Estonia Recording Laws: Consent, Penal Code & GDPR (2026)

In Estonia, a participant in a conversation may record it without notifying other parties because Penal Code §156 targets third-party interception, not participant recording. Any recording that captures personal data must also satisfy a GDPR lawful basis under the Personal Data Protection Act 2018.

Overview of Recording Laws in Estonia

Estonia is one of the most digitally advanced nations in the world. Its e-Residency program, universal digital identity system, and paperless government services have earned it the nickname "e-Estonia." This digital-first culture extends directly to how the country approaches privacy, data protection, and recording laws.

Jurisdictional scope: This article covers the law of recording private conversations, telephone calls, in-person discussions, and video surveillance under Estonian national law and applicable EU regulations. It addresses the Constitution of the Republic of Estonia, the Penal Code (Karistusseadustik), the Personal Data Protection Act (Isikuandmete kaitse seadus), the Electronic Communications Act, the Security Authorities Act (governing covert state surveillance), and the EU General Data Protection Regulation (GDPR). It does not address the recording laws of other EU member states.

Understanding these laws is essential for residents, visitors, e-residents, and businesses operating in Estonia, as violations can lead to criminal penalties, administrative fines, and civil liability. The framework is best understood as two distinct but overlapping layers: a criminal law layer (Penal Code) that primarily targets third-party interception, and a data-protection layer (GDPR and PDPA) that governs all recordings of personal data regardless of how they were made.

Constitutional Protections for Communications Privacy

The foundation of Estonia's recording laws begins with the Constitution of the Republic of Estonia, adopted in 1992 and amended most recently in 2015.

Section 43: Secrecy of Communications

Section 43 of the Estonian Constitution provides that everyone has the right to confidentiality of messages sent or received by post, telegraph, telephone, or other commonly used means. This protection applies broadly to all forms of communication, whether traditional mail or modern digital channels.

The constitutional text reads: "Everyone has the right to the confidentiality of messages transmitted to him or by him by post, telegraph, telephone or other commonly used means. Exceptions may be made by a court order, in cases and pursuant to the procedure provided by law, for the purpose of combating a criminal offence or ascertaining the truth in a criminal procedure."

This means law enforcement cannot intercept or record communications without a judicial warrant.

Section 26: Protection of Private Life

The Estonian Supreme Court has ruled that private conversations not conducted through public communication services (such as face-to-face discussions) are protected under Section 26 of the Constitution, which guarantees the right to private and family life. This distinction matters: telephone and electronic messages fall under Section 43, while in-person conversations are protected under Section 26.

Section 44: Access to Information

Section 44 provides that everyone has the right to freely obtain information disseminated for public use. This provision, read alongside Sections 26 and 43, helps define the boundary between private communications that are protected and public information that can be freely accessed and recorded. Section 44 is the constitutional basis courts have relied on when recognizing the right to record police officers and public officials acting in their official capacity in public spaces.

Can You Record Conversations in Estonia?

Estonia does not have a single statute that explicitly states whether one-party or all-party consent is required for recording private conversations. The legal framework operates through two distinct layers that must be analyzed separately.

Layer 1: Criminal Law (Penal Code §156)

Penal Code §156 criminalizes the violation of confidentiality of messages communicated by correspondence or other means of communication. The provision targets people who are not parties to the communication: it reaches the person who intercepts, accesses, or discloses a message to which they had no legitimate access.

A participant in a conversation already has full access to the content of that conversation. Recording it does not constitute an "interception" or a "violation of confidentiality" in the §156 sense. Under Estonian criminal law, participant recording is not a criminal offense.

This creates a de facto one-party consent outcome at the criminal law level: one party to a conversation may record it without notifying the other parties, and that act alone does not violate the Penal Code.

Layer 2: Data Protection Law (GDPR and PDPA)

A recording of a conversation is personal data processing under the GDPR whenever it captures a person's voice, image, or other identifying information. The General Data Protection Regulation (EU) 2016/679 applies in Estonia as directly effective EU law. The Personal Data Protection Act 2018 implements the GDPR at the national level.

