# Cyber claims in Estonia: NIS2, GDPR, ransomware and insurance URL: https://insurancelawestonia.ee/guides/cyber-claims-estonia/ Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ) Last updated: 2026-11-07 > Cyber incidents in Estonia: Cybersecurity Act (NIS2) duties, GDPR claims, ransomware payments and sanctions. Estonia is one of the most digitalised states in Europe, and its companies are correspondingly exposed to ransomware, data breaches and business interruption caused by cyber incidents. For cyber insurers, an Estonian incident raises three groups of legal questions: the insured's regulatory duties during the incident, the liability exposures that follow, and the way Estonian insurance contract law treats the cyber policy itself. This guide covers all three, as of November 2026. ## 1. The regulatory framework ### 1.1 The Cybersecurity Act and NIS2 The NIS2 Directive (EU) 2022/2555 has been transposed into Estonian law through amendments to the **Cybersecurity Act** (*küberturvalisuse seadus*, KüTS), the relevant amendments entered into force on 1 January 2026 (RT I, 30.12.2025, 4), and the consolidated text in force since 16 October 2026 is the current version.[^1] The Act applies to "service providers" (*teenuseosutaja*) within its scope, categorised as essential entities (*üliolulised üksused*) and important entities (*olulised üksused*), as well as to digital service providers and public bodies. Key duties relevant to insurers: **Governance (KüTS § 6¹).** The service provider must designate at least one management board member who approves the security measures, monitors their implementation and is responsible for them; the Information System Authority (*Riigi Infosüsteemi Amet*, RIA) may request that member's contact details. The member must undergo regular training sufficient to understand and assess risks and risk-management methods. If no member is designated, the duties fall on all board members (§ 6¹ lg 3). Only the duty to designate a responsible member does not apply where the board has one member (§ 6¹ lg 1, third sentence); the approval, monitoring and training duties then rest on that sole board member (analytical conclusion). Where there is no management board because of the entity's legal form or structure, the duties apply to the person performing management functions, and for a sole trader to the trader personally (§ 6¹ lg 4).[^1] **Security measures (KüTS § 7).** Service providers must apply security measures to their systems, based on a risk analysis of the system (§ 7 lg 1 p 1, to which § 8 lg 2 refers). **Incident notification (KüTS § 8).** The obligations follow the three-stage NIS2 model:[^1] | Stage | Deadline | Content | |---|---|---| | Early warning (*esmane teade*) | without delay, at the latest **24 hours** after becoming aware of a cyber incident with significant impact, or where significant impact may reasonably be assumed | initial information | | Incident notification (*intsidenditeade*) | at the latest **72 hours** after becoming aware of a significant incident (24 hours for trust service providers) | updated assessment | | Interim report | on RIA's request, before the final report (§ 8 lg 4³) | status of handling | | Final report (*lõppraport*) | within **one month** of the incident notification; if the incident is still unresolved, that report counts as an interim report and a new final report is due within one month of resolution (§ 8 lg 7) | full description | An incident has significant impact if, among other things, its consequences are at least "severe" under the provider's own risk analysis, the service cannot be restored within the maximum permitted outage, another provider's service is disrupted, extraordinary recovery measures must be used, considerable damage has occurred or may occur, or the incident meets the criteria of the Commission's implementing act; an incident affecting services in another Member State is always significant (§ 8 lg 2–3). Where a system is managed or hosted by a third party, the service provider is responsible for ensuring that the third party notifies it within 24 hours (§ 8 lg 1¹). Where appropriate, the provider must inform affected persons, or the public, of significant incidents or threats and of the measures they can take (§ 8 lg 5).[^1] **Sanctions.