Sök
- Fess-sök
-
Corrective Powers The Office of the Data Protection Ombudsman has the following corrective powers: Warning controllers and processors of personal data if the planned processing activities will probably violate the General Data Protection Regulatio...https://tietosuoja.fi/en/corrective-powers
-
Frequently asked questions regarding the adequacy decision concerning data protection in the United States For organisations What does the adequacy decision concerning the United States mean? The European Commission's decision on the adequacy of d...https://tietosuoja.fi/en/faq-adequacy-decision-concerning-data-protection-in-the-united-states
-
Roles and responsibilities for processing personal data in scientific research A research project can involve a variety of parties in different roles. Personal data may be processed for research purposes by one or more research organizations, pers...https://tietosuoja.fi/en/roles-and-responsibilities-for-processing-personal-data
-
Data Protection Officer of the Office of the Data Protection Ombudsman The Data Protection Officer of the Office of the Data Protection Ombudsman acts as a contact person when the Office of the Data Protection Ombudsman processes your personal dat...https://tietosuoja.fi/en/data-protection-officer
-
Derogations for specific situations Article 49 of the General Data Protection Regulation provides for derogations for specific situations. They are a last-resort basis for data transfer, only applicable in exceptional cases . The transfer of data ...https://tietosuoja.fi/en/derogations-for-specific-situations
-
Telephone guidance Our telephone guidance service provides general guidance and support in matters involving data protection and lets you know if the case requires more detailed investigation and processing at our Office. In the first instance, tr...https://tietosuoja.fi/en/telephone-guidance
-
Notification to the Data Protection Ombudsman Concerning your rights Data protection rights help you manage your data. If you would like to exercise your rights, first contact the company or organisation that is processing your data, i.e. the cont...https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman
-
Data Protection Legislation General Data Protection Regulation (EUR-Lex) Data Protection Act (pdf, Finlex) Law Enforcement Directive (EUR-Lex) Law Enforcement Act Data Protection Act The Data Protection Act (1050/2018) specifies and supplements th...https://tietosuoja.fi/en/legislation
-
Scientific research and data protection Taking care of data protection builds trust in research subjects and is a requirement for the success of any study. It is essential to plan the processing of personal data for its entire lifespan before the ...https://tietosuoja.fi/en/scientific-research-and-data-protection
-
9.11.2023 | Högsta förvaltningsdomstolen har den 9 november förkastat ParkkiPate Oy:s ansökan om besvärstillstånd i Helsingfors förvaltningsdomstols avgörande. Helsingfors förvaltningsdomstol förkastade i juli 2022 bolagets yrkanden på upphävning av dataombudsmannens byrås förordnanden och anmärkningar samt den administrativa påföljdsavgift som påföljdskollegiet påfört.https://tietosuoja.fi/sv/-/hogsta-forvaltningsdomstolen-beviljade-inte-parkkipate-oy-besvarstillstand-forvaltningsdomstolens-avgorande-om-dataombudsmannens-byras-beslut-forblir-i-kraft
-
Brexit and the transfer of personal data to the UK When the transition period for the withdrawal from the EU ended, the United Kingdom lost all its rights and obligations as a Member State. Due to the withdrawal from the EU, data protection regula...https://tietosuoja.fi/en/brexit-and-the-transfer-of-personal-data-to-the-uk
-
Designating a data protection officer A data protection officer must be designated if your organisation processes sensitive data on a large scale monitors individuals regularly, systematically and on a large scale or your organisation is a public ...https://tietosuoja.fi/en/designating-a-data-protection-officer
-
Choosing the processing basis and ensuring its lawfulness in scientific research As a rule, the controller is free to choose the basis for processing that is most applicable to the implementation of the study. The processing of special categories ...https://tietosuoja.fi/en/choosing-the-processing-basis-and-ensuring-its-lawfulness
