Data & Privacy · Finland
Data & Privacy - Finland
As an EU member state, Finland applies the GDPR directly, supplemented by the national Data Protection Act (1050/2018), in force since 1 January 2019, which repealed the former Personal Data Act (523/1999). The independent supervisory authority is the Office of the Data Protection Ombudsman in Helsinki, which monitors compliance, conducts investigations, and (via a collegial Sanctions Board) imposes administrative fines. Sector-specific rules such as the Act on the Protection of Privacy in Working Life and electronic-communications privacy rules layer on top of this comprehensive framework.
The Data Protection Act (1050/2018) specifies and supplements the GDPR for national application; it has applied since 1 January 2019 and repealed the old Personal Data Act (523/1999).
The Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), based in Helsinki, is Finland's national data protection authority enforcing the GDPR. It is headed by the Data Protection Ombudsman (Anu Talus, reappointed for a five-year term from 1 November 2025) and two Deputy Ombudsmen.
Administrative fines under the GDPR may only be imposed in Finland by a collegial body (seuraamuskollegio / Sanctions Board) composed of the Ombudsman and Deputy Ombudsmen, chaired by the Ombudsman, with a quorum of at least three members.
Finland exercised the GDPR Article 8 derogation to lower the age at which children can consent to information society services to 13 years; below that age, parental consent or authorisation is required.
The Data Protection Act restricts processing of the national personal identity code (henkilötunnus), generally permitting it only with the data subject's consent or where required/authorised by law and necessary for an identified purpose.
Comprehensive protection is complemented by sectoral rules including the Act on the Protection of Privacy in Working Life (759/2004) governing employee data, and electronic-communications/ePrivacy provisions in the Act on Electronic Communications Services.
Machine-assisted translation · verified 5/23/2026 · orientation, not legal advice. English version →