Short answer
The core rules governing commercial payment-default disclosure and a lender's creditworthiness assessment were already in force on 1 January 2020, and their central wording has proved unusually stable.
- Section 10 of the Personal Data Protection Act (Isikuandmete kaitse seadus, IKS) was textually identical on 1 January 2020 and 14 September 2026.
- Section 403⁴ of the Law of Obligations Act (Võlaõigusseadus, VÕS) was also textually identical on those two dates.
- Sections 49 and 50 of the Creditors and Credit Intermediaries Act (Krediidiandjate ja -vahendajate seadus, KAVS) retained the same substantive assessment factors, information sources, verification requirements and confidentiality rule.
- KAVS §44 gained additional governance requirements in 2024, including procedures for monitoring and changing credit agreements, debt-restructuring measures, management suitability and internal whistleblowing.
- The major structural difference is the , effective from 30 June 2026. It introduced a statutory framework for a national credit-information register, including defined data fields, reporting deadlines, purpose-limited access, logging and retention. No equivalent statute was in force on 1 January 2020.
The comparison therefore does not support the claim that Estonia rewrote the basic five-year payment-default rule or the responsible-lending assessment between the two dates. The important change is the addition of a regulated national information-sharing layer and later lender-governance duties around problem credit.
Which versions were actually compared?
A temporal comparison must use the consolidation in force on each date, not the publication date nearest to it and not today's text applied retrospectively.
Legalcode's exact in_force_on_date lookup returned one version for each of the three established law families on 1 January 2020:
In MCP metadata, validUntil is the exclusive boundary at which the next version begins. Thus a value of 17 January 2020 for the VÕS version means that the historical text remained applicable through 16 January.
The research-date comparison uses the following consolidations current on 14 September 2026:
- , effective from 16 March 2026;
- , effective from 1 September 2026;
- , effective from 30 June 2026; and
- , effective from 30 June 2026.
Those are whole-act version dates. The amendment marker beneath an individual provision remains the better evidence of when that provision's wording entered into force.
IKS §10 did not change
On both dates, IKS §10 permitted personal data connected with breach of a debt relationship to be transferred to a third party, and processed by the recipient, for assessing the data subject's creditworthiness or a similar purpose only where the controller or processor had:
- checked the accuracy of the information;
- checked the legal basis for its transfer; and
- recorded the transfer.
The same five exclusions also appeared on both dates. Collection and transfer for this purpose were prohibited where the information:
- was special-category data under GDPR Article 9(1);
- concerned commission of or victimisation by an offence before the specified public hearing, decision or termination point;
- would excessively prejudice the data subject's rights or freedoms;
- concerned a contractual breach less than 30 days old; or
- concerned a breach that had ended more than five years earlier.
The complete §10 extracts from the authenticated historical and current Legalcode downloads were the same length and produced the same SHA-256 digest. The wider IKS was amended between 2020 and 2026, but the fact that the act version changed does not mean that this particular payment-default provision changed.
This continuity matters for legal characterisation. The five-year endpoint was already present in the new IKS on 1 January 2020. It is not a rule created by the later credit-information-register legislation. Nor does the unchanged text turn five years into an automatic publication entitlement: the excessive-prejudice prohibition and accuracy and legal-basis checks applied at both dates.
VÕS §403⁴ did not change
The responsible-lending provision was also already fully developed on 1 January 2020. On both dates, VÕS §403⁴ required a consumer lender before contracting to:
- obtain information permitting an assessment of whether the consumer could repay on the agreed terms;
- assess creditworthiness with due care;
- consider financial position, regular income, other obligations, earlier payment performance and the possible increase in the proposed burden;
- request information and use relevant databases where necessary;
- tell the consumer what information and evidence were required;
- lend only where the combined analysis supported creditworthiness;
- reassess before increasing the credit amount or ceiling;
- notify the consumer where refusal was based on database information; and
- notify a housing-credit applicant where refusal was based on automated processing.
The authenticated 2020 and 2026 §403⁴ sections—including all 13 subsections and the amendment marker—were byte-for-byte identical after line-ending normalization. Both attribute the provision to RT I, 11.03.2016, 1, effective from 21 March 2016.
Accordingly, the research-date version must not be described as having newly introduced database use, automated-refusal notice or the lender's burden of proving compliance. Those elements were already part of the applicable text in 2020.
KAVS §§49–50 kept the same assessment and verification core
The 2020 KAVS already required a written methodology addressing assets and regular income, other financial and non-financial obligations, previous payment performance, household expenditure, possible increases in the credit burden, other known material facts, and the terms and amount of the proposed agreement.
It also already required ratio and term policies, analysis of resilience to interest-rate changes, a sufficiently representative income period, reasonable verification of income evidence and the rule that housing-credit assessment could not rest solely on collateral value or assumed appreciation.
