Short answer
The Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) does not treat five years as an automatic retention period for every payment default.
AKI's says payment-default information may be disclosed for no longer than five years after the debt is paid or the obligation becomes time-barred. The current states the legal prohibition as more than five years having passed since the breach of the obligation ended.
The precise permissible period within that outer boundary depends on a case-specific assessment. AKI expressly identifies:
- the amount of the debt;
- how many other debts the person has;
- circumstances characterising the debtor;
- circumstances characterising the creditor;
- whether the information is accurate, current and relevant;
- whether its content and presentation give a clear, non-misleading account;
- whether continued disclosure remains necessary for the creditworthiness purpose; and
- whether the impact on the person's rights and freedoms has become excessive.
The register must be able to justify continued publication throughout the period. “Five years have not elapsed” is necessary, but it is not sufficient by itself.
Publication, processing and storage are not interchangeable
AKI's FAQ discusses avaldamine—making payment-default information available through a payment-default register for creditworthiness assessment. Section 10 governs collection, transfer to a third party and subsequent processing for that or a similar purpose.
This is narrower than saying that every copy of the information must be destroyed for every legal purpose on the same day. A creditor may have separate accounting, litigation or regulatory retention duties. But a separate duty to preserve a source document does not automatically justify continuing to expose the person as a payment defaulter to third-party users.
For a credit bureau, the relevant question is therefore not only “May we still store evidence?” It is also “May we continue to make this adverse entry available for creditworthiness decisions, in this form, at this time?”
The five-year rule is an outer limit
Section 10(2)(5) prohibits the relevant processing once more than five years have passed since the breach of the obligation ended. AKI's FAQ expresses the practical endpoint as no more than five years after payment or expiry of the obligation.
That maximum should be understood alongside four points.
It runs from the end of the breach, not simply the first missed payment
The legally relevant event is when the breach ended. Identifying that event may require evidence of payment, settlement, termination, limitation or another way in which the relevant breach ceased.
The date should not be generated merely by adding five years to the date an entry was created in a commercial database.
A shorter period may be required
AKI says the exact publication period depends on the amount, other debts and circumstances of the debtor and creditor. The legitimate-interest and excessive-harm tests continue to apply before the outer limit expires.
An entry can therefore become unjustified earlier if it no longer gives relevant creditworthiness information, is misleading, or causes an excessive interference with the person's rights.
Payment does not make history irrelevant automatically
The FAQ contemplates some continued publication after payment. A settled default may still say something about earlier payment behaviour. But settlement changes the facts and starts the period AKI describes; the entry must show the status accurately and be reassessed rather than displayed indefinitely as an active debt.
Limitation periods are a separate legal question
AKI notes that limitation periods arise under the General Part of the Civil Code Act. It refers to a usual three-year period for a contractual claim and possible ten-year periods, including for certain claims recognised by an enforceable judgment or another enforcement instrument.
The claim's limitation period and the payment-default publication period are not the same clock. The underlying claim, the end of the breach and the continued necessity of publication must be identified separately.
Factor 1: the amount of the debt
AKI expressly lists the debt amount. The amount can affect how strongly the information supports the register's asserted creditworthiness purpose and how severe continued adverse publication is relative to that purpose.
This is not a published AKI tariff under which a fixed euro amount always receives a fixed number of years. The controller must explain the significance of the amount in the particular context rather than place every default into one undifferentiated retention bucket.
The figure must also be accurate. Principal, interest and ancillary claims should not be confused, and a paid or reduced balance should not remain displayed as though unchanged.
Factor 2: the number of other debts
AKI also identifies how many other debts the person has. Multiple genuinely separate defaults may carry different creditworthiness significance from one isolated breach.
But the number must not be manufactured by presentation. AKI's 10 July 2026 opinion on warns that several entries arising from one continuing contractual relationship can create a misleading impression that the person defaulted under several different relationships.
If consecutive unpaid instalments form one uninterrupted default, AKI says it may be reasonable to display one continuing entry whose amount changes as instalments fall due. If an earlier default ended or was paid and a later default then arose under the same agreement, separate entries may be justified.
The register must therefore establish whether the count represents separate breaches, separate periods, or merely multiple instalments under one continuing default.
Factor 3: circumstances characterising the debtor
The FAQ requires consideration of circumstances characterising the debtor. AKI does not turn that phrase into an exhaustive checklist on the page.
Its wider explanation makes the direction clear: the assessment must consider the person's rights and interests, not only the economic usefulness of the data to lenders. The Tallinn Circuit Court authority cited by AKI says excessive harm must be considered more broadly than creditworthiness and responsible lending because privacy interests are also weighty.
Relevant circumstances must still be lawfully obtained, necessary and related to the balancing exercise. The phrase is not permission to collect sensitive or unrelated personal history.
Factor 4: circumstances characterising the creditor
AKI separately names circumstances characterising the creditor. That prevents the analysis from treating the claimant as an invisible constant.
The controller should be able to identify who supplied the data, the relationship from which the claim arose, the creditor's role and the evidence supporting the reported status. The legitimacy and weight of the asserted interest may depend on who seeks publication and for what purpose.
The FAQ also says the creditor must check that a legitimate-interest basis exists and balance its interests against the debtor's rights. The register has its own responsibility for the processing it performs; it cannot replace its analysis with the creditor's instruction alone.
Factor 5: accuracy, currentness and relevance
AKI defines excessive harm primarily through whether the published default gives correct and relevant information about the person and whether publication interferes with their rights and interests.
