Geili Keppi - AKI
Teema: RE: Kind request for information
From: Geili Keppi - AKI
Sent: Wednesday, December 10, 2025 5:24 PM
To: 'Direcția relații externe' <
[email protected]>
Subject: RE: Kind request for information
Dear Zoia,
Thank you for your request and patience, the response has taken longer than usual.
I will answer the questions in the order which they were submitted:
1. Retention of log files
Estonia does not have a universally regulated period for retaining log files. The duration of the
retention of logs depends on the law or statute governing the specific information system, the
applicable security requirements, as well as the General Data Protection Regulation (GDPR). If
important circumstances concerning a database are not regulated by law, then the management of
the database must be regulated by statute.
The general principle is that logs must be kept for as long as necessary to detect, investigate and
ensure the rights of the data subjects, but not longer than required for that purpose. The retention
period must be justified by the need to detect and investigate security incidents.
In its guidelines on databases (available only in estonian: andmekogude_juhend.pdf), the Data
Protection Inspectorate (DPI) lists important aspects that should be regulated by statute if not
already covered by law. Among other things, the statute must include an exhaustive list of data
collected in the database, data sources, recipients of data from the database and the conditions for
obtaining data, logging of operations performed with database data (in particular, insertion,
modification, deletion, viewing, transmission) and retention periods for logs.
For example, § 8 of the Population Register Act, which regulates the Estonian Population Register,
states that data entered in the Register are preserved permanently, except data on access to data
which are preserved for five years.
Reference to the web-link to this Act (English version): Population Register Act–Riigi Teataja.
2. Access to criminal case files
In Estonia, the DPI does not have a general right to access criminal case files independently. The
Prosecutor’s Office and the courts supervise criminal proceedings.
Section 16 of the Code of Criminal Procedure provides that the proceedings authorities are the court,
the Prosecutor’s Office and the relevant investigative authority. Sections 214 and following strictly
regulate the disclosure of criminal files and access rights: files are accessible to the parties to the
proceedings, the Prosecutor Office and the court. The DPI is not among the authorities referred to in
1
the Code of Criminal Procedure and The DPI has no right to interfere with the activities of the court in
the administration of justice.
Reference to the web-link to this Act (English version): Code of Criminal Procedure–Riigi Teataja
3. Video-surveillance inspections
If a video-surveillance system operator claims that a camera did not function or refuses to cooperate,
the DPI has the right and competence to carry out an on-site inspection to verify the presence and
functioning of the devices.To this end, we can involve technical experts, if necessary.
However, due to the inspectorate’s high workload, resources and activities must be carefully
planned. The need for on-site inspections is decided case by case, depending on the circumstances.
In the case of cameras, the complexity of supervision must be considered, as it is always possible to
change a camera’s field of view or remove it before on-site inspection.
I hope that you will find this answer helpful. If you have any further questions, do not hesitate to
contact again.
Best wishes,
Geili Keppi
Lawyer
[email protected]
627 4141
FOR DATA PRIVACY AND FREEDOM OF INFORMATION
Tatari 39 | 10134 Tallinn | Estonia
LinkedIn | YouTube
Republica Moldova
2