Under GDPR Article 6(1), any recording must rest on one of the following lawful bases:

• Consent of the data subject (Article 6(1)(a)): freely given, specific, informed, and unambiguous
• Legitimate interests of the controller (Article 6(1)(f)): provided those interests are not overridden by the data subject's fundamental rights
• Performance of a contract (Article 6(1)(b)): where recording is necessary to fulfill contractual obligations
• Legal obligation (Article 6(1)(c)): where recording is required by law

Recording a conversation purely out of curiosity, to later embarrass the other party, or for speculative future use would not satisfy any of these bases. The most common lawful basis for private citizen recording is legitimate interest, specifically the protection of one's legal rights (for example, documenting threats, contractual disputes, or workplace harassment). That basis requires a genuine interest, a necessity assessment, and a balancing against the other party's privacy rights.

Conversations You Do Not Participate In

Recording or intercepting a conversation between other people without their knowledge or consent violates Penal Code §156 and is a criminal offense. The constitutional protections under Sections 26 and 43 reinforce this prohibition. Such recordings are also obtained without any GDPR lawful basis and constitute unlawful data processing.

Phone Recording Laws in Estonia

Phone calls in Estonia are classified as communications transmitted by "commonly used means" and receive full protection under Constitution §43.

Personal Phone Calls

When you are a party to a phone call, you may record it for legitimate purposes such as keeping a personal record or protecting your legal rights. The other party does not need to be informed under criminal law. GDPR data processing requirements apply, however. If you intend to share, publish, or use the recording in a way that affects the other person, you must have a lawful basis and should document it.

Business and Commercial Calls

Businesses that record phone calls (customer service centers, financial institutions, healthcare providers) must comply with stricter requirements under GDPR and the PDPA. Obligations include:

• Providing clear notice that the call is being recorded before the recording begins
• Stating the purpose and legal basis for the recording (typically legal obligation for regulated sectors, or legitimate interest for others)
• Retaining the recording only as long as necessary for the stated purpose
• Ensuring appropriate technical security measures protect the recordings

The Electronic Communications Act further regulates how telecommunications providers handle data and cooperate with surveillance authorities. Telecom providers must grant surveillance agencies access to communications networks when authorized by court order under the Code of Criminal Procedure.

Criminal Penalties Under the Penal Code

The Estonian Penal Code (Karistusseadustik) contains several provisions relevant to unauthorized recording and surveillance.

Section 156: Violation of Confidentiality of Messages

This is the primary criminal provision addressing unauthorized interception or access to private communications.

§156(1): Violation of the confidentiality of a message communicated by correspondence or other means of communication is punishable by a pecuniary punishment (fine).

§156(2): The same offense committed by a person who gained access to the message due to their professional duties is punishable by a pecuniary punishment or imprisonment of up to one year.

The enhanced penalty in §156(2) reaches professionals whose job gives them legitimate access to communications infrastructure: postal workers, telecommunications employees, IT administrators, and similar roles. A person in such a role who uses that access to read, record, or disclose private messages faces potential imprisonment.

Sections 157 and 157-1: Violation of Privacy of Personal Data

The current consolidation of the Penal Code restructures the data privacy offenses across §157, §157-1, and §157-2:

§157: Illegal disclosure of personal data obtained in the course of professional activities by a person required by law not to disclose it.

§157-1: Illegal disclosure of sensitive personal data (health information, political opinions, biometric data) or data relating to criminal offenses, if committed for personal gain or if it causes significant damage, is punishable by a pecuniary punishment or imprisonment of up to one year.

§157-2: Illegal use of another person's identity is punishable by imprisonment of up to three years.

Section 137: Unauthorized Surveillance Activities

Carrying out surveillance activities without proper authorization constitutes a criminal offense. Only designated law enforcement and security agencies may conduct surveillance, and only with judicial authorization for specific criminal offenses listed in the Code of Criminal Procedure (Chapter 31).

2023 Penalty Ceiling Amendment

On November 1, 2023, Estonia amended the Penal Code to allow larger administrative penalties under the Personal Data Protection Act. The PDPA's maximum administrative fine was raised from EUR 400,000 to EUR 20,000,000 or up to 4% of total global annual turnover, whichever is higher, fully aligning with GDPR Article 83 maximums. This change significantly increased the AKI's enforcement leverage.