** Breaches of the security and notification duties by essential entities can lead to fines of up to EUR 10 million and, for legal persons, up to 2% of the worldwide annual turnover of the previous financial year, whichever is higher; for important entities, up to EUR 7 million or 1.4% (KüTS §§ 18², 18³).[^1] ### 1.2 GDPR Where personal data are affected, the controller must notify the Estonian Data Protection Inspectorate (*Andmekaitse Inspektsioon*) without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach unless the breach is unlikely to result in a risk, and must notify data subjects without undue delay where the risk is high (GDPR arts 33–34); the notification of data subjects is not tied to the 72-hour period.[^2] The two notification regimes (KüTS and GDPR) run in parallel and are addressed to different authorities; one incident will often require both. ## 2. Liability exposures ### 2.1 Claims by data subjects Data subjects may claim compensation for material and non-material damage caused by an infringement of the GDPR (art 82).[^2] Under Estonian procedure, such claims are brought in the civil courts. Typical amounts should not be assumed from foreign experience: the exposure depends on the number of data subjects, the nature of the data and the damage actually proven; where a breach affects many people, claims may be pursued together, including through representative actions, and claims of business customers for consequential losses can exceed the data-subject claims. Limitation of consumers' and data subjects' claims is suspended when a competent authority takes the first procedural step in proceedings concerning the collective interests of consumers or data subjects or when a representative action is filed (General Part of the Civil Code Act, *tsiviilseadustiku üldosa seadus*, TsÜS, § 160¹).[^3] ### 2.2 Contractual liability to customers Service outages and data loss expose the insured to contractual claims for damages under the Law of Obligations Act (*võlaõigusseadus*, VÕS) § 115. Limitation clauses in IT and outsourcing contracts are subject to the standard-terms control (VÕS §§ 35–44): in consumer contracts, an exclusion of liability for intentional or grossly negligent breach is presumed unreasonable (§ 42 lg 3 p 1), and the same presumption applies in business-to-business contracts (§ 44).[^4] ### 2.3 Directors The designated board member under KüTS § 6¹ and the board in general face exposure for failures in cyber governance under the Commercial Code duty of care. See the [D&O guide](https://insurancelawestonia.ee/guides/d-and-o-claims-estonia). ## 3. Ransomware payments and sanctions Estonian law contains no specific statutory prohibition on paying a ransom as such. The legality of a payment nevertheless depends on several regimes: - **International sanctions.** A transaction violating an international sanction is **void** (International Sanctions Act, *rahvusvahelise sanktsiooni seadus*, RSanS, § 7 lg 1), and making funds available to a designated person or entity breaches financial sanctions.[^5] Before any payment, the threat actor, the wallet and any intermediaries must be screened against EU, UN and Estonian sanctions lists, and the result documented. EU restrictive measures against persons responsible for cyber-attacks are part of this screening. - **Anti-money laundering and criminal law.** Payment through intermediaries and virtual-currency service providers triggers due diligence; any indication that the payment would finance further criminal activity must be assessed. - **Insurance law.** A cyber policy may cover extortion payments only to the extent the payment is lawful. A contractual promise to indemnify a sanctioned payment would be unenforceable, and the insurer's own payment could itself breach sanctions. - **Cooperation with authorities.** Insurers commonly require notification of the police and of RIA as a condition of extortion cover; such conditions must be tested against VÕS § 452 lg 2 (see section 4). As breach coach, my role is to coordinate these analyses with forensic and negotiation firms so that the decision on any payment is taken on a documented legal basis. ## 4. Cyber insurance under Estonian insurance contract law ### 4.1 Which law applies? A cyber policy for an Estonian company whose risk is situated in Estonia and does not qualify as a large risk under Rome I art 7(2) will normally be governed by Estonian law: art 7(3) limits the choice to the laws listed there, so a foreign choice-of-law clause is usually ineffective.