Skip to Content

Data Protection Legislation

Data Protection Act

The Data Protection Act (1050/2018) specifies and supplements the EU's General Data Protection Regulation and its national application. Among other things, the Act provides for the appointment, organisation and powers of the supervisory authority on data protection matters.

The Data Protection Act also provides for:

  • the age limit for offering information society services to a child;
  • the processing of special categories of personal data;
  • the processing of personal data for journalistic purposes or the purposes of academic, artistic or literary expression;
  • the processing of personal identity codes;
  • certain situation in which the public interest constitutes a legal basis for processing personal data; and
  • restrictions of the right of the data subject.

Specific legislation

In addition to general data protection legislation, Finland has specific legislation on the processing of personal data. The majority of such legislation deals with the processing of personal data by the authorities. Specific enactments either impose more precise provisions on the processing of personal data in a certain field or specify how the personal data may be processed by derogation from the general legislation.

Specific legislation is divided into enactments dealing with personal data files with a major role in the functioning of society (e.g. the Population Register and registers related to studies and the right to study) and enactments providing for the processing of personal data in a specific field (e.g. the Act on the Protection of Privacy in Working Life and the Credit Information Act). Individual provisions on data protection can also be found in legislation on other matters.

Back to top