GDPR and the Personal Data Protection Act

As an EU member state, Estonia fully implements the General Data Protection Regulation. The Personal Data Protection Act (PDPA) 2018, in force since January 15, 2019, provides the national framework for GDPR implementation.

Lawful Bases for Recording

Any recording that captures personal data constitutes data processing under the GDPR. The recorder must rely on one of the Article 6(1) lawful bases. For most private citizen recording, the applicable bases are:

• Legitimate interests (Article 6(1)(f)): Documenting a legal dispute, recording for personal protection, or keeping records of business interactions where no contractual or consent basis is available. The recorder must conduct a balancing test.
• Legal obligation (Article 6(1)(c)): Financial institutions, healthcare providers, and other regulated entities may have statutory obligations to record certain transactions or communications.
• Consent (Article 6(1)(a)): Fully valid where genuinely freely given, but cannot be used where there is a power imbalance (such as employer-employee context).

Audio and Visual Recording in Public Places

PDPA §11 addresses recording in public spaces directly. The statutory text reads: "Upon making in public places of audio or visual recordings intended for future disclosure, the consent of data subjects shall be substituted by an obligation to notify the data subjects thereof in a manner which allows the persons to understand the fact of the recording of the audio or visual images and to give the persons an opportunity to prevent the recording of their person if they so wish."

The notification obligation does not apply to public events where recording for disclosure may be reasonably presumed. Recording at a public rally, concert, sports match, or official public ceremony generally does not require individual notification.

Data Protection Inspectorate (AKI)

The Andmekaitse Inspektsioon (AKI) serves as Estonia's national supervisory authority under GDPR Article 51. The AKI holds authority to:

• Investigate complaints about unlawful recording and data processing
• Issue binding orders to stop processing activities
• Impose administrative fines of up to EUR 20 million or 4% of global annual turnover
• Conduct audits and inspections

Notable AKI enforcement actions:

The Apotheka case illustrates that systematic security neglect (no multi-factor authentication, unsecured database backups, absent activity logging) carries severe financial consequences. While that case involved a data breach rather than recording specifically, the AKI's willingness to impose EUR 3 million demonstrates that enforcement is active and significant.

Video Surveillance and CCTV Laws

Estonia has specific rules governing video surveillance in residential and commercial settings.

Private Property

Individuals may install security cameras on their own property. Cameras must not capture public areas, neighboring properties, or spaces where others have a reasonable expectation of privacy beyond the owner's premises. The AKI requires property owners to:

• Post visible notification signs indicating cameras are operating
• Document the purpose and legal basis for surveillance in a data protection conditions document
• Limit retention periods to what is strictly necessary for the stated purpose
• Provide evidence of compliance to the AKI when requested

Workplace CCTV and the Audio Surveillance Prohibition

The AKI's 2021 fuel station precept established a firm position on workplace audio recording: combined audio and video surveillance of employees is presumptively unjustified. The AKI stated that "audio surveillance could only be justified by very exceptional circumstances" and that video-only surveillance is typically sufficient to achieve legitimate workplace monitoring purposes.

Employers seeking to implement any audio recording of employees must demonstrate an exceptional circumstance that cannot be achieved through less intrusive means. Employee consent is not a valid legal basis for workplace surveillance because of the inherent power imbalance in employment relationships.

Workplace Recording Laws

Estonia's approach to workplace recording reflects both EU-wide GDPR principles and the AKI's firm national guidance.

Employee Recording of Conversations

Employees may record workplace conversations they participate in, particularly when the recording serves to protect their legal rights, such as documenting harassment, unsafe conditions, wage theft, or contractual disputes. This falls within the legitimate interests basis under GDPR Article 6(1)(f). Disseminating workplace recordings beyond what is necessary for legal protection could, however, constitute a PDPA violation.

Employer Monitoring of Employees

Employers relying on legitimate interest or legal obligation to monitor employees must:

• Provide clear, written notice to employees about any monitoring before it begins
• Specify the purpose and scope of monitoring in advance
• Conduct a data protection impact assessment (DPIA) for high-risk monitoring systems
• Prefer video-only surveillance over audio; audio requires exceptional justification
• Avoid monitoring private communications unless absolutely necessary and proportionate

During the rise of remote work, the AKI noted particular concerns about AI-powered monitoring tools that fail to distinguish between personal and work-related activity. Screen-tracking, keystroke logging, email scanning, and GPS tracking are all subject to the same proportionality requirements.

