recommended. D9 · Children's Privacy — Full Module Record 5 sub-modules · 82 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Estonia: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ AKI has active, EDPB-integrated enforcement powers and a functioning complaint/court escalation path, but its fine mechanism structurally departs from the direct-administrative-fine model used elsewhere in the EU (GDPR Recital 151 carve-out), and the surrounding EU legislative framework (Digital Omnibus) is in active flux. Primary framework GDPR Articles 58, 77-84, Recital 151; PDPA; Substitutive Enforcement and Penalty Payment Act (sunniraha) Supervisory authority [Andmekaitse Inspektsioon (AKI)](http://www.aki.ee/) Traffic-light rationale — Amber AKI has active, EDPB-integrated enforcement powers and a functioning complaint/court escalation path, but its fine mechanism structurally departs from the direct-administrative-fine model used elsewhere in the EU (GDPR Recital 151 carve-out), and the surrounding EU legislative framework (Digital Omnibus) is in active flux. Periodic update · new data 2026-10-11 #### Enforcement & Redress Estonia's enforcement and redress posture this cycle is reported as escalating, built on three reinforcing data points. AKI retains the capacity to impose fines of up to EUR 20 million or 4% of global annual turnover for GDPR violations, following a 2023 Penal Code amendment that raised the ceiling from a prior EUR 400,000 cap; this structural fact frames the scale within which the Apotheka fine, and any future fine, sits. Reports further indicate that AKI opened 46 own-initiative supervisory proceedings in 2025, of which roughly 30% were prompted by a data leak, and handled 50 court cases during the year. This activity-volume figure is carried with an uncertain rather than assertive tone, reflecting its reliance on a single tracker-style secondary source rather than AKI's own published enforcement statistics. The cycle's dominant enforcement-and-redress development remains the Apotheka matter. The EUR 3,000,000 fine imposed on Allium UPI OÜ on 5 September 2025, reported as Estonia's largest to date, is understood to remain under appeal, with court hearings reported to have begun 6 April 2026. Pending the appeal's outcome, this fine should be read as a current but not yet final exercise of AKI's enforcement powers, rather than a settled precedent for how the raised fine ceiling will be applied going forward. Separately, the EDPB's own published Article 60 decision, finalised and published in October 2026, shows the cross-border cooperation and consistency mechanism reaching a formal conclusion on an Estonian breach matter, with the underlying controller's notification and remedial conduct recorded directly in that primary EDPB document. This is the most firmly sourced redress-mechanism development of the cycle and illustrates the EDPB consistency mechanism functioning in practice for at least one Estonian case this reporting period. Read together, these developments describe an enforcement environment where the formal fining ceiling is high, reported own-initiative activity is substantial, and at least one significant fine is actively contested through the courts, while the EU-level cooperation mechanism continues to process and close Estonian matters referred to it. #### Outlook The Apotheka appeal remains the single clearest forward-looking marker for this module: its resolution will show how Estonia's courts treat AKI's exercise of its post-2023 fining powers in a significant security-failure matter. Beyond that, whether AKI's reported 2025 enforcement-activity volume, including the 46 own-initiative proceedings, is sustained, grows, or recedes in the following reporting period is not resolved by the material available, and would be the natural next data point to track. Periodic update · new data 2026-09-28 #### Enforcement & Redress AKI imposed a EUR 3,000,000 fine on Allium UPI OU on 5 September 2025 over the Apotheka loyalty-programme data breach, which affected more than 750,000 people, the largest GDPR fine imposed in Estonia to date. The fine is under appeal, with court hearings beginning 6 April 2026; its outcome remains unresolved as of this cycle. The scale of this penalty was made possible by the 2023 legislative simplification of legal-person fining under the IKS, and it arrives against the backdrop of an earlier, unfavourable precedent for the regulator: the annulment of AKI's Asper Biogene fine, which already introduced uncertainty about how far the regulator's enforcement reach actually extends once tested in court. The statutory ceiling within which this penalty sits is substantial: IKS Sections 66-70 permit fines of up to EUR 20,000,000, or for legal persons up to EUR 20,000,000 or 4 percent of worldwide annual turnover, whichever is greater, classified as an Estonian misdemeanour. The Allium UPI fine, at EUR 3,000,000, represents a fraction of that ceiling, meaning the statutory framework has substantially more room to escalate in a future case of comparable or greater severity, assuming the current fine survives appeal. Separately from AKI's regulatory enforcement track, Estonian law grants any person who has suffered material or non-material damage from a GDPR infringement a direct right to claim compensation. This creates a second redress channel independent of the regulator's own enforcement outcome, meaning affected individuals from the Apotheka breach are not solely dependent on the fate of AKI's appeal to seek a remedy. #### Outlook The 6 April 2026 appeal hearings are the single most consequential near-term event for this module: a ruling in AKI's favour would confirm the durability of its post-2023 enforcement powers, while a ruling against it, following the Asper Biogene annulment, would suggest a pattern of judicial pushback against the regulator's expanded fining practice. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 119 words · 14 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 8 [Children & Vulnerable Groups](#sec-cat-children_and_vulnerable_groups) age verification Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties