ITER/EEEstonia
What the record establishes for Estonia: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Andmekaitse Inspektsioon reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | Riigi Infosüsteemi Amet, the State Information System Authority reported | https://raport.cert.ee/checked 2026-09-03 Not set by the act. The Authority's incident resolution department, CERT-EE, runs a notification form at raport.cert.ee, and also accepts a plain e-mail to cert@cert.ee. | ee kuberturvalisuse seadus · ria teavita |
| Financial supervisorDORA, article 19 | Finantsinspektsioon reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Finantsinspektsioon (FSA) reported | — | esma mar nca |
Transposition of NIS2 binding
| Act | Küberturvalisuse seadus |
|---|---|
| In force | The act dates from 2018. The provisions read here are those in force from 1 January 2026, as amended by RT I, 30.12.2025, 4. |
| Recipient | Riigi Infosüsteemi Amet, the State Information System Authority |
| Moves a term | No. Not in the terms. Section 8(1) owes the first notice «viivitamata, kuid hiljemalt 24 tundi pärast teada saamist küberintsidendist», section 8(4¹) the incident notice «hiljemalt 72 tundi pärast olulise mõjuga küberintsidendist teada saamist», section 8(4²) twenty-four hours for a trust service provider, and section 8(7) the final report one month from the incident notice. All of it runs from learning of the incident, as the Directive has it. What is wider is the trigger: section 8(1) reaches not only an incident with significant impact but one «mille oluline mõju ... ei ole ilmne, kuid seda võib»: where the significant impact is not evident but may arise. |
| Standing | Read in the consolidated act on Riigi Teataja, which serves it through a script and had to be rendered. Section 12(3¹) puts a deadline on the authority as Denmark's does: the Amet answers within twenty-four hours where possible. The act does not set the channel. |
| Source | ee kuberturvalisuse seadus |
An event in Estonia
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.