Law Enforcement Surveillance

Estonian law provides a structured framework for lawful surveillance by government agencies.

Judicial Authorization

All surveillance activities involving the interception of communications require prior authorization from a designated county court judge. The Code of Criminal Procedure (Chapter 31) specifies that surveillance judges are specially designated: up to three in Harju County Court, two in other county courts. These judges are separate from the trial judge to protect independence.

Surveillance may only be authorized for specific criminal offenses listed in the Code. Each authorization must specify the scope, duration, and permitted methods of surveillance.

The Prokuratuuri Ruling

Estonia's surveillance framework was significantly shaped by the Court of Justice of the European Union (CJEU) ruling in the Prokuratuuri case (C-746/18). The CJEU found that Estonia's previous system, which allowed prosecutors to independently authorize access to telecommunications metadata, violated EU law because it lacked sufficient judicial independence. Following that ruling, prosecutors cannot independently request communications data from telecom companies in criminal investigations without proper judicial oversight.

This landmark ruling reinforced the requirement for independent judicial authorization before accessing any communications data, including metadata.

Security Services

The Estonian Internal Security Service (KAPO) conducts counterintelligence and national security surveillance under separate legal authority. KAPO's surveillance activities are subject to oversight by the Riigikogu (Parliament) Security Authorities Surveillance Select Committee.

Surveillance Act and Covert Surveillance

The Surveillance Act (Jälitustegevuse seadus) governs the authorized use of covert surveillance methods by law enforcement and security agencies in Estonia. The act underwent significant reforms in 2008 and has been integrated with the Code of Criminal Procedure framework for judicial oversight.

Scope of Authorized Surveillance

Covert surveillance methods under Estonian law include: surveillance of communications, physical surveillance, undercover operations, and technical surveillance measures. All of these methods require prior judicial authorization except in cases of urgent necessity where subsequent judicial approval must be sought promptly.

The act limits covert surveillance to investigation of serious criminal offenses specifically listed in the Code of Criminal Procedure. Surveillance for general intelligence gathering without a specific criminal nexus falls under the Security Authorities Act, which governs KAPO and the Foreign Intelligence Service (Välisluureamet).

Citizens and Covert Surveillance

Private individuals are prohibited from conducting covert surveillance. Only agencies with statutory authority may use covert surveillance methods. A private person who installs listening devices in someone else's premises, intercepts communications without authorization, or conducts any form of unauthorized covert monitoring commits a criminal offense under Penal Code §137 (unauthorized surveillance activities).

Recording Police Officers

Under Estonian law, recording police officers and other public officials performing their duties in public spaces is constitutionally protected and not subject to any specific restriction.

In March 2025, the Tallinn Administrative Court ruled that individuals have the right to photograph, record audio, and film Police and Border Guard Board (PPA) buildings from publicly accessible areas not under PPA control. The court found that existing Estonian legislation, including the National Defence Act, Police and Border Guard Act, Public Information Act, and Law Enforcement Act, does not establish any legal basis for prohibiting such recording or photography from public streets and surrounding areas.

The constitutional basis for this right combines Section 44 (right to freely obtain information disseminated for public use) and the freedom of expression provisions of the Constitution. Public officials performing public duties in public spaces do not carry the same privacy expectations as private individuals.

Police retain authority under the Law Enforcement Act to question individuals about their recording activities to assess potential threats and determine purpose. That questioning authority does not constitute a prohibition on recording. A person recording police from a public street is not required to stop recording or provide their recording to police upon request absent a specific court order.

Voyeurism and Intimate Recording

The Estonian Penal Code addresses intimate and private recording through several interconnected provisions.

Penal Code Provisions on Privacy and Intimate Surveillance

The privacy-offense provisions in the Penal Code (§§ 156-157-3) cover the full range of unauthorized recording and surveillance of private persons. The harassment and stalking provision (§157-3, "harassing pursuit") addresses persistent surveillance and monitoring of an individual without their consent.