-
Frequently asked questions about search engines How do I request that a search result be erased from a search engine? Contact the search engine directly to request the erasure of a search result. Out of the search engines, at least Google and Bing...https://tietosuoja.fi/en/faq-search-engines
-
Processors A processor is an individual or an organisation that processes personal data on behalf of a controller. Processors operate according to the controller’s instructions and under its supervision. The controller determines the purposes and ...https://tietosuoja.fi/en/processors
-
Transfers on the basis of an adequacy decision Personal data can be transferred out of the European Union and European Economic Area if the European Commission has issued a decision on an adequate level of protection for personal data (‘adequacy d...https://tietosuoja.fi/en/transfers-on-the-basis-of-an-adequacy-decision
-
The processing of personal data at the Office of the Data Protection Ombudsmanhttps://tietosuoja.fi/en/our-data-protection-policy
-
25.6.2025 | VERKSAMHETSBERÄTTELSE 2024 DATAOMBUDSMANNENS BYRÅ B 11/2025 rd VERKSAMHETSBERÄTTELSE 2024 DATAOMBUDSMANNENS BYRÅ 3 Innehåll Dataombudsmannens byrå tryggar rättigheter och friheter i behandlingen av personuppgifter.....................................https://tietosuoja.fi/documents/6927448/242571942/2%20TSV%20Verksamhetsbera%CC%88ttelse%202024%20saavutettava.pdf/1dfd5da4-5a51-0953-936a-63f348f872de?t=1750846054208
-
Accessibility statement of Tietosuoja.fi This accessibility statement applies to the website www.tietosuoja.fi and it was created on 22 September 2020. The statement has been updated on 20 January 2026. We are committed to providing accessibility ...https://tietosuoja.fi/en/accessibility-statement
-
Lifespan of personal data processing, data protection principles and the protection of data in scientific research If processing of personal data is necessary for the implementation of the study, the lifespan of the processing must be planned from...https://tietosuoja.fi/en/lifespan-of-personal-data-processing-data-protection-principles-and-the-protection-of-data
-
Find out whether the Data Protection Ombudsman can help you What do you want to do? I want to obtain information on the processing of my personal data. I want access to my personal data I want to rectify my personal data. I want to erase my person...https://tietosuoja.fi/en/en/find-out-whether-the-data-protection-ombudsman-can-help-you-rights
-
Lecture requests The Office of the Data Protection Ombudsman’s experts can be invited to give lectures at training events held by stakeholders and other organisations. As a rule, such lectures are subject to a fee. The fees are based on the Act on...https://tietosuoja.fi/en/lecture-requests
-
Frequently asked questions about the internet Is the controller entitled to publish personal data from its personal data file on its website? Personal data stored in a personal data file may only be published on the internet with the consent of th...https://tietosuoja.fi/en/faq-internet
-
Current issues Annual report of the Office of the Data Protection Ombudsman 2025: Artificial intelligence and world politics were highlighted in data protection work Publication date: 14.7.2026 Supreme Administrative Court upholds the administrati...https://tietosuoja.fi/en/current-issues
-
European cooperation The Office of the Data Protection Ombudsman is an active member of the European Data Protection Board (EDPB). The EDPB promotes cooperation between European data protection authorities and the consistent application of data pr...https://tietosuoja.fi/en/european-cooperation
-
Rights of the data subject When a controller processes personal data, it must take appropriate measures to ensure that the data protection rights of data subjects are fulfilled. Controllers are also required facilitate the exercise of the data sub...https://tietosuoja.fi/en/rights-of-the-data-subject
-
Data protection principles The data protection principles must always be observed when processing personal data . The controller must also be able to demonstrate the effective implementation of the data protection principles in the processing of p...https://tietosuoja.fi/en/data-protection-principles
-
