Breach coach for cyber incidents in Estonia (NIS2, GDPR)

When a cyber incident hits an Estonian company, the first 72 hours decide much of the legal and financial outcome. As breach coach I coordinate the legal side of the incident response for the insured and its cyber insurer: regulatory notifications, privilege, communication, forensic and negotiation vendors, the ransom question and documentation for the insurance claim. The regulatory and coverage framework is explained in the cyber claims guide; this page describes the service.

1. The first hours

A typical engagement starts with a call from the insurer's hotline, the broker or the insured. In the first hours I:

1. Establish the facts known so far: type of incident (ransomware, business email compromise, data exfiltration, DDoS), systems affected, data involved, whether the attacker is still present.
2. Determine regulatory status: is the insured an essential or important entity under the Cybersecurity Act (küberturvalisuse seadus, KüTS), a controller or processor under the GDPR, a financial entity under DORA, a trust service provider?
3. Start the clocks: the 24-hour early warning and 72-hour incident notification under KüTS § 8 for significant incidents; for personal data breaches, the GDPR notification to the Data Protection Inspectorate without undue delay and, where feasible, within 72 hours of the controller becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals (a processor notifies the controller without undue delay).¹²
4. Structure the engagement of forensic investigators, negotiators and PR advisers so that reports are prepared for the purpose of legal advice where possible, with clear instructions on distribution.
5. Preserve evidence and coordinate with law enforcement where appropriate.
6. Inform the insurer of the incident, the vendors proposed and the expected costs, in line with the policy's consent requirements.

2. NIS2 notifications under the Cybersecurity Act

Estonia has transposed the NIS2 Directive through amendments to KüTS in force since 1 January 2026. Service providers within its scope must:

• send an early warning to the Information System Authority (Riigi Infosüsteemi Amet, RIA) without delay and at the latest within 24 hours of becoming aware of a significant incident;
• submit an incident notification within 72 hours (24 hours for trust service providers);
• provide an interim report on the state of handling if RIA requests one before the final report (KüTS § 8 lg 4³); and
• submit a final report within one month of the incident notification; if the incident has not been resolved by then, that report is treated as an interim report and a new final report is due within one month of resolution (KüTS § 8 lg 7).¹

A designated management board member is responsible for approving and supervising security measures (KüTS § 6¹), and fines for essential entities can reach EUR 10 million or 2% of global turnover (§ 18²); for important entities, EUR 7 million or 1.4% (§ 18³).¹ These governance duties are also relevant for D&O exposure.

3. GDPR and data subjects

For personal data breaches, the controller notifies the Data Protection Inspectorate (Andmekaitse Inspektsioon) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals; a later notification must state the reasons for the delay (GDPR art 33(1)). A processor must notify the controller without undue delay (art 33(2)). Data subjects are informed without undue delay, not within a fixed 72-hour window, where the breach is likely to result in a high risk to their rights and freedoms, unless an exception applies, for example where the affected data were effectively encrypted (art 34(1), (3)).² Data subjects may claim compensation for material and non-material damage. The breach coach coordinates the notification texts, call centre scripts and the record of the breach.

4. Ransomware and sanctions

Paying a ransom is not as such prohibited by Estonian law, but:

• a payment to a person subject to EU or Estonian sanctions is prohibited and may be void and punishable; a transaction violating international sanctions is void under the International Sanctions Act (rahvusvahelise sanktsiooni seadus, RSanS) § 7;³
• many cyber policies require the insurer's prior consent and a sanctions check;
• ransom payments may conflict with anti-money-laundering obligations of banks and crypto service providers.

The breach coach organises the sanctions screening (with the negotiator's threat intelligence), documents the decision-making and coordinates with the insurer. See sanctions and insurance.

5. Coverage coordination

Cyber policies typically cover incident response costs, business interruption, data restoration, extortion, regulatory defence and third-party liability. Under Estonian insurance contract law:

• mitigation costs reasonably incurred to prevent or reduce the loss are recoverable even if unsuccessful, and costs incurred on the insurer's instructions even beyond the sum insured (§ 491 lg 2 of the Law of Obligations Act (võlaõigusseadus, VÕS));⁴
• security conditions (MFA, backups, patching) operate as obligations under VÕS § 452 lg 2, with fault and causation tests and proportional release;
• late notification releases the insurer only if intentional; otherwise the insurer may reduce by its prejudice (§ 449).

The breach coach keeps a cost log aligned with the policy sections and sub-limits, and seeks the insurer's consent for vendors and major expenses.

6. After the incident

• Final reports to RIA and the Data Protection Inspectorate.
• Support with claims by customers and data subjects.
• Lessons-learned review for the board, with a view to the board member's responsibility under KüTS § 6¹ and D&O exposure.
• Recovery against vendors (for example managed service providers) where a contractual breach contributed to the incident.

7. Engagement

I can be appointed by the insurer as panel breach coach or by the insured with the insurer's consent. Contact for incidents: +372 509 7543, olavi@widen.legal.

Cyber incidents combine coverage questions with IT, data-protection and regulatory work that has to be done in parallel. WIDEN's IT, IP and data-protection specialists are ranked by Chambers & Partners and The Legal 500 (WIDEN news, 10 August 2026), and WIDEN lawyers advised the Republic of Estonia on the transposition of the NIS2 Directive (WIDEN news, 18 September 2025). WIDEN also operates a round-the-clock legal hotline for cyber attacks and data breaches; its terms are set out in WIDEN's announcement of 11 June 2025.

Related pages

• Cyber claims in Estonia
• War exclusions and cyber
• Sanctions and insurance
• Crime and fidelity investigations
• D&O claims

References