Recording a person in a private space without their consent (for example, concealing a camera in a bathroom, changing room, or bedroom) would violate both the constitutional right to private life under §26 and the Penal Code provisions on unauthorized surveillance. The PDPA treats such recordings as unlawful processing of sensitive personal data.

EU Directive on Violence Against Women

The EU Directive on combating violence against women and domestic violence (2024/1385), which Estonia is required to implement, requires member states to criminalize the non-consensual sharing of intimate images and the use of information and communications technology to stalk or harass. Estonia's existing Penal Code provisions partially address these requirements. Full national implementation work was ongoing as of May 2026.

Estonia's Digital Governance and Privacy

Estonia's unique position as a digital society creates both opportunities and challenges for recording and privacy law.

The X-Road and Data Transparency

Estonia's X-Road data exchange platform connects government databases and enables seamless digital services. Every access to personal data through X-Road is logged and traceable. Citizens can log into the eesti.ee portal and see exactly who has accessed their data, when, and for what purpose.

If a government official accesses a citizen's data without a legitimate reason, the citizen can file a complaint with the AKI. This transparency has no direct equivalent in most other countries and reflects Estonia's commitment to giving individuals control over their personal information. In practical terms, X-Road means that government recording or data access cannot easily be hidden from the subject.

e-Residency and Digital Identity

Estonia's e-Residency program allows non-residents to obtain a government-issued digital identity for accessing Estonian e-services and running EU-based businesses. E-residents are subject to the same data protection laws as physical residents, including all recording and surveillance regulations. E-residents conducting business through Estonian entities must comply with Estonian and GDPR data protection standards for any recordings made in connection with that business.

The digital identity system uses strong two-factor authentication with PIN codes, and all digital signatures carry the same legal weight as handwritten signatures. Digital communications in Estonia benefit from robust identity verification, which has implications for the evidentiary weight of recordings in legal proceedings.

Recording in Public Spaces

Recording in public spaces in Estonia is generally permitted, subject to the notification requirements in PDPA §11.

Street Photography and Public Events

Photography and video recording in public places are permitted. For recordings intended for disclosure (publication, broadcast, or sharing online), the recorder must either obtain consent or provide notification that allows people to understand they are being recorded and gives them the opportunity to object. At public events (demonstrations, concerts, sports matches, public ceremonies), the notification obligation does not apply because recording for disclosure is reasonably presumed.

Journalism

Journalists in Estonia enjoy protections for newsgathering activities. Freedom of the press is protected under the Constitution, and journalistic processing of personal data benefits from specific exemptions under GDPR Article 85 and the Estonian PDPA. These exemptions require that the processing is necessary to reconcile the right to privacy with the freedom of expression and information, and that it is proportionate and necessary for journalistic purposes.

Using Recordings as Evidence in Court

Estonian courts may admit recordings as evidence in criminal and civil proceedings, provided the recordings were lawfully obtained.

Admissibility Standards

Recordings made by a participant in a conversation are generally admissible as evidence when:

• The recording was made lawfully (not in violation of Penal Code §156)
• The recording is relevant to the proceedings
• The recording's authenticity can be established

Recordings obtained through illegal surveillance or interception are generally inadmissible, and the person who made the illegal recording faces potential criminal charges under §156.

Digital Evidence Authentication

Given Estonia's advanced digital infrastructure, courts are accustomed to handling digital evidence. The Code of Criminal Procedure provides frameworks for the collection, preservation, and presentation of digital evidence including audio and video recordings. Estonia's digital signature infrastructure means that electronically signed or timestamped recordings carry particularly strong evidential weight regarding the time and integrity of the recording.

Digital evidence may be challenged on grounds of authenticity, chain of custody, or integrity. The AKI's X-Road access logs can themselves serve as evidence in cases where government data access is disputed.

EU AI Act and Deepfake Provisions

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689), which entered into force on August 1, 2024, is directly applicable in Estonia without requiring national transposition. Several of its provisions are directly relevant to recording law.

