Short answer
The Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) says that a person may ask the responsible controller to correct or complete personal data that are inaccurate and may affect their life. For payment-default information, AKI's practical route is to contact the payment-default register and, where useful, the creditor; identify the disputed entry precisely; explain what is wrong or incomplete; and provide supporting material.
AKI's adds a related right to object to publication at any time. The register must respond within one month and conduct a new legitimate-interest assessment explaining why continued publication is lawful and not excessively prejudicial. If there is no timely or satisfactory response, the person may complain to AKI and should attach the earlier correspondence, a screenshot of the register entry and an explanation of the debt and the alleged harm.
Correction is not the same as deletion. AKI's expressly says that correcting data does not automatically erase the original data. A person seeking both outcomes should make the requests separately, even if they are submitted together.
Accuracy covers facts and presentation
AKI treats payment-default accuracy as more than checking whether a debt once existed. Its FAQ says excessive prejudice may arise where the published entry does not give correct and relevant information. Failure to verify the accuracy of debt data can itself excessively prejudice the data subject.
AKI's 10 July 2026 opinion on makes the point more concrete. Published data must be factually correct, up to date and presented in a clear, non-misleading way. Multiple entries arising from one continuous contractual relationship may create an inaccurate impression that the person defaulted under several separate relationships.
The opinion does not impose a universal one-entry rule. AKI says that the correct presentation depends on the facts:
- consecutive unpaid instalments forming one uninterrupted default may reasonably be displayed as one continuing default whose amount changes over time;
- separate defaults at different periods, including a later default after an earlier one ended or was paid, may justify separate entries; and
- if termination made all unpaid instalments due at once, displaying the total as one debt may be justified, while dividing it into several entries may be excessive or misleading.
Whichever method is used, the register must be able to explain why it is necessary, proportionate, fair and accurate. It must also make clear when entries relate to the same contractual relationship.
What to put in a correction request
AKI recommends making the request in writing so there is a record. Its correction guidance says the request should contain:
- the applicant's name and contact details, with a personal identification code where needed to distinguish people with the same name;
- a precise description of which data are inaccurate or incomplete;
- the correction or addition requested, including the relevant time or period; and
- available evidence supporting the correction.
For a payment-default entry, useful evidence will depend on the dispute. It may include the contract, invoices, payment confirmations, a settlement, correspondence with the creditor, a judgment or enforcement document, and screenshots showing exactly how the register presents the entry. Where the problem is misleading presentation rather than a wrong amount or date, the request should explain the impression the display creates—for example, why several entries actually arise from one continuing agreement.
The controller may require proof of identity, such as a digitally signed request or an identity document. That is a verification step; it does not relieve the controller of addressing the substance of the request.
Who should receive the request?
AKI's correction guidance directs the request to the controller responsible for the inaccurate personal data. In a payment-default context, responsibility may involve more than one actor:
- the creditor supplies or continues to supply the debt information; and
- the register publishes and structures the information for its users.
AKI's payment-default FAQ therefore says a person may approach both the register and the creditor. A practical request should be sent to each actor whose processing or source data may need correction, without assuming that one actor's reply automatically resolves the other's responsibility.
If corrected data were disclosed to other recipients, AKI's correction guidance says the controller must generally communicate the correct data to those recipients, unless doing so would require disproportionate effort. The person may also ask who received the inaccurate data.
The response deadline
AKI says the controller should act as soon as possible and no later than one month after receiving the request. For a complex or extensive request, the deadline may be extended by up to two further months. The controller may ask for clarification where necessary.
A refusal must also be communicated within one month. It must be reasoned, including why the controller considers the data accurate and complete. Correction should be free of charge. AKI notes the narrow exception for a manifestly unfounded or excessive request: the controller may charge a reasonable administrative fee or refuse to act, but bears the burden of proving that exception.
These points reflect the response framework in , while the right to rectification is stated in Article 16.
Correction, objection and deletion are different remedies
The appropriate request depends on what is wrong:
AKI's 2026 opinion warns about the last distinction. In an explanatory response, AKI can assess compliance with personal-data rules, but it does not decide the underlying amount, origin or enforceability of a private debt. Those civil-law issues may require a court or another competent procedure. A bare assertion that “the debt is disputed” does not determine whether the register's data are accurate; the controller must examine the evidence and the way the dispute is represented.
What happens after an objection?
Under AKI's payment-default FAQ, a person may object at any time and explain why publication is incorrect or excessively prejudicial. The register must then perform a new balancing assessment under the legitimate-interest basis used for publication. It should explain why publication remains necessary and why the person's rights and interests do not override the asserted interest.
This is not satisfied by a generic statement that payment-default registers help lenders assess creditworthiness. The assessment must consider the particular debt, debtor, creditor, age and relevance of the information, as well as the content and presentation of the entry.
When and how to complain to AKI
If the register or creditor does not answer within the applicable period, refuses without an adequate explanation or leaves the problem unresolved, AKI says the person may complain to the Inspectorate or seek judicial protection.
For a payment-default complaint, AKI asks for a signed submission so it can verify identity. The complaint should include:
- correspondence with the register and/or creditor;
- a screenshot of the relevant register display;
- an explanation of the debt and why the information is inaccurate, misleading or excessively prejudicial; and
- the evidence already supplied in support of correction.
Starting with the controllers matters. It gives them an opportunity to investigate and creates the evidential record AKI expects to see.
Authority and currentness
AKI's web guidance explains how Estonia's supervisory authority interprets and administers data-protection requirements. It is valuable regulatory guidance, but it is not legislation and does not have the binding force of a court judgment. The underlying binding rules include the GDPR and Estonia's Personal Data Protection Act.
The payment-default FAQ used here was last updated on 4 January 2024; the general correction page was last updated on 30 May 2025; and the instalment-display opinion is dated 10 July 2026. This article was reviewed on 13 September 2026. The 2026 document is an explanatory opinion, not a binding determination of a specific person's dispute.
Conclusion
AKI's guidance gives a person a document-driven route: identify the precise payment-default data or presentation that is wrong, ask the responsible controller in writing to correct it, attach supporting evidence and approach both the register and creditor where their roles overlap. The controller normally has one month to respond and must justify any refusal.
If continued publication is also challenged, the person should make an objection that triggers a fresh case-specific legitimate-interest assessment. If erasure is sought, it should be requested separately. When the controllers do not resolve the matter, the complaint to AKI should include the prior correspondence, screenshot and supporting documents.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.