Failure to verify debt data can itself cause excessive harm. The current §10 also requires the controller or processor to check both the accuracy of the information being transferred and the legal basis for the transfer, and to record the disclosure.
Accuracy is time-sensitive. A historically correct active-debt entry becomes inaccurate if payment, settlement, reduction, dispute or another status change is not reflected.
Factor 6: the content must be limited to what matters
AKI says excessive harm may arise from the content of the disclosed information. Data that are plainly irrelevant to the contractual breach—such as a photograph or subjective character judgments—must not be added to the payment-default record.
This is both a minimisation and relevance issue. A longer narrative does not become more lawful merely because some underlying debt fact is true.
Factor 7: presentation must not extend the practical retention period
AKI's July 2026 instalment opinion adds an important operational factor. Payment-default data must not only be factually correct; their presentation must provide a correct, clear and non-misleading overview.
If a terminated agreement made all unpaid instalments due at once, displaying the total as one debt may be justified. Dividing that amount into several entries may be excessive if it suggests several independent relationships or enables the data to remain visible longer than permitted or necessary.
This means a credit bureau cannot reset or stagger deletion dates artificially by splitting one continuing obligation into multiple technical records. Each entry's start and end events must reflect the underlying legal and factual relationship.
Factor 8: continued necessity for the stated purpose
Private payment-default registers generally rely on legitimate interests under Article 6(1)(f) of the , according to AKI. The FAQ describes a three-stage analysis:
- identify the controller's or third party's legitimate interest and its weight;
- identify the data subject's rights and interests and their weight; and
- balance them, including any safeguards, to reach a final assessment.
The July opinion adds the GDPR principles of fairness and transparency, purpose limitation, data minimisation, accuracy and storage limitation. Data must not be kept available longer than necessary to achieve the defined purpose.
A generic claim that payment-default registers help lenders is not enough. The controller must be able to connect continued display of this entry to the purpose after considering its age, status, content and effect.
Factor 9: excessive harm can end publication early
Section 10 independently prohibits processing that excessively harms the data subject's rights or freedoms. AKI's FAQ says a person may object at any time and explain why publication is wrong or excessively harmful.
The register must answer within one month and perform a new legitimate-interest assessment explaining why publication remains lawful and not excessively harmful. That fresh assessment is especially important where the debt has been paid, the context has changed, the entry is disputed, or its presentation overstates the person's defaults.
If the register cannot justify the continuing interference, the fact that the five-year maximum has not expired does not save the publication.
Other statutory boundaries that affect the period
The current §10 also prohibits the relevant collection and transfer where:
- the information is special-category personal data;
- it concerns commission of, or victimisation by, an offence before the specified public hearing, decision or termination event;
- processing would excessively harm the person's rights or freedoms; or
- fewer than 30 days have passed since the contractual breach.
The 30-day rule is a minimum delay before this form of processing, not evidence that publication becomes automatically lawful on day 31. Accuracy, legal basis, necessity and balancing must still be established.
Transparency affects the fairness of the period
AKI's 29 June 2026 opinion on says the person must receive clear, accessible information about the processing.
Before negative credit information is published, the person should be able to understand:
- which particular debt is involved;
- the legal basis and purpose;
- which register will receive the data;
- the conditions for publication; and
- when publication may occur.
A precise calendar date or running count of overdue days is not always mandatory, but the available information must let an average person foresee the timing and conditions. The purpose is to make the processing real and contestable, not merely formal.
Although this opinion addresses the start of publication, the same transparency logic matters for retention. A person should be able to understand the event from which the register calculated continued display and how to exercise correction, objection or deletion rights.
A defensible retention decision record
The guidance supports recording at least:
- the underlying agreement and creditor;
- the principal, ancillary amounts and current balance;
- the date and nature of each breach;
- whether breaches were continuous, separate, paid, settled, terminated or time-barred;
- the event treated as ending the breach, with evidence;
- other genuine payment defaults and how they were matched;
- the purpose and necessity of continued publication;
- the debtor's and creditor's relevant circumstances;
- accuracy, relevance, minimisation and presentation checks;
- the effect on the person's rights and freedoms;
- safeguards and the result of the legitimate-interest balance; and
- the next review or deletion date, never later than the statutory outer boundary for this purpose.
A single global “five years” configuration without those inputs cannot demonstrate the case-specific assessment AKI describes.
Authority and currentness
The Personal Data Protection Act is binding legislation. AKI's FAQ is official supervisory guidance explaining how the authority understands and administers the rules. The two 2026 letters are explanatory opinions; each expressly says it is not a binding legal assessment of the requester's individual situation outside a supervisory proceeding.
The payment-default FAQ was last updated on 4 January 2024. The transparency opinion is dated 29 June 2026, and the instalment-display opinion is dated 10 July 2026. All were retrieved and reviewed through the production Legalcode MCP on 13 September 2026.
No new source or MCP defect was found in this review. The central FAQ's source-native update date, the two PDF dates and the current statutory version were represented consistently.
Conclusion
AKI treats five years after the breach ends as the outside boundary for payment-default disclosure for creditworthiness purposes, not the default answer in every case. The actual lawful period depends on the amount and number of genuine debts, circumstances of debtor and creditor, accuracy and relevance, the clarity of presentation, continued necessity, and the effect on the person's rights and freedoms.
Payment, settlement, limitation, termination, a successful objection or a change that makes the entry misleading may alter the analysis before five years elapse. A credit bureau must therefore use evidence-based start and end events, avoid artificial splitting, review continued necessity and be able to explain why each entry remains available.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.