Article 50: Synthetic Content Disclosure

EU AI Act Article 50 takes effect August 2, 2026. It requires:

• Providers of AI systems that generate synthetic audio, video, text, or images to ensure outputs are marked in a machine-readable format and detectable as artificially generated
• Deployers using AI to generate or manipulate content to disclose clearly at first interaction that the content is AI-generated or manipulated, when it depicts real persons

This means that any recording that has been processed by AI to alter, synthesize, or clone a person's voice or appearance must be disclosed as AI-generated. Using an AI-generated deepfake recording as authentic evidence in legal proceedings would compound existing evidentiary admissibility issues.

Estonia's AI Act Supervisory Structure

As of May 2026, Estonia had not formally completed its designation of AI Act competent authorities, with the designation status listed as unclear by the EU AI Act tracker. The August 2, 2025 designation deadline under Article 113(b) had passed. The Ministry of Economic Affairs and Communications and Ministry of Justice identified a preliminary list of three relevant bodies. The Consumer Protection and Technical Regulatory Authority (TTJA) is understood to serve as one of the general market surveillance bodies for AI systems, while the AKI retains supervisory authority over data-protection aspects of AI-driven processing.

High-risk AI system obligations that would have applied from August 2, 2026 are subject to a proposed postponement to December 2, 2027 for standalone systems and August 2, 2028 for embedded systems, pending formal adoption.

No Estonia-specific national deepfake statute has been enacted. AI-generated recordings that violate personal data protection, defame individuals, or are used to commit fraud are addressed through existing PDPA, Penal Code, and civil liability frameworks.

Cross-Border Recording

Within the EU

Estonia is a full EU member state. GDPR establishes a free flow of personal data between EU member states without additional transfer requirements. Recordings made lawfully in Estonia can be transferred to other EU member states without additional authorization, provided processing in the receiving state also complies with GDPR.

Outside the EU

Transferring recordings outside the EU requires compliance with GDPR Chapter V. Transfers to countries with an EU adequacy decision (currently including the United Kingdom, Japan, New Zealand, and others) are permitted. Transfers to other countries require appropriate safeguards such as Standard Contractual Clauses (SCCs), binding corporate rules, or the individual's explicit informed consent.

E-residents and foreign businesses processing Estonian residents' data outside the EU must implement Chapter V transfer mechanisms.

Penalties Summary

Practical Advice for Recording in Estonia

For personal recordings: You may record conversations you participate in for legitimate purposes such as protecting your legal rights or keeping a personal record. Document your lawful basis. Avoid sharing recordings unnecessarily, as distribution triggers stricter GDPR obligations.

For businesses: Implement clear policies on call recording, CCTV, and employee monitoring. Provide written notice before recording begins. Conduct DPIAs for high-risk monitoring systems. Do not combine audio and video workplace surveillance without exceptional documented justification. Retain recordings only as long as necessary.

For visitors and e-residents: Estonian recording laws apply to everyone within Estonia's jurisdiction, regardless of citizenship or residency status. E-residents conducting business through Estonian entities must comply with Estonian data protection standards for any recordings connected to that business.

For public recording: When recording in public for publication, provide visible notification and allow people to object. No notification is required for public events. You have a constitutional right to record police officers performing their duties in public spaces.

For AI tools and synthetic media: Any AI-generated recording, voice clone, or synthetic video that depicts a real person requires disclosure as AI-generated under EU AI Act Article 50, effective August 2, 2026. Using undisclosed synthetic recordings in legal proceedings risks evidentiary challenges and potential liability under existing fraud and defamation provisions.

Conclusion

Estonia's recording laws reflect its dual identity as a privacy-conscious European democracy and the world's most advanced digital society. The constitutional right to communications secrecy under §43, reinforced by the Penal Code and the GDPR-implementing Personal Data Protection Act, creates strong protections against unauthorized recording and surveillance. The AKI's enforcement track record, culminating in the EUR 3 million Apotheka fine, demonstrates that these protections are actively enforced.

The framework operates at two levels: the Penal Code, which targets third-party interception and creates a de facto one-party outcome for participant recording at the criminal law level; and the GDPR and PDPA, which require any recording of personal data to have a documented lawful basis regardless of criminal-law permissibility. Anyone recording in Estonia must satisfy both layers.

Estonia's transparent digital governance model, the X-Road audit trail, and the forthcoming EU AI Act Article 50 disclosure requirement make it one of the most thoroughly regulated recording environments in the world, despite the relative accessibility of participant recording under the criminal law layer.