How can an individual challenge an Estonian administrative decision affecting data rights?

Short answer

Three current Riigi Teataja instruments form the core procedural map:

• the Personal Data Protection Act (Isikuandmete kaitse seadus), especially §§ 3, 28 and 56–61;
• the Administrative Procedure Act (Haldusmenetluse seadus), especially §§ 57 and 71–87; and
• the Code of Administrative Court Procedure (Halduskohtumenetluse seadustik), especially §§ 37–47 and 249–252.

The route depends on what is being challenged.

1. If a controller's processing infringes the person's data rights, the person may complain to the Data Protection Inspectorate—Andmekaitse Inspektsioon (AKI). This does not by itself mean that a private controller's refusal is an administrative act.
2. If the disputed measure is an administrative act or action, an administrative challenge called a vaie may be available under the Administrative Procedure Act. A special statute can change the forum, make pre-court review mandatory or prescribe a different deadline.
3. A person protecting their own right may bring the appropriate claim in the administrative court. The usual deadline for an annulment claim is 30 days from notification of the act, but other remedies have different limits.

The decision should identify where, when and how it can be challenged. Do not assume, however, that a defective challenge notice stops the clock or invalidates the decision. Nor should a person assume that filing a vaie automatically suspends continuing disclosure or other processing. Suspension or interim judicial protection may need to be requested expressly.

First classify the disputed decision

The procedure cannot be selected from the words “data decision” alone.

This classification should be recorded at the outset. It determines the respondent, requested remedy, deadline, evidence and whether a pre-court step is required.

The data-protection-specific route starts with AKI

Personal Data Protection Act § 3 applies the Administrative Procedure Act to administrative proceedings under the data statute, subject to the data statute's own special rules.

For the law-enforcement-processing regime in Chapter 4, § 28 says a data subject who considers that processing infringes their rights may complain to AKI. Sections 24(4) and 25(7) also require a controller that restricts access or refuses correction, erasure or restriction to tell the data subject about the right to challenge the decision before AKI or a court.

AKI's wider supervisory competence appears in § 56. It supervises compliance with the Personal Data Protection Act, the GDPR and data-processing requirements in other statutes. It may, among other things, require correction, erasure, restriction or termination of processing, impose a temporary or permanent processing restriction, and open supervision following a complaint or on its own initiative.

Under § 61, AKI normally resolves a complaint within 30 days after submission. It may extend that period by up to 60 days where additional facts must be established, but it must notify the complainant in writing. Cooperation with other relevant supervisory authorities may extend the review by the reasonable time needed for that cooperation.

These are decision-making periods for AKI, not a general promise that every data dispute will end within 30 days. Cross-border competence, the processing regime and the nature of the requested measure still matter.

A vaie is a rights-protection procedure within the administration

Administrative Procedure Act § 71 allows a person who considers that an administrative act or the course of administrative proceedings violated their rights or restricted their freedoms to file a vaie.

Under § 72, the person may seek:

• full or partial revocation of an administrative act;
• an instruction to issue an administrative act;
• a new decision; or
• performance of an administrative action.

An intermediate procedural step is usually challenged together with the final administrative act. Delay, inactivity, refusal to recuse an official, return of an application, and another step specified by law can be challenged separately.

This route is not universal. Section 71(2) excludes an act or action of an administrative authority over which the Government exercises official supervision. A special statute may also establish a different review body or procedure. The first check should therefore be the governing special law and the challenge notice in the decision.

File with the correct authority—but a routing error may be curable

The default rule in § 73 is that the vaie is submitted through the authority that issued the act or performed the action to the supervisory authority exercising official supervision over it.

There are two important variations:

• if there is no such supervisory authority, the issuing or acting authority decides the vaie itself; and
• where a minister exercises supervision, the issuing or acting authority normally decides it unless a statute provides otherwise.

If the recipient lacks competence, § 79(2) says it must either return the challenge with an explanation of where to apply or forward it to the competent authority and notify the person. That safeguard is useful, but it is not a reason to ignore the deadline or the decision's routing instructions.

The ordinary vaie deadline is 30 days from knowledge

Section 75 requires a vaie to be filed within 30 days unless another statute provides otherwise. Time runs from the day the person learned, or should have learned, of the challenged act or action.

The record should therefore preserve:

• the decision and its complete challenge notice;
• the date and method of service;
• the date on which the person actually obtained knowledge if service is disputed;
• envelope, delivery, portal or email evidence; and
• any facts explaining a late filing.

Under § 77, restoration of the vaie deadline follows the general restoration rule in § 34. A restoration request should identify the missed procedural step, explain the valid reason for delay and be accompanied by the step that should have been taken.

The decision must contain challenge instructions

Administrative Procedure Act § 57 requires an administrative act to identify the available means of challenge and state the place, deadline and procedure.