Controller's legitimate interests The processing of personal data can sometimes be justified due to the legitimate interests of the controller or a third party. The use of legitimate interests as a basis for processing requires particularly carefu...https://tietosuoja.fi/en/controller-s-legitimate-interests
-
Data breach notification Purpose of processing If a personal data breach can cause a risk to the rights and freedoms of natural persons, the supervisory authority must be notified. In Finland, the Office of the Data Protection Ombudsman functions ...https://tietosuoja.fi/en/data-breach-notification
-
Duties of the Data Protection Ombudsman supervising compliance with data protection legislation and other laws concerning the processing of personal data promoting awareness of the risks, rules, safeguards, obligations and rights related to the pr...https://tietosuoja.fi/en/duties
-
Accountability in scientific research The controller must be prepared to demonstrate that data protection regulations have been taken into account in the study. Researchers must document the implementation of data-protection principles and other p...https://tietosuoja.fi/en/accountability-in-scientific-research
-
22.5.2023 | Biträdande dataombudsmannen har gett Meteorologiska institutet en anmärkning på grund av överföring utan giltig orsak av personuppgifter till USA genom övervakningsteknologier. Dessutom hade Meteorologiska institutet underlåtit att göra en konsekvensbedömning för dataskydd av internationella dataöverföringar.https://tietosuoja.fi/sv/-/anmarkning-till-meteorologiska-institutet-for-overforing-av-personuppgifter-till-det-amerikanska-foretaget-google
-
7.3.2025 | Dataombudsmannens byrå, PB 800, 00531 Helsingfors, telefonväxel: 029 566 6700, [email protected], tietosuoja.fi 6.3.2025 Lathund om dataskydd i valkampanjer Dataombudsmannens byrå har utarbetat en lathund för partier, kandidater och deras stödtrupp...https://tietosuoja.fi/documents/6927448/8214540/Lathund%20om%20dataskydd%20i%20valkampanjer%202025.pdf/9a75815d-9535-3fbc-2c8c-16c0b26c7ceb?t=1741333198171
-
17.10.2025 | OEV-HPY/88/2025 25.8.2025 Beslut om avgister för handlingar som tas ut vid ämbetsverket Specialmyndighet- erna inom jus riets avgistsförordning 1. Avgister som tas ut med stöd av offentlighetslagen I lagen om offentlighet i myndigheternas verksamh...https://tietosuoja.fi/documents/6927448/8486189/Beslut_om_avgi%EF%AC%85er_f%C3%B6r_handlingar_2025.pdf/91401f43-c650-b056-5fb7-6333d04d0b3d?t=1760683648023
-
Declaration of Data Protection Officer Purpose of processing The purpose of processing the personal data of Data Protection Officers is to enable communication between the supervisory authority and the Data Protection Officers of controllers and p...https://tietosuoja.fi/en/declaration-of-data-protection-officer
-
Minimisation of data Personal data may only be processed when necessary for the purposes of the processing. The personal data being processed must be appropriate , i.e. data that can be used to fulfil a specified purpose of processing relevant , i...https://tietosuoja.fi/en/minimisation-of-data
-
17.10.2025 | OEV-HPY/88/2025 25.8.2025 Beslut om avgister för handlingar som tas ut vid ämbetsverket Specialmyndighet- erna inom jus riets avgistsförordning 1. Avgister som tas ut med stöd av offentlighetslagen I lagen om offentlighet i myndigheternas verksamh...https://tietosuoja.fi/documents/6927448/8486189/Beslut_om_avgi%EF%AC%85er_f%C3%B6r_handlingar_2025.pdf/91401f43-c650-b056-5fb7-6333d04d0b3d/Beslut_om_avgi%EF%AC%85er_f%C3%B6r_handlingar_2025.pdf?t=1760683648023
-
Storage limitation Personal data may only be stored for as long as necessary for the purposes of processing. The controller must plan and be able to justify the storage time of the personal data. The storage times of personal data must also be doc...https://tietosuoja.fi/en/storage-limitation
-
Codes of Conduct Codes of conduct are sector-specific guidelines on the application of data protection legislation. They are intended to help organisations comply with data protection requirements with concrete and practical instructions. By commi...https://tietosuoja.fi/en/codes-of-conduct
-
