Search
- Fess search
-
Accuracy of data The personal data being processed must be accurate and up to date. Inaccurate personal data must be rectified or erased without delay. The controller must confirm the accuracy of the personal data being kept by it. The verificatio...https://tietosuoja.fi/en/accuracy-of-data
-
Processing of personal data The processing of personal data refers to activities such as the collection, storage, use, transfer and disclosure of personal data. All activities involving personal data, from the planning of processing to the erasure...https://tietosuoja.fi/en/processing-of-personal-data
-
What is personal data? All data related to an identified or identifiable person are personal data. In other words, data that can be used to identify a person directly or indirectly, such as by combining an individual data item with some other piec...https://tietosuoja.fi/en/what-is-personal-data
-
Right to data portability The data subject has the right to receive the personal data that he or she has provided to a controller in a structured, commonly used and machine-readable format and, if desired, transmit that data to another controller....https://tietosuoja.fi/en/right-to-data-portability
-
Transfer of data abroad Research is an international activity, and a need to transfer personal data out of Finland may arise during a project. There is legislation to ensure that the level of data protection does not deteriorate even if a research...https://tietosuoja.fi/en/transfer-of-data-abroad
-
Rights of the data subject When a controller processes personal data, it must take appropriate measures to ensure that the data protection rights of data subjects are fulfilled. Controllers are also required facilitate the exercise of the data sub...https://tietosuoja.fi/en/rights-of-the-data-subject
-
Consent of the data subject Consent is one possible legal basis for processing personal data. Consent gives the data subjects the opportunity to monitor the processing of their personal data and influence it by withdrawing their consent. Requireme...https://tietosuoja.fi/en/consent-of-the-data-subject
-
EU digital and data regulation The EU's digital and data regulation facilitate the movement of data within the EU, create clear and fair rules for data use and promote compliance with privacy, data protection and competition rules. Digital and dat...https://tietosuoja.fi/en/eu-digital-and-data-regulation
-
Inform data subjects about processing The requirements of the notification practices for controllers the requirements are laid down in the GDPR. The Office of the Data Protection Ombudsman urges industries to create shared notification practices a...https://tietosuoja.fi/en/inform-data-subjects-about-processing
-
When is the processing of personal data permitted? Legal bases for processing personal data The processing of personal data always requires a legal basis, which must be determined before the start of processing. Once the processing of personal dat...https://tietosuoja.fi/en/when-is-the-processing-of-personal-data-permitted
-
Minimisation of personal data in scientific research The necessity of personal data for scientific research must be assessed at the earliest possible stage. Efforts must be made to minimise the processing of personal data. Both the amount and natu...https://tietosuoja.fi/en/minimisation-of-personal-data
-
Have you misplaced personal data? This page provides instructions on what to do if your personal data has been lost, stolen or acquired with a phishing message. Act fast especially if: you have lost payment card details or your online bank ID and ...https://tietosuoja.fi/en/have-you-misplaced-personal-data
-
When you want to inspect your data The controller is required to tell you whether it is processing personal data concerning you. You have the right to inspect which of your personal data different controllers are processing. Thus, you can also ver...https://tietosuoja.fi/en/when-you-want-to-inspect-your-data
-
Processing of special categories of personal data As a rule, the processing of personal data belonging to special categories is prohibited. Such data reveals the person’s ethnic origin political opinions religion or philosophical beliefs trade uni...https://tietosuoja.fi/en/processing-of-special-categories-of-personal-data
-
When a competent authority processes your personal data The Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security sets down your rights when a competent authority processes your personal da...https://tietosuoja.fi/en/when-a-competent-authority-processes-your-personal-data
-
Right to inspect the data processed by a competent authority The competent authority is required to tell you whether it is processing personal data concerning you. You have the right to inspect which of your personal data different controllers are...https://tietosuoja.fi/en/right-to-inspect-data-processed-by-a-competent-authority
-
Have you been affected by a personal data breach? This page contains instructions for people who have been affected by a personal data breach. If you have been affected by a personal data breach, first check what data about you could have been dis...https://tietosuoja.fi/en/have-you-been-affected-by-a-personal-data-breach
-
Rights of the data subject in scientific research The rights of the data subject arising from the basis for processing should be considered at the planning stage of the study. Research subjects must be informed of how their personal data will be p...https://tietosuoja.fi/en/rights-of-the-data-subject-in-scientific-research
-
Rectification of data processed by a competent authority You have the right to have personal data concerning you rectified, especially if they pertain to facts. However, the right of rectification of data does not extend to the contents of a testi...https://tietosuoja.fi/en/rectification-of-data-processed-by-a-competent-authority
-
Brexit and the transfer of personal data to the UK When the transition period for the withdrawal from the EU ended, the United Kingdom lost all its rights and obligations as a Member State. Due to the withdrawal from the EU, data protection regula...https://tietosuoja.fi/en/brexit-and-the-transfer-of-personal-data-to-the-uk
-
If you do not want your data processed In certain situations, you have the right to restrict the processing of your personal data. You can also object to the processing of your personal data if you do not want it processed at all. Personal data re...https://tietosuoja.fi/en/if-you-do-not-want-your-data-processed
-
If you want to have your data rectified You have the right to demand the rectification of inaccurate personal data concerning you. The accuracy of your personal data is a part of your legal protection. You have the right to be evaluated on the bas...https://tietosuoja.fi/en/if-you-want-to-have-your-data-rectified
