Search

Frequently asked questions about banking Are banks permitted to copy my ID? Yes. Banks have a statutory obligation to know and identify their customers. Among other things, this means that the bank must verify the customer’s identity in a reliable...

News We completed the guidance on the alcohol testing of employees and processing of personal data in the workplace Type: News item Categories: Publication date: 6.8.2025 Keywords: Showing 1 - 1 / 1 Common topics What is personal data? Know your r...

Frequently asked questions about the internet Is the controller entitled to publish personal data from its personal data file on its website? Personal data stored in a personal data file may only be published on the internet with the consent of th...

Processors A processor is an individual or an organisation that processes personal data on behalf of a controller. Processors operate according to the controller’s instructions and under its supervision. The controller determines the purposes and ...

Transfer bases for authorities and the public sector Authorities and public organisations can transfer personal data to international organisations or the public bodies of third countries based on a European Commission decision on the adequacy of ...

Transfers on the basis of an adequacy decision Personal data can be transferred out of the European Union and European Economic Area if the European Commission has issued a decision on an adequate level of protection for personal data (‘adequacy d...

Accessibility statement of Tietosuoja.fi This accessibility statement applies to the website www.tietosuoja.fi and it was created on 22 September 2020. The statement has been updated on 20 January 2026. We are committed to providing accessibility ...

Choosing the processing basis and ensuring its lawfulness in scientific research As a rule, the controller is free to choose the basis for processing that is most applicable to the implementation of the study. The processing of special categories ...

Processing involving several EU countries If your organisation operates in more than one EU country, you need to find out which country’s supervisory authority you are meant to deal with. This data protection authority is called the lead superviso...

Automated decision-making and profiling What does profiling mean? Profiling means the automated processing of personal data for evaluating the personal aspects of an individual. In particular, profiling refers to the analysis or prediction of aspe...

Standard clauses adopted by the Commission Personal data can also be transferred out of the EU and EEA under the standard contractual clauses (SCC) adopted by the Commission. A transition period set for the adoption of the updated standard clauses...

Know your rights The EU's General Data Protection Regulation sets down your rights when a company or organisation is processing your personal data. You have the right to obtain information on the processing of your personal data of access to your ...

Right to restriction of processing The data subject can request the controller to restrict the processing of personal data concerning him or her. The restriction of processing means that, in addition to storage, the personal data subject to the re...

Carrying out an impact assessment 1. Draw up a systematic description of the envisaged processing operations and the purposes of the processing Draw up a description of the nature, scope, context and purposes of the processing of personal data. Id...

Frequently asked questions about personal identity code Is it permitted to ask for the personal identity code when a guest checks into a hotel? Yes. According to the Act on Accommodation and Food Service Activities (308/2006), an accommodation pro...

The right to rectification Data subjects have the right to demand the rectification of inaccurate personal data concerning them and to have incomplete personal data completed. How quickly is the controller required to reply to the data subject’s r...

Safeguards to supplement transfer tools The level of protection for personal data must be essentially equivalent to that guaranteed within the EU when transferring data to international organisations and third countries outside the European Econom...

Controller's record of processing activities The obligation to draw up a record of processing activities applies to all organisations with more than 250 employees. Smaller organisations are also required to draw up the record if the personal data ...

Confidentiality and security The processing of personal data must be confidential and secure. The controller is required to assess the potential risks, the level of the organisation's data protection and data security guidelines, and the technical...

Supervision of codes of conduct The code of conduct must specify a mechanism for the effective monitoring of compliance with the code. Monitoring means ensuring that the controllers and processors committed to compliance with the code follow the p...

Processor's record of processing activities Organisations are obligated to draw up a written description of their personal data processing. This description is called a record of processing activities. The obligation to draw up a record of process...

Storage limitation Personal data may only be stored for as long as necessary for the purposes of processing. The controller must plan and be able to justify the storage time of the personal data. The storage times of personal data must also be doc...

Frequently asked questions about the Digital Services Act (DSA) What kinds of operators are subject to the DSA's obligations? The obligations imposed by the Digital Services Act (DSA) apply to all online services, referred to as 'intermediary serv...

Controller's legitimate interests The processing of personal data can sometimes be justified due to the legitimate interests of the controller or a third party. The use of legitimate interests as a basis for processing requires particularly carefu...

Record of processing activities Record of processing activities is a written description of organisations personal data processing. The obligation to draw up a record of processing activities applies to all organisations with more than 250 employe...

Derogations for specific situations Article 49 of the General Data Protection Regulation provides for derogations for specific situations. They are a last-resort basis for data transfer, only applicable in exceptional cases . The transfer of data ...

Right to object In certain situations, the data subject has the right to object to the processing of his or her personal data, that is, request the controller not to process it at all. If the data is processed for the performance of a task carried...

Purpose limitation The purpose of processing personal data must be planned and defined clearly before the start of processing. Personal data may only be collected and processed for a specific and lawful purpose. The data may not be processed in a ...

Right to erasure In certain cases, the data subject has the right to have the controller erase data concerning him or her without undue delay. This right is also known as the right to be forgotten. The controller is obligated to erase the personal...

30.4.2021 | The Office of the Data Protection Ombudsman's sanctions board imposed an administrative fine on ParkkiPate Oy on 21 April for processing personal data in violation of data protection legislation. The violations concerned a failure to realise the rights of the data subject, shortcomings in limiting the storage period of data, and practices related to identifying data subjects.