The consequences of omission are narrower than many readers expect:

• a missing challenge notice does not itself invalidate the act;
• it does not automatically change the challenge deadline; but
• it may constitute a valid reason for restoration if the omission caused the late filing.

The causal link is important. A person relying on the omission should explain how it caused the missed deadline rather than merely point out that the notice was absent.

A vaie has mandatory content

Under § 76, a vaie may be written or oral. An oral challenge must be recorded by the authority and signed by the submitter.

It must identify:

• the authority to which it is submitted;
• the submitter, postal address and communication details;
• the content of the disputed act or action;
• why it violates the submitter's rights;
• the remedy requested in clear terms;
• confirmation that no final judgment exists and no court proceeding is pending in the matter; and
• the attached documents.

The submitter or representative signs the challenge. A representative supplies proof of authority unless it has already been provided. A digital signature is unnecessary where the challenge is sent through an electronic channel and the authority securely identifies the submitter.

This is more than a complaint narrative. The filing should connect the identified data right, the disputed act or action, the alleged error and the precise remedy.

Defects should be cured before return

If the filing does not satisfy § 76, § 78 requires the authority to help cure the defects or grant ten days to correct them.

Section 79 permits return where, for example, the person lacks the right to file, fails to cure defects, misses an unrestored deadline, or the same matter is already subject to a final judgment or pending court proceeding. Notice of return must be given within seven days after submission, state reasons and explain how to appeal.

Where a compliant vaie must go to a supervisory body, the issuing authority forwards it with the necessary documents within seven days after receipt. The issuing authority may instead grant the challenge itself if it considers it justified.

Filing does not automatically stop the act

Section 81 says the authority deciding the vaie may suspend execution of the administrative act where necessary to protect the public interest, the addressee or a third person's rights.

The word “may” matters. If the disputed act permits continuing publication, transfer, access or another potentially irreversible use of personal data, the person should address suspension explicitly and explain the concrete harm that could occur before the challenge is decided.

The administrative court provides a separate route for urgent protection. Under Code of Administrative Court Procedure § 249, the court may grant interim protection where otherwise protection by the final judgment could become materially more difficult or impossible. A request may be made during the vaie procedure, with the court claim or later. Sections 250–251 require a reasoned request identifying the dispute, supporting facts, respondent and requested measure; the court may suspend the act, prohibit an act or action, require an action or require a continuing action to stop.

Interim relief is not automatic. The court weighs the public interest, affected persons' rights, the claim's prospects and foreseeable consequences.

The authority reviews legality and appropriateness

Under §§ 83–84, the deciding authority examines both the lawfulness and appropriateness of the act, considers documents and other evidence, and hears interested persons where required.

Unless another statute provides otherwise, it decides within ten days after the challenge reaches the reviewing authority. Additional investigation permits an extension of up to 30 days, with notice to the submitter.

Section 85 allows the authority to:

• revoke the act in whole or part and remove its factual consequences;
• direct that an act be issued, an action be performed or the matter be decided again;
• direct reversal of an action; or
• dismiss the challenge.

The decision is written and served on the submitter and any third party. A rejection must be reasoned and explain how to apply to the administrative court.

Judicial review requires the right remedy

Code of Administrative Court Procedure § 37 lists distinct forms of court claim. Depending on the problem, a person may seek:

• annulment of an administrative act;
• an order requiring an act or action;
• prohibition of a proposed act or action;
• compensation;
• removal of unlawful consequences; or
• a declaration of nullity, unlawfulness or another legally significant fact.

The choice affects admissibility and time. Under § 44, an individual generally applies to protect their own right, not merely an abstract public interest. A prohibitory claim requires reason to believe that the proposed act or action will violate the claimant's rights and that later review would not protect them effectively. A declaratory claim is generally available only if no more effective remedy exists.

Court deadlines differ by claim

Section 46 provides the default periods:

• annulment: 30 days from notification of the administrative act;
• an order following a refusal: 30 days from notification of the refusal;
• inactivity or delay: one year after the prescribed decision period expires, or two years after requesting the act or action if no period is prescribed;
• prohibition: no fixed filing period;
• compensation or removal of consequences: three years from knowledge of the harm, responsible person or relevant consequences, subject to the stated ten-year outer limit; and
• declaration of unlawfulness: three years after the act or action, while other declaratory claims may be brought without a fixed period.

A special statute may prescribe different periods. If it mandates a vaie or another pre-court procedure, § 47 permits a court claim only after the person has followed that procedure and only to the extent the claim was not granted on time. The normal period after the pre-court decision is 30 days from notification unless another statute provides otherwise.

