Personal data is all data that allows a person to be identified. A person can be identified both directly (for example, through a name or personal identification code) and indirectly (for example, by combining several different pieces of data or characteristics). Certain requirements and principles apply to the processing of personal data. The requirements apply to all natural and legal persons and institutions that process personal data.
The General Data Protection Regulation provides the legal bases and principles of personal data processing, including collection, transfer, and storage. If the personal data is processed by a law enforcement agency in the course of conducting a misdemeanour or criminal procedure, the requirements for the processing of personal data arise from the Personal Data Protection Act.
More information on personal data processing and data processing requirements and documentation can be found in the guideline for personal data processors of the Data Protection Inspectorate. If necessary, the personal data processor must appoint a data protection specialist.
Every person whose data is processed has the right to receive information about it and access the personal data about them. A person also has the right to request data rectification, data erasure, and limitation of processing. They also have the right to submit objections. Additional information on the processing of personal data can be found on [the website of the Data Protection Inspectorate (https://www.aki.ee/et/eraelu-kaitse/isikuandmed-ja-tootlemine) and the official website of the European Union.