Search
- Fess search
-
Minimisation of personal data in scientific research The necessity of personal data for scientific research must be assessed at the earliest possible stage. Efforts must be made to minimise the processing of personal data. Both the amount and natu...https://tietosuoja.fi/en/minimisation-of-personal-data
-
The right to rectification Data subjects have the right to demand the rectification of inaccurate personal data concerning them and to have incomplete personal data completed. How quickly is the controller required to reply to the data subject’s r...https://tietosuoja.fi/en/right-to-rectification
-
Processing of the personal data of Data Protection Officers Controllers and processors must declare the contact details of their Data Protection Officers to our Office. The notification can be made with the form on our website or by providing the ...https://tietosuoja.fi/en/processing-of-the-personal-data-of-data-protection-officers
-
Right to erasure In certain cases, the data subject has the right to have the controller erase data concerning him or her without undue delay. This right is also known as the right to be forgotten. The controller is obligated to erase the personal...https://tietosuoja.fi/en/right-to-erasure
-
Data protection for children and youth A lot of information called personal data is collected on you when you use the internet, social media or the apps on your phone, or play video games. Personal data is also collected for your hobbies and at sc...https://tietosuoja.fi/en/children-s-data-protection
-
Frequently asked questions about elections On this page, you will find answers to frequently asked questions about election advertising and data protection. See also: Frequently asked questions about direct marketing Information on the EU regulati...https://tietosuoja.fi/en/faq-elections
-
Frequently asked questions about Data Protection Officers More information about data protection officers and instructions for organisations and managers that have designated a data protection officer Do the Data Protection Officer's name and cont...https://tietosuoja.fi/en/faq-dpos
-
Processor's record of processing activities Organisations are obligated to draw up a written description of their personal data processing. This description is called a record of processing activities. The obligation to draw up a record of process...https://tietosuoja.fi/en/processor-s-record-of-processing-activities
-
Frequently asked questions about phone calls Are individuals allowed to record their own telephone conversations? Citizens have the right to record telephone calls in which they are the caller or receiver. Finland’s Constitution gives the right to...https://tietosuoja.fi/en/faq-phone-calls
-
This section provides answers to common questions.https://tietosuoja.fi/en/frequently-asked-questions
-
Visiting the Office of the Data Protection Ombudsman Instituting a case Our website contains electronic forms for instituting cases falling within the competence of the data protection authorities ( read more on our office’s electronic services )....https://tietosuoja.fi/en/visiting-the-office
-
Have you been notified of the processing of your personal data? | Data Protection Ombudsman’s Office
Have you been notified of the processing of your personal data? You have the right to obtain information on the purpose for which your personal data is collected and how it is processed. A company, authority or corporation processing your personal...https://tietosuoja.fi/en/have-you-been-notified-of-the-processing-of-your-personal-data -
Carrying out an impact assessment 1. Draw up a systematic description of the envisaged processing operations and the purposes of the processing Draw up a description of the nature, scope, context and purposes of the processing of personal data. Id...https://tietosuoja.fi/en/carrying-out-an-impact-assessment
-
Registry You can enquire after matters concerning instituting and pending a case from the registry of the Office of the Data Protection Ombudsman. This kind of enquiries are for example how should a case be sent to the Office of the Data Protectio...https://tietosuoja.fi/en/registry
-
Have you been subjected to a decision based solely on automated processing? You have the right to demand human involvement in decisions that concern you. Some decisions concerning you can be made automatically. This means that humans are not invol...https://tietosuoja.fi/en/have-you-been-subjected-to-a-decision-based-solely-on-automated-processing
-
Pseudonymised and anonymised data Pseudonymised personal data Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific person without the use of additional information...https://tietosuoja.fi/en/pseudonymised-and-anonymised-data
-
Personal data breaches What is a personal data breach? A personal data breach means an event leading to the destruction, loss, alteration or unauthorised disclosure of, or access to, personal data. Examples of personal data breaches include lost d...https://tietosuoja.fi/en/personal-data-breaches
-
Right to restriction of processing The data subject can request the controller to restrict the processing of personal data concerning him or her. The restriction of processing means that, in addition to storage, the personal data subject to the re...https://tietosuoja.fi/en/right-to-restriction-of-processing
-
Destruction, anonymisation or archiving of data at the conclusion of research When a study ends, the controller must ensure that data is appropriately destroyed, anonymised or archived. Data protection regulations specify a lifespan for personal d...https://tietosuoja.fi/en/destruction-anonymisation-or-archiving-of-data
-