The Personal Data Protection Act provisions reviewed here give a right to complain to AKI and to challenge an AKI decision in court. They do not state a universal rule that every data-related administrative claim must first pass through a vaie. Mandatory exhaustion should not be inferred without the applicable special-law provision.

What the court filing must contain

Sections 38–40 require the court claim to identify the claimant, other parties, any representative and the court; state the chosen remedy; describe the act or action and issuing authority; give the factual grounds; and identify the evidence for each material fact.

The filing must also state how and when the claimant learned of the act or action, identify the desired form of proceedings, and list its attachments. A late claim must include a restoration request and reasons for the delay.

Attachments include, where available or applicable:

• the disputed act or a copy;
• evidence of service or knowledge where timing may be in question;
• documents supporting the claim that were not already provided in the underlying proceedings;
• evidence that the state fee was paid or an application for procedural assistance; and
• a power of attorney for a non-lawyer authorised representative.

The claim may be filed on paper or electronically under the referenced electronic-procedure rules. A paper claim may be delivered to any Estonian administrative- or county-court courthouse, which must forward it to the competent court.

A practical filing checklist

Before filing, an individual or adviser should be able to answer:

1. Is the target a private-controller response, an administrative act, an action, a refusal, delay or omission?
2. Which personal-data right is said to have been violated?
3. What special statute governs the decision, and does it alter the forum or deadline?
4. Does the decision contain a complete challenge notice?
5. When was it served, and what evidence proves the knowledge date?
6. Is a vaie available or mandatory, or may the person apply directly to court?
7. Which authority or court is competent?
8. What precise remedy is needed: annulment, performance, prohibition, correction, erasure, restriction, compensation or a declaration?
9. Are the facts connected to specific evidence?
10. Is suspension or interim protection needed to prevent continuing or irreversible data use?
11. Are the signature, representation, fee or legal-aid and attachment requirements satisfied?
12. If a period was missed, is a supported restoration request included immediately?

Authority and coverage limits

This article describes the procedural framework in the three current Estonian consolidations returned by Legalcode on 13 September 2026. The MCP identified the Administrative Procedure Act version effective from 1 January 2024, the Personal Data Protection Act version effective from 16 March 2026, and the Code of Administrative Court Procedure version effective from 12 June 2026 as current on that date.

It does not determine that a particular communication is an administrative act, that a named court has territorial jurisdiction, that a specific vaie is available, or that a deadline has been preserved. Those conclusions require the decision, service evidence, governing special statute and requested remedy. EU-law remedies, civil claims and compensation questions may also coexist with the national routes described here.

MCP and source audit findings

Production research used one accepted Discover, two Searches and three exact Fetches. An initial Discover used the stale key operation instead of the current mode key and was rejected; it is conservatively counted, bringing the turn to the seven-call cap. Every accepted call used the configured production bypass token and charged zero.

The combined Estonian title search returned the three governing current laws, and their exact authenticated Markdown downloads contained the provisions needed for this article. Their source references, effective dates, current-version flags and official Riigi Teataja URLs were mutually consistent.

One source-normalization defect was confirmed. The current Personal Data Protection Act download inserts a literal empty marker () before 20 unnumbered provision bodies, including § 3. The current Code of Administrative Court Procedure does the same four times. Legalcode issue #655 requests a source-wide audit, re-normalization and a regression test that preserves genuine numbered paragraphs while suppressing an empty label.

A keyword search that combined the exact title Haldusmenetluse seadus with the additional words vaie vaidlustamine did not return that Act, while the flat-OR title query did. Because Search explicitly reported AND semantics and the extra inflected term may not match the source analyzer's indexed form, this was treated as a query-design limitation rather than filed as a separate defect. The article relies on exact Search-to-Fetch handoffs and complete authenticated downloads, not on the omitted result.

Conclusion

An individual challenging an Estonian administrative decision affecting data rights must first identify the legal character of the decision and the right being protected. A data-subject complaint to AKI, a vaie within the administration and a claim in the administrative court are related but distinct routes.

The ordinary vaie and annulment periods are both commonly 30 days, but they start under different provisions and can be displaced by special law. A valid filing identifies the act or action, explains the personal-rights violation, requests the correct remedy and preserves service and supporting evidence. Neither a missing challenge notice nor filing a vaie automatically solves the timing or suspension problem. Where data use may continue, a reasoned request for suspension or interim judicial protection can be as important as the merits.

Sources and audit issue

• Personal Data Protection Act — current consolidation reviewed, especially §§ 3, 28 and 56–61
• Administrative Procedure Act — current consolidation reviewed, especially §§ 57 and 71–87
• Code of Administrative Court Procedure — current consolidation reviewed, especially §§ 37–47 and 249–252
• Legalcode issue #655: empty subsection markers in Riigi Teataja Markdown