Vastus selgitustaotlusele

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST

Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee

Registrikood 70004235

Lauri Ojala

Columbia University

[email protected]

Yours: 12.11.2025 Ours: 26.11.2025 nr 2.2-9/25/3722-2

Vastus selgitustaotlusele Estonian Data Protection Inspectorate (DPI) has received your questions about data processing in

research and the possible role of Estonian DPI in it.

Estonian DPI explain that for the (re)processing of the personal data You must follow, among other

acts, the rules of the General Regulation on the Protection of Personal Data (GDPR) and Estonia’s

Personal Data Protection Act (IKS).

In the case of research conducted for the purpose of policy-making, the role of the Data Protection

Inspectorate is stipulated in the Personal Data Protection Act (IKS). According to IKS § 6, the

approval of the Estonian DPI is required if the research processes special types of personal data

and there is no sectoral ethics committee (IKS § 6 (4)) or if it is a research or analysis of the

executive branch of state power that is carried out for the purpose of policy-making (IKS § 6 (5)).

Research conducted with ordinary personal data does not require the approval of the Data

Protection Inspectorate. Research where personal data is not processed at all does not require the

approval of the Data Protection Inspectorate either.

Please note that You should submit an appropriate application to the correct ethics committee,

preferably in Estonia, University of Tartu or in NIH, as research assume processing Estonians

personal data. The Ethics Committee in Estonia has the advantage of knowing local legislation

profoundly.

Altogheter, according to the Estonian law DPI here takes applications only in cases

mentioned in IKS § 6, including cases when there are no ethics committee. As far as we know,

there are available ethic committees in Estonia, so we don’t see the need to come to Estonian

DPI relying on information offered by you. You should submit an appropriate application to

the ethics committee, preferably to committee in Estonia (see additional information about

committee in University of Tartu or in some cases NIH).

Regarding the language requirement, general rule is that all applications sent to Estonian

institutions should be in Estonian. However, you can find out from each Estonian ethics committee

which language they prefer for applications.

More information about the processing of personal data in research can be found here:

2 (2)

Isikuandmed uuringutes | Andmekaitse Inspektsioon (aki.ee).

I hope this information is helpful for you. Respectfully

Liina Kroonberg

lawyer

authorized by Director General