[^6] Where the policyholder meets at least two of the three criteria in VÕS § 427 lg 3 (balance sheet above EUR 6.6 million, net turnover above EUR 13.6 million, at least 250 employees on average), the protective rules of § 427 lg 1 do not apply to the financial loss and liability classes; otherwise they do.[^4] See the [choice of law guide](https://insurancelawestonia.ee/guides/choice-of-law-jurisdiction-insurance-estonia). ### 4.2 Security conditions (MFA, backups, patching) Cyber wordings commonly require multi-factor authentication, offline backups, timely patching and endpoint detection. Under Estonian law such requirements are obligations aimed at reducing the insured risk or preventing its increase. The insurer may not rely on a release clause for their breach if the breach had no effect on the occurrence of the insured event or the extent of the insurer's obligation (VÕS § 452 lg 2 p 2), nor if a pre-event breach was not culpable (§ 452 lg 2 p 1).[^4] A missing MFA on a system that was not the attack vector will therefore not, by itself, defeat a claim. Insurers should investigate the actual attack path in the forensic report before taking a coverage position. Whether a requirement is a true **risk description** (cover applies only to systems with MFA) or a disguised **obligation** is a question of construction; an Estonian court will look at substance, and unclear wording is construed against the insurer (VÕS § 39 lg 1).[^4] ### 4.3 Pre-contractual disclosure and proposal forms Cyber proposal forms are usually detailed. Incorrect answers allow the insurer to withdraw within one month of discovering the breach and within three years of conclusion (VÕS §§ 441–442), but after an insured event the insurer must still pay if the misrepresented circumstance had no effect on the event (§ 442 lg 2). Circumstances not asked about can ground withdrawal only if intentionally concealed (§ 441 lg 3).[^4] Fraudulent answers allow avoidance under the TsÜS (§ 441 lg 5). ### 4.4 Aggravation of risk Significant changes in the IT environment (migration to new systems, removal of security controls) may constitute an increase in the probability of the insured risk. Two rules must be kept apart. Where the risk increased and the policyholder failed to notify the increase (VÕS § 443), the insurer is released only if the insured event occurs more than one month after the notice should have reached it, unless the insurer already knew or should have known of the increase at that time (§ 445 lg 1). Where the policyholder itself increased the risk, or allowed persons for whom it is responsible to do so, without the insurer's consent (§ 444), there is no one-month waiting period: the insurer is released to the extent of the increase if the insured event occurs after it (§ 445 lg 2). In both cases there is no release if the increase had no effect on the occurrence of the insured event, if by the time of the event the period within which the insurer could have cancelled or demanded amendment of the contract because of the increase had expired without it doing so, if the higher risk would not have affected the insurer's obligation, or if the risk increased through the insurer's fault (§ 445 lg 3).[^4] ### 4.5 Incident response costs and mitigation The insured must try to prevent and reduce damage, following the insurer's instructions (VÕS § 488 lg 1). The insurer must reimburse mitigation expenses the insured reasonably considered necessary, even if unsuccessful, and expenses incurred **on the insurer's instructions even beyond the sum insured**; on request, it must advance the amount needed for expenses to be incurred in accordance with its instructions (§ 491 lg 2, last sentence).[^4] For cyber insurers using panel vendors, this means that instructing a panel forensic firm may create an obligation to pay its costs outside the limit unless the wording validly regulates the point (and § 491 is mandatory where § 427 lg 1 applies). The insured may not alter affected systems in a way that impedes establishing the cause or extent of the loss, except where necessary for mitigation or in the public interest (§ 488 lg 2). Restoring from backups is usually necessary mitigation; wiping evidence without imaging may breach § 488 lg 2 and allow a reduction of the indemnity by the resulting prejudice (§ 488 lg 3). ### 4.6 Notification and cooperation Notification must be made without delay (VÕS § 448); for the liability section, within one week of becoming aware of circumstances that may lead to an insured event or of a claim (§ 514 lg 1). Negligent late notification reduces the indemnity only to the extent of the insurer's prejudice; only intentional breach releases it (§ 449).