24.5.2023 | Den irländska dataskyddsmyndigheten har påfört Meta Platforms Ireland Limited en administrativ påföljdsavgift på 1,2 miljarder euro för överföring av personuppgifter till USA via Facebook i strid med lagen. Påföljdsavgiften påfördes enligt Europeiska dataskyddsstyrelsens bindande tvistlösningsbeslut. Detta är den hittills största boten som påförts på basis av dataskyddsförordningen. Dessutom åla...https://tietosuoja.fi/sv/-/meta-far-en-pafoljdsavgift-pa-1-2-miljarder-euro-genom-europeiska-dataskyddsstyrelsens-beslut-for-overforing-av-personuppgifter-till-usa-i-strid-med-lagen
-
Binding corporate rules Binding Corporate Rules (BCR) refer to common binding rules on the transfer of personal data to third countries within companies in the same group of undertakings or group of enterprises engaged in a joint economic activity...https://tietosuoja.fi/en/binding-corporate-rules
-
Risk assessment and data protection planning Controllers have a responsibility to assess the risks relating to the processing of personal data every time they are about to process personal data. A risk assessment allows controllers to plan the ste...https://tietosuoja.fi/en/risk-assessment-and-data-protection-planning
-
Office of the Data Protection Ombudsman The Office of the Data Protection Ombudsman safeguards your data protection rights The Data Protection Ombudsman is a national supervisory authority which supervises the compliance with data protection legis...https://tietosuoja.fi/en/office-of-the-data-protection-ombudsman
-
Transfers of personal data out of the European Economic Area Transferring personal data out of the EEA requires an appropriate basis for the transfer and compliance with the other requirements imposed by data protection legislation. This page desc...https://tietosuoja.fi/en/transfers-of-personal-data-out-of-the-eea
-
29.9.2023 | Europeiska dataskyddsstyrelsen och Europeiska datatillsynsmannen har gett ett gemensamt yttrande om EU-kommissionens förslag till en förordning om harmonisering av förvaltningsförfarandet vid behandling av ärenden som överskrider EU-ländernas gränser. Syftet med den nya förordningen är att effektivera samarbetet mellan de europeiska dataskyddsmyndigheterna vid ärenden som gäller människor i flera EU-länder.https://tietosuoja.fi/sv/-/europeiska-dataskyddsstyrelsen-och-europeiska-datatillsynsmannen-hoppas-pa-snabbt-godkannande-av-forslaget-till-en-forordning-som-gor-behandlingen-av-gransoverskridande-arenden-smidigare
-
Processing involving several EU countries If your organisation operates in more than one EU country, you need to find out which country’s supervisory authority you are meant to deal with. This data protection authority is called the lead superviso...https://tietosuoja.fi/en/processing-involving-several-eu-countries
-
20.7.2026 | EU-maiden tietosuojaviranomaiset kokoontuivat 16.–17. heinäkuuta Dublinissa Euroopan tietosuojaneuvoston korkean tason tapaamisessa. Tietosuojaviranomaiset kehottavat luomaan oikeusperustan tiedonvaihdolle eri alojen viranomaisten kesken. Tietosuojaneuvosto keskusteli myös siitä, kuinka tietosuojasääntelyn yhdenmukaista soveltamista voitaisiin tukea tietosuojaviranomaisten entistä tiiviimmällä yhteistyöllä.https://tietosuoja.fi/-/euroopan-tietosuojaneuvosto-keskusteli-eri-alojen-viranomaisten-valisesta-tiedonjaosta-ja-valvonnan-tehostamisesta
-
1.6.2023 | Biträdande dataombudsmannen har gjort en rättelse i beslutet från den 27 april där Meteorologiska institutet konstaterades att olagligen ha överfört personuppgifter till USA genom Googles tjänster. Anmärkningen till Meteorologiska institutet om att ha brutit mot artikel 35 i den allmänna dataskyddsförordningen om konsekvensbedömning har raderats från beslutet. I det korrigerade beslutet bedöms inte efterlevnaden av artikel 35 i den allmänna dataskyddsförordningen.https://tietosuoja.fi/sv/-/rattelse-till-beslutet-om-meteorologiska-institutet-anmarkningen-om-underlatelse-att-genomfora-en-konsekvensbedomning-raderades
-
List compiled by the Office of the Data Protection Ombudsman of processing operations which require data protection impact assessment (DPIA) Updated 21.12.2018 Article 35 (1) GDPR requires a DPIA when the processing activity is likely to result in...https://tietosuoja.fi/en/list-of-processing-operations-which-require-dpia
-
The review and approval of codes of conduct at the Office of the Data Protection Ombudsman The Office of the Data Protection Ombudsman reviews and approves national codes of conduct applied in Finland. The criteria for the content of codes of cond...https://tietosuoja.fi/en/the-review-and-approval-of-codes-of-conduct