When is the processing of personal data permitted? Legal bases for processing personal data The processing of personal data always requires a legal basis, which must be determined before the start of processing. Once the processing of personal dat...https://tietosuoja.fi/en/when-is-the-processing-of-personal-data-permitted
-
Data protection in the development and use of AI systems These pages have information on the requirements arising from data protection legislation that should be taken into account when artificial intelligence (AI) systems are developed and used. ...https://tietosuoja.fi/en/ai-systems-and-data-protection
-
Frequently asked questions about personal identity code Is it permitted to ask for the personal identity code when a guest checks into a hotel? Yes. According to the Act on Accommodation and Food Service Activities (308/2006), an accommodation pro...https://tietosuoja.fi/en/faq-personal-identity-code
-
Claiming damages for violations of the GDPR Data subjects are entitled to damages if a controller or processor of personal data violates the EU General Data Protection Regulation and the violation causes material or immaterial damage to the data s...https://tietosuoja.fi/en/claiming-damages
-
Regulation on political advertising and the powers of the Data Protection Ombudsman The EU regulation on the transparency and targeting of political advertising sets out rules on how political advertising may be targeted. The Data Protection Ombud...https://tietosuoja.fi/en/regulation-on-political-advertising
-
If you want to have your data rectified You have the right to demand the rectification of inaccurate personal data concerning you. The accuracy of your personal data is a part of your legal protection. You have the right to be evaluated on the bas...https://tietosuoja.fi/en/if-you-want-to-have-your-data-rectified
-
Scientific research FAQ Learn more about scientific research on our website Scientific research and data protection . The European Data Protection Board (EDPB) has published a first version of the guidelines for scientific research. The content of...https://tietosuoja.fi/en/faq-scientific-research
-
Everyone has the right to their own personal datahttps://tietosuoja.fi/en/private-persons
-
Know your responsibility and build trusthttps://tietosuoja.fi/en/organisations
-
Data Protection Legislation General Data Protection Regulation (EUR-Lex) Data Protection Act (pdf, Finlex) Law Enforcement Directive (EUR-Lex) Law Enforcement Act Data Protection Act The Data Protection Act (1050/2018) specifies and supplements th...https://tietosuoja.fi/en/legislation
-
Annual report 2025 The annual report describes the year's most important data protection events, supervision measures in different sectors and presents the key figures for the Office's operations. Annual report of the Office of the Data Protection...https://tietosuoja.fi/en/annual-report-2025
-
If you do not want your data processed In certain situations, you have the right to restrict the processing of your personal data. You can also object to the processing of your personal data if you do not want it processed at all. Personal data re...https://tietosuoja.fi/en/if-you-do-not-want-your-data-processed
-
Lawfulness, fairness and transparency The processing of personal data shall be lawful, fair and transparent. Lawfulness The processing of personal data must be done in compliance with the EU’s General Data Protection Regulation and other legislati...https://tietosuoja.fi/en/lawfulness-fairness-and-transparency
-
Know your rights The EU's General Data Protection Regulation sets down your rights when a company or organisation is processing your personal data. You have the right to obtain information on the processing of your personal data of access to your ...https://tietosuoja.fi/en/know-your-rights
-
The researcher’s data protection expertise Data protection tools are a necessary part of the researcher’s work and competence. Compliance with data protection regulations builds trust and lays the groundwork for future research. Data protection re...https://tietosuoja.fi/en/researchers-data-protection-expertise
-
Processors’ responsibilities Processors are governed by the General Data Protection Regulation if they are established in an EU Member State they are not established in an EU Member State but their personal data processing activities relate to the...https://tietosuoja.fi/en/processors-responsibilities
-
Transfer bases for authorities and the public sector Authorities and public organisations can transfer personal data to international organisations or the public bodies of third countries based on a European Commission decision on the adequacy of ...https://tietosuoja.fi/en/transfer-bases-for-authorities-and-the-public-sector
-
Telephone guidance Our telephone guidance service provides general guidance and support in matters involving data protection and lets you know if the case requires more detailed investigation and processing at our Office. In the first instance, tr...https://tietosuoja.fi/en/telephone-guidance
-
Data Protection Officer of the Office of the Data Protection Ombudsman The Data Protection Officer of the Office of the Data Protection Ombudsman acts as a contact person when the Office of the Data Protection Ombudsman processes your personal dat...https://tietosuoja.fi/en/data-protection-officer
-
If you would like to have your personal data transferred to another controller In certain situations, you have the right to receive your data and transfer them to another service provider. The right to data portability makes it easier for you to c...https://tietosuoja.fi/en/if-you-would-like-to-have-your-personal-data-transferred-to-another-controller
-
Frequently asked questions about genealogy What personal data can I process for purposes of genealogical research? The General Data Protection Regulation (GDPR) does not specify what personal data may be processed for genealogical purposes. The es...https://tietosuoja.fi/en/faq-genealogy