Every Estonian private limited company (OÜ) that has clients, employees or a website processes personal data, and the General Data Protection Regulation — Regulation (EU) 2016/679, the GDPR — applies to it directly. The regulation asks a company not only to follow its rules but to be able to show that it does. This article sets out the documents that showing rests on, what each must contain under the article of the regulation, and what we prepare.
The article is general information, not legal advice. Which documents a company needs depends on what data it processes, why and with whom; in Estonia the Data Protection Inspectorate supervises.
The principle: be able to show it
The controller is responsible for compliance with the principles of processing and must be able to demonstrate it — the accountability principle of Article 5(2) of the GDPR. In practice that means written records: what is processed, on what basis, for how long and who receives it.
The documents and what the regulation asks of each
- Record of processing activities. Each controller maintains a record of the processing under its responsibility: among other things its name and contact details, the purposes of the processing, the categories of data subjects and of personal data, the recipients, transfers outside the EU and, where possible, the time limits for erasure (Article 30(1)). A company employing fewer than 250 persons is exempt only if its processing is occasional, is unlikely to result in a risk to the rights and freedoms of data subjects and does not include special categories of data or data on criminal convictions (Article 30(5)) — processing of clients' or employees' data is usually not occasional, so most companies keep the record.
- Privacy notice. When data are collected from the person, the company tells them at that time who it is and how to contact it, why and on what legal basis the data are processed, who receives them, how long they are kept and what rights the person has (Article 13).
- Data processing agreements. When a service provider — an accountant, a hosting or e-mail provider, a CRM — processes personal data on the company's behalf, the processing is governed by a contract that sets out its subject-matter, duration, nature and purpose, the types of data and the obligations of both parties, among them that the processor acts only on documented instructions (Article 28(3)).
- Requests of data subjects. A person may ask for access to their data, its correction or erasure and the other rights of Articles 15 to 22; the company answers without undue delay and in any event within one month, a period it may extend by two further months for complex or numerous requests, telling the person within the first month (Article 12(3)). An internal rule says who receives and answers such requests.
- Personal data breaches. A breach is notified to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people (Article 33(1)); a processor tells the controller without undue delay (Article 33(2)). Every breach is documented — the facts, its effects and the action taken (Article 33(5)). An internal rule sets out these steps before anything happens.
A data protection officer?
A company must designate a data protection officer only where its core activities consist of regular and systematic monitoring of people on a large scale, or of processing special categories of data or data on criminal convictions on a large scale, or where it is a public authority (Article 37(1)). Most small companies are outside these cases; the documents above apply to them in full.
What we prepare
The service GDPR compliance documentation for an Estonian company, from from €1,800, prepares from the company's description of its processing:
- the record of processing activities;
- the privacy notice for the website or the clients;
- templates of the data processing agreement;
- internal rules for data subject requests and personal data breaches.
The starting price is for one company with ordinary processing; more work is agreed in writing before it starts. Not included: legal advice or a legal opinion, acting as the data protection officer and representation before the Data Protection Inspectorate. The company applies the documents; the inspectorate supervises.
Prices exclude VAT. All communication takes place by email.
Ready to start? The record of processing, privacy notice, processor agreement templates and internal rules; not legal advice. Order.
To see which of our services your company needs, open the Business Navigator.