Which current Estonian provisions govern personal data processing for creditworthiness assessments?

Short answer

Four current Estonian statutes published in Riigi Teataja form the core national framework as at 13 September 2026:

• Personal Data Protection Act (Isikuandmete kaitse seadus), § 10 specifically regulates disclosure and subsequent processing of personal data connected with a breach of a debt relationship for creditworthiness assessment or a similar purpose.
• Law of Obligations Act (Võlaõigusseadus), § 403⁴ requires a consumer lender to obtain sufficient information, consult relevant databases where necessary, assess all material repayment factors and notify the consumer when a refusal is based on database information.
• Creditors and Credit Intermediaries Act (Krediidiandjate ja -vahendajate seadus), §§ 44, 49 and 50 governs the lender's methodology, data sources, verification, internal personal-data procedures and confidentiality.
• Credit Information Sharing Act (Krediiditeabe jagamise seadus), §§ 2 and 6–11 establishes the national credit-information register, defines its data, logging, reporting, access and retention rules, and limits lender access to specified creditworthiness-assessment situations.

These provisions are cumulative rather than alternatives. A lender or credit bureau needs both a lawful basis for processing and compliance with the more specific national conditions governing the relevant data source and use. The Estonian statutes also refer expressly to the EU General Data Protection Regulation. The four-act map below therefore answers which current Riigi Teataja provisions matter; it is not a substitute for the GDPR analysis that remains necessary in an individual processing operation.

Debt-default information: Personal Data Protection Act § 10

Section 10 of the Personal Data Protection Act is the most direct national rule for commercial payment-default information. It permits personal data connected with a breach of a debt relationship to be transferred to a third party, and processed by that recipient, for assessing the data subject's creditworthiness or for a similar purpose only if the controller or processor has:

1. checked the accuracy of the data;
2. checked the legal basis for the transfer; and
3. recorded the transfer.

The permission is subject to express exclusions. The data may not be collected and transferred for that purpose if it concerns special-category data; concerns an offence or victimisation before the specified public adjudication or termination point; would excessively prejudice the data subject's rights or freedoms; concerns a contractual breach less than 30 days old; or concerns a breach that ended more than five years ago.

The five-year provision is a prohibition after the statutory endpoint, not an automatic entitlement to publish every record for five years. The excessive-prejudice condition must still be assessed, and the accuracy and legal-basis checks apply before disclosure.

The assessment duty: Law of Obligations Act § 403⁴

Section 403⁴ of the Law of Obligations Act turns responsible lending into a concrete pre-contract process. Before entering a consumer credit agreement, the creditor must obtain information that makes it possible to assess whether the consumer can repay on the agreed terms and must actually perform that assessment.

The assessment must be conducted with due care and address all known circumstances capable of affecting repayment. The statute expressly points to the consumer's financial position, regular income, other financial obligations, earlier payment performance and the effect of a possible increase in the obligations created by the proposed agreement. The scope of the inquiry must be proportionate to the contract terms, existing information and the size of the proposed obligation.

Section 403⁴(3) allows the creditor to request information from the consumer and to use relevant databases where necessary. That does not make a database result self-proving or sufficient on its own. The consumer must provide correct and complete information, while the creditor must perform the checks required by § 50 of the Creditors and Credit Intermediaries Act.

The creditor may contract only if its analysis of the collected data supports the conclusion that the consumer is creditworthy. The information must be updated and creditworthiness reassessed before an agreed increase in the credit amount or limit.

Two transparency rules are especially relevant to data processing:

• under § 403⁴(10), if a refusal is based on database information, the creditor must promptly and free of charge tell the consumer the result of the database query and identify the database, unless disclosure is legally prohibited or contrary to public-order or security objectives;
• under § 403⁴(11), a refusal of housing-related consumer credit must be communicated promptly and the consumer must also be told if the decision was based on automated processing.

Lender governance and verification: §§ 44, 49 and 50

The Creditors and Credit Intermediaries Act supplies the operational controls behind the assessment.

Internal rules under § 44

Section 44 requires a creditor or intermediary to adopt and apply board-approved internal rules. Those rules must separately address the creditworthiness methodology and information-collection process, the processing of personal data, the handling of databases and data, complaint resolution and internal controls. They must also separate responsibility for creditworthiness assessment from credit decisions, collateral valuation, risk assessment and accounting or reporting functions.

This matters because a general privacy policy alone does not satisfy the credit-specific governance requirement. The organisation must be able to show how data enters the assessment, how it is verified, who may use it and how the resulting decision is controlled.

Assessment methodology under § 49

Section 49 requires a written methodology for assessing creditworthiness and checking submitted data. At minimum it must cover:

• assets and regular income;
• other financial and non-financial obligations;
• previous performance of payment obligations;
• regular household expenditure;
• the possible effect of increases in existing and proposed obligations;
• other known facts material to repayment; and
• the terms and amount of the proposed credit.

Income analysis must address the source and regularity of income over a sufficient period. The creditor or intermediary must make reasonable efforts to check the documents and evidence used to calculate regular income. For housing credit, the assessment cannot rest only on collateral value or an assumption that the property will appreciate, subject to the statutory construction or renovation exception.

