Personal data is all data that enables a person to be identified. There are firm requirements and principles for the use of personal data.
The General Data Protection Regulation (GDPR) sets out detailed requirements for companies on collecting, storing and managing personal data. It applies both to European organisations that process personal data of individuals in the EU, and to organisations outside the EU that target people living in the EU.
The requirements for the processing of personal data apply to all organisations and self-employed persons with at least one client or employee.
Any individual whose data is being processed has the right to be informed about it and to have access to personal data relating to them. Any individual also has the right to demand the correction and deletion of their data, the restriction of the processing and the transfer thereof from one enterprise to another.
The processing of personal data shall be subject to security measures and, where appropriate, to the appointment of a data protection officer.
More information about personal data in employment relationships is available on the website of the Estonian Data Protection Inspectorate.
More detailed information about special categories and when data processing allowed can be found on the Your Europe Business portal.