-
10.7.2026 | ANNUAL REPORT OF THE OFFICE OF THE DATA PROTECTION OMBUDSMAN OF FINLAND 2025 ANNUAL REPORT OF THE OFFICE OF THE DATA PROTECTION OMBUDSMAN OF FINLAND 2025 3 Contents The Office of the Data Protection Ombudsman safeguards the rights and freedoms of ...https://tietosuoja.fi/documents/6927448/267659444/TSV%20Annual%20Report%202025%20saavutettava.pdf/2f0bc5fe-b5bd-f5cd-6110-cca70019fede?t=1783669724217
-
15.2.2022 | Dataombudsmannens byrå deltar tillsammans med 22 andra tillsynsmyndigheter i Europeiska dataskyddsstyrelsens gemensamma åtgärd för att utreda användningen av molntjänster inom den offentliga sektorn. Dataskyddsstyrelsens åtgärd inleddes den 15 februari.https://tietosuoja.fi/sv/-/dataombudsmannens-byra-inleder-en-utredning-om-anvandningen-av-molntjanster-inom-den-offentliga-sektorn-som-en-del-av-de-europeiska-tillsynsmyndigheternas-gemensamma-atgard
-
8.7.2024 | Dataombudsmannens byrå, PB 800, 00531 Helsingfors, Telefonväxel: 029 566 6700, [email protected], www.tietosuoja.fi 1 (2) Dataskyddsombud Ett dataskyddsombud är en organisationsintern sakkunnig, som följer behandlingen av personuppgifter och ger hj...https://tietosuoja.fi/documents/6927448/213374119/Anvisningar+till+organisationer+som+utn%C3%A4mnt+dataskyddsombud.pdf/55506d4c-2283-89c4-f6ee-658e5ba7b7af?t=1720445535296
-
14.7.2026 | The annual report of the Office of the Data Protection Ombudsman describes the most important data protection events of the year, supervisory work in different sectors and performance indicators. Last year was marked by an increase in the use of artificial intelligence, the transforming legislative field and the debate on the competitiveness of the EU.https://tietosuoja.fi/en/-/annual-report-of-the-office-of-the-data-protection-ombudsman-2025-artificial-intelligence-and-world-politics-were-highlighted-in-data-protection-work
-
Rollerna och ansvaren gällande behandling av personuppgifter inom vetenskaplig forskning I forskningsprojektet kan det finnas olika instanser i olika roller. Studien kan omfatta en eller flera forskningsorganisationer, en person som ansvarar för s...https://tietosuoja.fi/sv/rollerna-och-ansvaren-gallande-behandling-av-personuppgifter
-
19.3.2026 | This year, European data protection authorities will investigate how well organisations comply with the transparency and information obligations related to personal data processing. Data protection authorities from 25 countries across Europe will take part in the action.https://tietosuoja.fi/en/-/the-office-of-the-data-protection-ombudsman-to-investigate-the-transparency-of-personal-data-processing-as-part-of-eu-wide-action
-
Asiakirjajulkisuuskuvauksessa kerrotaan, millaisia tietoja tietosuojavaltuutetun toimisto tallentaa ja miten tietoja voi pyytää itselleen.https://tietosuoja.fi/asiakirjajulkisuuskuvaus
-
17.1.2023 | Biträdande dataombudsmannen har gett en anmärkning till Helsingfors, Esbo, Vanda och Grankulla stad om behandling av personuppgifter i strid med dataskyddslagstiftningen. Webbplatsen av huvudstadsregionens Helmet-bibliotek har använt uppföljningsteknologier genom vilka uppgifter om böcker och annat material som användare har sökt har kunnat förmedlas till utomstående. Personuppgifter har också överförts till USA i strid med lagen.https://tietosuoja.fi/sv/-/bitradande-dataombudsmannen-gav-en-anmarkning-om-att-uppgifterna-om-materialsokningar-pa-bibliotek-formedlades-till-det-amerikanska-foretaget-google
-
12.6.2026 | The Supreme Administrative Court has enforced the decision of the Office of the Data Protection Ombudsman and the Sanctions Board of the Data Protection Ombudsman concerning the operations of Verkkokauppa.com Plc. The company violated data protection provisions by failing to specify the storage periods for customer account data.https://tietosuoja.fi/en/-/supreme-administrative-court-upholds-the-administrative-fine-imposed-on-verkkokauppa.com-for-data-protection-violations
-
Impact assessment Impact assessments are designed to identify, evaluate and control risks involved in the processing of personal data. They are designed to be a continuous process for identifying and controlling risks. Impact assessments must be c...https://tietosuoja.fi/en/impact-assessments