-
If you would like to have your data erased In certain situations, you have the right to request the controller to erase the personal data concerning you. Personal data refers to information by which you can be identified. A company, authority or c...https://tietosuoja.fi/en/if-you-would-like-to-have-all-of-your-data-erased
-
Destruction, anonymisation or archiving of data at the conclusion of research When a study ends, the controller must ensure that data is appropriately destroyed, anonymised or archived. Data protection regulations specify a lifespan for personal d...https://tietosuoja.fi/en/destruction-anonymisation-or-archiving-of-data
-
Roles and responsibilities for processing personal data in scientific research A research project can involve a variety of parties in different roles. Personal data may be processed for research purposes by one or more research organizations, pers...https://tietosuoja.fi/en/roles-and-responsibilities-for-processing-personal-data
-
Transfers of personal data out of the European Economic Area Transferring personal data out of the EEA requires an appropriate basis for the transfer and compliance with the other requirements imposed by data protection legislation. This page desc...https://tietosuoja.fi/en/transfers-of-personal-data-out-of-the-eea
-
Defining the research scheme and purpose for processing personal data Processing personal data for purposes of scientific research must comply with the requirement of purpose limitation. The purpose of processing personal data must be planned and ...https://tietosuoja.fi/en/defining-the-research-scheme-and-purpose-for-processing-personal-data
-
The right to obtain information on the processing of personal data Data subjects have the right to be informed of the collection and processing of their personal data. The processing of personal data shall be done in a transparent manner. Data sub...https://tietosuoja.fi/en/the-right-to-obtain-information-on-the-processing-of-personal-data
-
Have you been notified of the processing of your personal data? | Data Protection Ombudsman’s Office
Have you been notified of the processing of your personal data? You have the right to obtain information on the purpose for which your personal data is collected and how it is processed. A company, authority or corporation processing your personal...https://tietosuoja.fi/en/have-you-been-notified-of-the-processing-of-your-personal-data -
What rights do data subjects have in different situations? Not all of the rights of the data subject can be exercised in all situations, depending on factors such as the basis for the processing of personal data. Some of the rights of the data sub...https://tietosuoja.fi/en/what-rights-do-data-subjects-have-in-different-situations
-
If you would like to have your personal data transferred to another controller In certain situations, you have the right to receive your data and transfer them to another service provider. The right to data portability makes it easier for you to c...https://tietosuoja.fi/en/if-you-would-like-to-have-your-personal-data-transferred-to-another-controller
-
12.6.2026 | The Supreme Administrative Court has enforced the decision of the Office of the Data Protection Ombudsman and the Sanctions Board of the Data Protection Ombudsman concerning the operations of Verkkokauppa.com Plc. The company violated data protection provisions by failing to specify the storage periods for customer account data.https://tietosuoja.fi/en/-/supreme-administrative-court-upholds-the-administrative-fine-imposed-on-verkkokauppa.com-for-data-protection-violations
-
Erasure of data and restriction of processing when the controller is a competent authority In certain situations, the competent authority must erase data concerning you at its own initiative. Personal data must be erased if processing is not neces...https://tietosuoja.fi/en/erasure-of-data-and-restriction-of-processing
-
The right to obtain information on the processing of personal data by a competent authority You have the right to obtain information on the purpose for which a competent authority collects your personal data and on how it is processed. The authori...https://tietosuoja.fi/en/right-to-obtain-information-on-the-processing-of-personal-data
-
When your personal data are processed in the Schengen Information System or the Visa Information System The Schengen Information System (SIS) and the joint Visa Information System (VIS) of the EU countries are information exchange systems used as ...https://tietosuoja.fi/en/when-your-personal-data-are-processed-in-the-schengen-information-system-or-the-visa-information-system
-
Derogating from the rights of data subjects in the context of scientific or historical research or for statistical purposes Chapter III of the General Data Protection Regulation provides for the rights of the data subject applied to the processing...https://tietosuoja.fi/en/derogating-from-the-rights-of-data-subjects
-
19.3.2026 | This year, European data protection authorities will investigate how well organisations comply with the transparency and information obligations related to personal data processing. Data protection authorities from 25 countries across Europe will take part in the action.https://tietosuoja.fi/en/-/the-office-of-the-data-protection-ombudsman-to-investigate-the-transparency-of-personal-data-processing-as-part-of-eu-wide-action
-
16.10.2025 | The Office of the Data Protection Ombudsman has assessed the practices of the Government ICT Centre Valtori, the Digital and Population Data Services Agency and the Tax Administration in the use of cloud services in 2022. The assessment found that an adequate level of data protection had not been ensured for personal data transferred to the United States through the cloud service provided by Valtori.https://tietosuoja.fi/en/-/office-of-the-data-protection-ombudsman-government-cloud-services-must-meet-data-protection-requirements
-
30.3.2026 | The Deputy Data Protection Ombudsman has determined that the credit information company Dun & Bradstreet Finland’s practice of allowing individuals to only check their credit information for free once per year is not compliant with data protection legislation. Several deficiencies were also found in the company’s practices for responding to personal data requests.https://tietosuoja.fi/en/-/deputy-data-protection-ombudsman-individuals-must-be-able-to-access-their-credit-information-for-free
-
30.1.2026 | On Thursday 29 January 2026, the Government appointed Heljä-Tuulia Pihamaa, Master of Laws, to the post of Deputy Data Protection Ombudsman for the next five-year term of office, starting on 22 March. Pihamaa has been serving as Deputy Data Protection Ombudsman since March 2021.https://tietosuoja.fi/en/-/helja-tuulia-pihamaa-continues-as-deputy-data-protection-ombudsman