Data sources, checks and secrecy under § 50

Section 50 permits information to come from the consumer, relevant internal sources and databases. An intermediary must pass all material pre-contract information to the creditor. The creditor or intermediary must make reasonable efforts to verify information supplied by the consumer using independently available information where possible. If the other information about income and obligations is insufficient, the statute points to verification through a consumer-provided bank-account statement where possible.

Employees and managers processing personal data for these purposes must comply with the Personal Data Protection Act and the organisation's internal rules. Employees, managers, shareholders and members with access to client personal data are subject to an indefinite confidentiality duty, unless another rule provides otherwise.

The national credit-information register: §§ 2 and 6–11

The Credit Information Sharing Act, effective from 30 June 2026, creates a separate statutory data system. Its purpose under § 2 is to make information needed for creditworthiness assessment available, support responsible borrowing and lending, and support financial-sector reliability, market monitoring and supervision.

Section 6 classifies the register as a database in the state information system. The Ministry of Finance is the controller and the appointed register operator is the processor. Detailed data, access and safeguard rules are also to be specified in the register's constitutive regulation.

Section 7 lists the register data. It includes the consumer's name and personal identification code or date of birth; creditor and guarantor identifiers; agreement dates and type; maximum credit, outstanding balance, repayment schedule and interest-rate type; the next repayment; agreed deferrals; a delay fact after 14 days; and assignment or transfer facts. Processing must be logged with its reason, time and responsible person.

Section 8 sets reporting and correction-relevant timing duties. Most covered creditors must report new or changed agreement data within 24 hours. The section also requires timely reporting when a claim is performed, assigned, transferred or otherwise ends. Credit collection entities have separate statutory periods.

Section 10 does not give lenders an unrestricted search entitlement. It requires access for the specified creditors and branches when assessing a consumer who has applied to enter or amend a consumer credit agreement, restructure debt, or obtain additional credit under an existing agreement. Access to the recorded 14-day delay fact is limited until performance and, for those creditors, to no more than 45 days from the delay. Other listed public bodies receive access only for their stated statutory functions.

Section 11 generally requires register data and logs to be retained for two years after the relevant performance, assignment, transfer or other ending is entered in the register. This retention rule concerns the statutory register. It should not be confused with the different five-year outer limit in Personal Data Protection Act § 10 for the separate disclosure of debt-breach data to third parties.

How the provisions fit together

For a practical creditworthiness workflow, the provisions operate in sequence:

1. Define the processing operation and source. Payment-default disclosure, a lender's own assessment and access to the statutory register engage different specific provisions.
2. Establish purpose and legal basis. Personal Data Protection Act § 10 supplies national conditions for debt-breach data, while the statutory register has its own purpose-limited access rules.
3. Collect only assessment-relevant information. Law of Obligations Act § 403⁴ and Creditors and Credit Intermediaries Act § 49 define the repayment factors the creditor must examine.
4. Verify rather than merely aggregate. Sections 49–50 and Personal Data Protection Act § 10 require accuracy or evidence checks. A negative registry entry is an input, not a replacement for the full assessment.
5. Control access, logging and confidentiality. Internal rules, transfer records, register logs and indefinite secrecy duties must be applied at the relevant layer.
6. Respect source-specific time limits. The 30-day and five-year rules for debt-breach disclosure, the 14-day delay trigger and 45-day access window, and the statutory register's two-year retention period address different events and cannot be substituted for one another.
7. Explain data-driven refusals. The database and automated-processing notifications in § 403⁴ apply where their stated conditions are met.

What the indexed provisions do not establish by themselves

The Riigi Teataja provisions do not make every publicly obtainable fact lawful to reuse in a credit score. They also do not establish that a commercial credit bureau may treat all official-register information as payment-default data, or that a creditor may decide solely from one adverse entry. The source, purpose, legal basis, accuracy, relevance, retention event and effect on the individual must be identified separately.

Nor does the national-law map resolve every GDPR issue. A complete assessment may additionally require analysis of transparency, data minimisation, accuracy, storage limitation, objection and automated-decision rules under EU law. Those questions should be answered against the actual processing design, not inferred from the mere existence of an Estonian database-access provision.

Conclusion

The current Estonian framework is layered. Personal Data Protection Act § 10 controls third-party use of debt-breach data for creditworthiness or a similar purpose. Law of Obligations Act § 403⁴ defines the creditor's information-gathering, assessment and notification duties. Creditors and Credit Intermediaries Act §§ 44, 49 and 50 require a documented methodology, verified inputs, internal personal-data controls and confidentiality. Credit Information Sharing Act §§ 2 and 6–11 govern the new statutory register and its purpose, data, reporting, access, logging and retention.

The practical compliance point is straightforward: access to data is not the same as permission to use it without limits, and one registry signal is not the same as a completed creditworthiness assessment.

Sources

• Isikuandmete kaitse seadus, especially § 10
• Võlaõigusseadus, especially § 403⁴
• Krediidiandjate ja -vahendajate seadus, especially §§ 44, 49 and 50
• Krediiditeabe jagamise seadus, especially §§ 2 and 6–11