The General Data Protection Regulation (GDPR) became applicable on 25 May 2018. It is directly applicable throughout the EU, including Estonia.
It applies to businesses processing information about individuals and protects the right to personal data protection recognised in the EU Charter of Fundamental Rights.
Member States must address national details and establish applicable sanctions. The regulation was adopted on 27 April 2016 and allowed more than two years for preparation.
At the time of this original 2018 article, Estonia was still using its 2016 Personal Data Protection Act, which had not been designed around the GDPR. A new bill was at its second reading in Parliament, with adoption and commencement dates uncertain.
The article therefore raised uncertainty about enforcement: although the GDPR applied, the existing national framework did not then give the Data Protection Inspectorate the necessary fining powers. This describes the historical legislative position discussed in 2018.