How quickly must a company hand over my data in Estonia?
Within one month — and silence is not an answer. A request about your personal data must be answered without undue delay and no later than one month after it is received. The controller may extend the period by two months where necessary — but must tell you within one month. A refusal must also be communicated within one month, and it must be reasoned. You also have the right to demand deletion of your data where you no longer want it processed and the controller has no justified basis for using or keeping it — or where the processing was unlawful. Complaints go to the Data Protection Inspectorate or the court.
📋 The rules
- Answer within one month
- Extension: up to 2 months
- The extension must be notified
- A refusal must be reasoned
- Complaint: the Inspectorate or court
🔓 Exceptions
- Deletion can be demanded where the controller has no justified basis to keep the data
- It can also be demanded where the processing was unlawful
- A refusal must mention the right to complain to the Inspectorate or the court
⚠️ Penalties & fines
A month is a deadline, not a suggestion. Where a company fails to answer within one month, does not notify an extension, or refuses without reasons, that is a breach, and you can complain to the Data Protection Inspectorate. Write the request clearly: say what you want — a copy of your data, deletion, restriction of processing or portability — and record the date, because the clock starts when the request is received. And remember two things: a refusal must be reasoned and must mention your right to complain; and deletion is not absolute — the controller may have a lawful basis to keep data, for instance under accounting rules.
📎 Official sources
- Data Protection Inspectorate · Your rights →
- AKI · Deleting personal data →
- Riigi Teataja · Personal Data Protection Act →
❓ Frequently asked
How quickly must they answer?
Without undue delay and no later than one month from receiving the request. Where necessary the controller may extend by two months, but must notify you within the first month.
Must a refusal be communicated?
It must, within one month. The refusal has to be reasoned and must include information about your right to lodge a complaint with the Data Protection Inspectorate or the court.
Can I have my data deleted?
You can demand deletion where you no longer want the processing and the controller has no justified basis to use or keep the data, or where the processing was unlawful from the start.
Is deletion an absolute right?
It is not. A controller may have a lawful basis to retain data, for example under accounting or other statutory requirements. In that case the refusal must be reasoned.
Where do I complain?
To the Data Protection Inspectorate or the court. It is worth complaining where no answer arrives within a month, no extension is notified, or the refusal is unreasoned.
🔎 Common searches
What people search to land here:
- “access to personal data one month estonia”
- “data subject rights estonia”
- “request deletion of personal data estonia”
- “data protection inspectorate complaint estonia”
- “must a company give me my data estonia”
- “gdpr request estonia”