Annual report of the Office of the Data Protection Ombudsman 2025: Artificial intelligence and world politics were highlighted in data protection work

The annual report of the Office of the Data Protection Ombudsman describes the most important data protection events of the year, supervisory work in different sectors and performance indicators. Last year was marked by an increase in the use of artificial intelligence, the transforming legislative field and the debate on the competitiveness of the EU.

Data protection legislation is amended both in the EU and in Finland. The Office of the Data Protection Ombudsman has received new tasks, especially in the supervision of artificial intelligence, and its duties will continue to expand in the coming years. 

“Our operating environment is undergoing a transformation in many ways. Artificial intelligence has rapidly changed the digital world, and geopolitical currents have brought the competitiveness and data sovereignty of the EU to the forefront of discussion. It is becoming increasingly important to be aware of the importance of data-related control. Data protection supports data sovereignty. Especially in the public sector, it is important to identify the risks related to digital dependence and actively develop AI solutions,” says Anu Talus, Data Protection Ombudsman of Finland.

The number of cases increased, the number of data breaches is still high

The number of cases at the Office of the Data Protection Ombudsman began to increase significantly in 2025. Approximately 15,400 cases were initiated, over 2,000 more than in the previous year. A record number of cases were also handled, over 15,030. 

The increase was largely due to updating the contact details list of data protection officers appointed by organisations. This is why the Office received several hundred more data protection officer notifications than normally. 

Notifications of personal data breaches are the largest case category in the Office. The number of notifications increases annually, but their relative share of all initiated cases decreased in 2025. Organisations reported over 7,350 data breaches to the Data Protection Ombudsman during the year. Since 2018, over 40,000 breaches have been reported. 

Phishing targeting organisations’ M365 employee accounts was highlighted in data breaches. Breaches related to AI tools were identified as a new phenomenon. There was also a large number of snooping cases in which personal data were viewed without a justified reason related to work tasks. 

Administrative fines were imposed on three companies for data protection violations. For the first time, fines were imposed for failing to process personal data securely, for example, in the management of system change processes. 

Operations were made more efficient through an organisational reform 

The Office of the Data Protection Ombudsman received more resources as the Office was granted an increase of EUR 2.35 million to carry out its statutory tasks from 2026 onward. In 2025, a new organisational structure was prepared to enhance the appropriate allocation of resources and supervisory work.  

The handling of data breach notifications was also developed during the year, and an overhauled reporting form was published for organisations. In the future, the goal is to accelerate the handling of notifications through automation. 

Further information:

​​​​​​​Annual report of the Office of the Data Protection Ombudsman of Finland 2025 (pdf)

Data Protection Ombudsman Anu Talus, tel. +358 29 566 6766, anu.talus(at)om.fi 

Office of the Data Protection Ombudsman’s communications: viestinta.tietosuoja(at)om.fi

The Office of the Data Protection Ombudsman is an independent authority that monitors compliance with legislation on the processing of personal data. The Office employs approximately 65 experts.