Frequently asked questions about credit information When is a payment default entry made in the credit information register? You can get a payment default entry in approximately two months from the payment's due date at the earliest. A payment def...

Right of access Data subjects have the right to receive confirmation from the controller on whether or not the controller is processing personal data that concerns them. The data subjects thus have the opportunity to evaluate and ensure the legali...

Lawfulness, fairness and transparency The processing of personal data shall be lawful, fair and transparent. Lawfulness The processing of personal data must be done in compliance with the EU’s General Data Protection Regulation and other legislati...

Frequently asked questions about information systems Can the customer of the company be entitled to log data by virtue of the right of access? Article 15 of the General Data Protection Regulation provides for the data subject's right of access to ...

Accountability in scientific research The controller must be prepared to demonstrate that data protection regulations have been taken into account in the study. Researchers must document the implementation of data-protection principles and other p...

Claiming damages for violations of the GDPR Data subjects are entitled to damages if a controller or processor of personal data violates the EU General Data Protection Regulation and the violation causes material or immaterial damage to the data s...

Frequently asked questions about phone calls Are individuals allowed to record their own telephone conversations? Citizens have the right to record telephone calls in which they are the caller or receiver. Finland’s Constitution gives the right to...

Corrective Powers The Office of the Data Protection Ombudsman has the following corrective powers: Warning controllers and processors of personal data if the planned processing activities will probably violate the General Data Protection Regulatio...

Submitting job applications Processing of personal data related to the job application process We publish information on open positions in the Valtiolle.fi service, which is the primary channel for submitting job applications. Through the Valtioll...

Everyone has the right to their own personal data

Website cookies Cookies are small text files that browsers save on visitors’ devices. Cookies are used to keep the language selection of a user when they navigate between pages, for example. The tietosuoja.fi website uses cookies that are essentia...

Frequently asked questions about genealogy What personal data can I process for purposes of genealogical research? The General Data Protection Regulation (GDPR) does not specify what personal data may be processed for genealogical purposes. The es...

For the media Interview requests Media representatives may contact the Office of the Data Protection Ombudsman’s communications to arrange a suitable interview time. Communications can be reached by media representatives during office hours. Commu...

Frequently asked questions about direct marketing Electronic direct marketing includes direct marketing via automated calling systems, as well as direct marketing implemented using email, text, sound, voice or picture messages. Traditional direct ...

Prior consultation Prior consultation refers to where a controller needs to consult the competent data protection authority before beginning to process personal data. A prior consultation is required whenever an impact assessment shows that the en...

Frequently asked questions about search engines How do I request that a search result be erased from a search engine? Contact the search engine directly to request the erasure of a search result. Out of the search engines, at least Google and Bing...

22.4.2020 | The European Data Protection Board’s guidelines concern the processing of health data for purposes of scientific research related to the COVID-19 disease and the use of location data and contact tracing applications.

Frequently asked questions about health care Rectifying patient records How can I rectify my patient records? If there are errors in your patient records, you can ask for their rectification. The rectification request is made to the health care un...

Frequently asked questions about working life What personal data on employees and job applicants can an employer process? The employer may only process personal data that is directly necessary with regard to the employee's employment relationship,...

Impact assessment Impact assessments are designed to identify, evaluate and control risks involved in the processing of personal data. They are designed to be a continuous process for identifying and controlling risks. Impact assessments must be c...

Prior consultation request Prior consultation refers to where a controller needs to consult the competent data protection authority before beginning to process personal data. A prior consultation (premilinary hearing) is required whenever an impac...

Lecture requests The Office of the Data Protection Ombudsman’s experts can be invited to give lectures at training events held by stakeholders and other organisations. As a rule, such lectures are subject to a fee. The fees are based on the Act on...

Codes of Conduct Codes of conduct are sector-specific guidelines on the application of data protection legislation. They are intended to help organisations comply with data protection requirements with concrete and practical instructions. By commi...

We promote responsibility in the digital environment The Office of the Data Protection Ombudsman safeguards the rights and freedoms of individuals with regard to the processing of personal data. We build awareness of the rights, duties and opportu...

Registry You can enquire after matters concerning instituting and pending a case from the registry of the Office of the Data Protection Ombudsman. This kind of enquiries are for example how should a case be sent to the Office of the Data Protectio...

Scientific research FAQ Learn more about scientific research on our website Scientific research and data protection . The European Data Protection Board (EDPB) has published a first version of the guidelines for scientific research. The content of...

Telephone guidance Our telephone guidance service provides general guidance and support in matters involving data protection and lets you know if the case requires more detailed investigation and processing at our Office. In the first instance, tr...

22.4.2020 | The European Data Protection Board’s guidelines concern the processing of health data for purposes of scientific research related to the COVID-19 disease and the use of location data and contact tracing applications.

Contact information Office of the Data Protection Ombudsman Street address: Lintulahdenkuja 4, 00530 Helsinki Postal address: PL 800, 00531 Helsinki, Finland Switchboard : +358 29 566 6700 Registry: +358 29 566 6768 E-mail (registry): tietosuoja(a...

Current issues From the Data Protection Ombudsman: data protection regulations must be observed when using smart glasses Publication date: 26.8.2026 Annual report of the Office of the Data Protection Ombudsman 2025: Artificial intelligence and wor...