[^4] ### 4.7 War and state-backed attacks Cyber exclusions for war and state-backed cyber operations are risk descriptions, not obligations, and thus outside § 452. Their enforceability depends on transparency and on the insurer's ability to prove attribution. An Estonian court will apply VÕS § 39 lg 1 (contra proferentem) to ambiguous attribution mechanisms; insurers should ensure that the attribution process and the burden of proof are clearly stated. ### 4.8 Interplay with crime and D&O Social-engineering losses (fake invoices, CEO fraud) may fall under cyber, crime or both. Overlapping covers may constitute multiple insurance with joint and several liability of insurers towards the insured (VÕS § 486 lg 1–3), subject to the definitions of "the same risk".[^4] See the [crime and fidelity guide](https://insurancelawestonia.ee/guides/crime-fidelity-claims-estonia). ## 5. Checklist for cyber insurers and breach coaches 1. Hour 0–24: determine whether the insured is within KüTS scope and whether a significant incident has occurred; send early warning to RIA (§ 8 lg 1). 2. Hour 0–72: GDPR breach assessment and notification; KüTS incident notification (§ 8 lg 4¹). 3. Preserve evidence before restoration (VÕS § 488 lg 2). 4. Sanctions screening before any extortion payment (RSanS § 7). 5. Document instructions to vendors: costs may be payable beyond limits (§ 491 lg 2). 6. Test any security-condition defence against § 452 lg 2 causation. 7. Final report to RIA within one month (§ 8 lg 7); calendar limitation of third-party claims. Cyber incidents combine coverage questions with IT, data-protection and regulatory work that has to be done in parallel. WIDEN's IT, IP and data-protection specialists are ranked by Chambers & Partners and The Legal 500 ([WIDEN news, 10 August 2026](https://widen.legal/news-events/widens-estonian-lawyers-and-legal-practices-recognised-in-the-2026-chambers-partners-and-legal-500-rankings/)), and WIDEN lawyers advised the Republic of Estonia on the transposition of the NIS2 Directive ([WIDEN news, 18 September 2025](https://widen.legal/news-events/widen-attorneys-advised-the-republic-of-estonia-on-the-transposition-of-the-nis2-directive/)). WIDEN also operates a round-the-clock legal hotline for cyber attacks and data breaches; its terms are set out in [WIDEN's announcement of 11 June 2025](https://widen.legal/news-events/24-7-legal-hotline-for-cyber-attacks-and-data-breaches/). ## Related pages - [Breach coach for cyber incidents in Estonia](https://insurancelawestonia.ee/services-for-insurers/breach-coach-cyber-incidents) - [War exclusions and cyber insurance under Estonian law](https://insurancelawestonia.ee/guides/war-exclusions-and-cyber) - [Cyber insurance and NIS2 in Estonia](https://insurancelawestonia.ee/blog/2026-11-02-cyber-insurance-nis2-estonia) - [Safety obligations and proportionality](https://insurancelawestonia.ee/estonian-insurance-contract-law/safety-obligations-and-proportionality) - [Crime and fidelity claims in Estonia](https://insurancelawestonia.ee/guides/crime-fidelity-claims-estonia) - [Sanctions and insurance in Estonia](https://insurancelawestonia.ee/guides/sanctions-and-insurance) ## References [^1]: Cybersecurity Act (küberturvalisuse seadus, KüTS) §§ 6¹, 7, 8, 18², 18³. RT I, 06.10.2026, 2 (in force 16.10.2026). Estonian: ; English (version in force 01.10.2026–15.10.2026): . The Act transposes Directive (EU) 2022/2555 (NIS2). [^2]: Regulation (EU) 2016/679 (General Data Protection Regulation), arts 33, 34, 82. . [^3]: General Part of the Civil Code Act (tsiviilseadustiku üldosa seadus, TsÜS) § 160¹. RT I, 31.12.2024, 48 (in force 01.01.2025). Estonian: ; English: . [^4]: Law of Obligations Act (võlaõigusseadus, VÕS) §§ 35–44, 115, 427, 439–452, 486, 488, 491, 514. RT I, 20.06.2026, 18 (in force 01.09.2026). Estonian: ; English: . [^5]: International Sanctions Act (rahvusvahelise sanktsiooni seadus, RSanS) § 7. RT I, 17.05.2025, 4 (in force 01.07.2026). Estonian: ; English: . [^6]: Regulation (EC) No 593/2008 (Rome I), art 7. .