Finland. Comprehensive data protection. Act
TietosuojalakiData Protection Act (Tietosuojalaki) 1050/2018
In force
Partly verified
Medium confidence.Finlex URL scheme changed in 2025; links may need updating.
§1Summary
- Synopsis
Finland's Data Protection Act supplements the GDPR, sets the age of consent and provides for a sanctions board to impose fines. Public authorities are not fined.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 13. Fines decided by a collegial sanctions board (Ombudsman plus two deputies); no administrative fines on public authorities; specific rules on personal identity codes.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; no fines on public bodies
§3Dates
- Key dates
- Adopted
- In force
- Repealed Personal Data Act 523/1999
§4Text and authority
- Text
- Authoritative text finlex.fi
- English text finlex.fi
- Authority
- Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
§5Where it applies
- Domestic law of
- Finland
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Finlex URL scheme changed in 2025; links may need updating.