Section 50 already allowed information to come from the consumer, relevant internal sources and databases. It required reasonable efforts to verify consumer-supplied information through independently available information where possible and referred to a consumer-provided bank statement where other income and obligation information was insufficient. Its personal-data compliance and indefinite confidentiality duties were also present.
The current §§49–50 retain that substantive wording. The arrival of a statutory credit-information register therefore adds a new regulated source and access framework; it does not replace the lender's pre-existing obligation to consider the whole financial picture and verify inputs.
KAVS §44 acquired additional governance controls
The 2020 KAVS §44 already required board-approved internal rules covering:
- creditworthiness methodology and information collection;
- personal-data processing;
- databases and data handling;
- complaints and internal control; and
- functional separation between assessment, credit decisions, collateral valuation, risk assessment and accounting or reporting.
Those credit-data controls remain. The current section is broader because amendments effective in 2024 added, among other matters:
- procedures for monitoring performance of credit agreements and changing them, including applicable debt-restructuring measures;
- a procedure for assessing management suitability;
- an internal infringement-reporting procedure and whistleblowing channel; and
- more detailed policies for debts overdue by up to and beyond 90 days and for decisions to begin court or enforcement action.
These additions strengthen governance after a loan has become problematic. They do not alter the central IKS rule governing third-party payment-default disclosure or the minimum creditworthiness factors in KAVS §49.
The 2026 register framework is the material structural change
The Credit Information Sharing Act was not in force on 1 January 2020. By the research date, it supplied a dedicated statutory architecture for credit information.
Its current text provides, among other things:
- a state-information-system credit-information register for making information available for creditworthiness assessment;
- the Ministry of Finance as controller and an appointed register operator as processor;
- specified consumer, creditor, guarantor, agreement, credit amount, balance, schedule, interest-rate, deferral, delay and transfer data;
- processing logs recording purpose, time and responsible person;
- a general 24-hour reporting rule for new or changed agreement data for the principal covered providers, with separate periods for credit servicers;
- recording of a delay after 14 days;
- lender access for defined creditworthiness-assessment situations rather than unrestricted searching;
- a maximum 45-day lender-access period for the recorded delay fact, ending earlier if the obligation is performed; and
- general two-year retention after performance, assignment, transfer or other ending is recorded.
These periods address different operations from IKS §10. The register's 14-day delay field and limited access, its 45-day access window for that field, and its two-year statutory retention period do not displace the separate 30-day minimum and five-year outer boundary for third-party processing of debt-breach data under IKS §10.
The statute establishes the legal framework. This version comparison alone does not prove when every technical register service became operational, which entities had completed onboarding, or whether any particular commercial bureau became the statutory operator. Those are implementation facts requiring separate evidence.
What changed in practical compliance terms?
For a lender or credit bureau, the comparison can be summarized as follows:
The main operational shift is thus from a framework centred on private/default-data disclosure plus lender assessment to that same framework plus a purpose-built statutory register regime.
MCP and source audit findings
The production audit used the configured bypass token. It consumed the seven-call cap: one rejected stale-parameter Discover attempt, one successful law-source Discover, one point-in-time title Search, one rejected stale-parameter Fetch attempt, one exact current IKS Fetch, one rejected multi-value-filter attempt and one successful exact-key point-in-time Search. Every accepted call charged zero. The three historical full-text downloads and the current IKS download returned by MCP were authenticated and reviewed; current VÕS and KAVS exact-source evidence had already been authenticated for earlier questions in this Estonia series.
Exact-key temporal selection worked correctly. The successful query returned precisely one historical version for each of the three requested law families, with coherent effective dates, exclusive validUntil boundaries and versionRole: historical.
Two search defects were recorded:
- A source-language query using the exact title “Isikuandmete kaitse seadus” and the 2020 in-force filter omitted that act from the first ten results while ranking partial-title convention statutes and unrelated regulations. Exact-key lookup proved the record was present. requests repair of exact-title relevance under point-in-time search.
- The successful
lawKey in [...]query emittedlaw_identifier_ambiguousbecause it intentionally returned three requested families. It joined the three keys into one supposed identifier and advised pagination even thoughhasMorewas false. requests that intentional multi-family filters be distinguished from genuinely ambiguous scalar identifiers.
The schema rejections were clear and did not return misleading evidence: current Discover uses mode, Fetch uses q, and an in filter requires values. They were counted conservatively against the per-turn cap but do not warrant issues.
Conclusion
Between 1 January 2020 and 14 September 2026, Estonia did not materially rewrite the core national rules for sharing payment-default information or assessing consumer creditworthiness. IKS §10 and VÕS §403⁴ were textually unchanged, while KAVS §§49–50 retained their assessment and verification core. KAVS §44 later added broader governance requirements for monitoring, restructuring, management suitability and internal reporting.
The decisive change was institutional: the Credit Information Sharing Act added a dedicated statutory register framework from 30 June 2026. That framework sits alongside, rather than replaces, the older duties concerning accuracy, legal basis, proportionality, holistic assessment and verification.
Sources and audit issues
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.