Vastus selgitustaotlusele

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST Lauri Ojala Yours: 12.11.2025 Columbia University [email protected] Ours: 26.11.2025 nr 2.2-9/25/3722-2 Vastus selgitustaotlusele Estonian Data Protection Inspectorate (DPI) has received your questions about data processing in research and the possible role of Estonian DPI in it. Estonian DPI explain that for the (re)processing of the personal data You must follow, among other acts, the rules of the General Regulation on the Protection of Personal Data (GDPR) and Estonia’s Personal Data Protection Act (IKS). In the case of research conducted for the purpose of policy-making, the role of the Data Protection Inspectorate is stipulated in the Personal Data Protection Act (IKS). According to IKS § 6, the approval of the Estonian DPI is required if the research processes special types of personal data and there is no sectoral ethics committee (IKS § 6 (4)) or if it is a research or analysis of the executive branch of state power that is carried out for the purpose of policy-making (IKS § 6 (5)). Research conducted with ordinary personal data does not require the approval of the Data Protection Inspectorate. Research where personal data is not processed at all does not require the approval of the Data Protection Inspectorate either. Please note that You should submit an appropriate application to the correct ethics committee, preferably in Estonia, University of Tartu or in NIH, as research assume processing Estonians personal data. The Ethics Committee in Estonia has the advantage of knowing local legislation profoundly. Altogheter, according to the Estonian law DPI here takes applications only in cases mentioned in IKS § 6, including cases when there are no ethics committee. As far as we know, there are available ethic committees in Estonia, so we don’t see the need to come to Estonian DPI relying on information offered by you. You should submit an appropriate application to the ethics committee, preferably to committee in Estonia (see additional information about committee in University of Tartu or in some cases NIH). Regarding the language requirement, general rule is that all applications sent to Estonian institutions should be in Estonian. However, you can find out from each Estonian ethics committee which language they prefer for applications. More information about the processing of personal data in research can be found here: Tatari tn 39 / 10134 Tallinn / 627 4135 / [email protected] / www.aki.ee Registrikood 70004235 Isikuandmed uuringutes | Andmekaitse Inspektsioon (aki.ee). I hope this information is helpful for you. Respectfully Liina Kroonberg lawyer authorized by Director General 2 (2)