Data protection & privacy law in Finland (2026)

Legal framework

EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) as supplemented nationally by Finland's Data Protection Act (Tietosuojalaki 1050/2018), enforced by the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

GDPR & data protection in Finland

In Finland, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Office of the Data Protection Ombudsman.

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Office of the Data Protection Ombudsman

Applies to

any organisation processing the personal data of people in Finland, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Finland supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Finland

1. 01Primary legal framework

   The GDPR applies directly and is supplemented by the Data Protection Act (Tietosuojalaki 1050/2018), which sets national derogations (e.g., age of consent for information-society services set at 13) and repealed the pre-GDPR Personal Data Act (523/1999).

   tietosuoja.fi legislationline.org

2. 02Supervisory authority

   The Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) is Finland's independent supervisory authority under Article 51 GDPR and Section 8 of the Data Protection Act; Anu Talus was reappointed as Ombudsman for a five-year term starting 1 November 2025.

   tietosuoja.fi en.wikipedia.org

3. 03Enforcement and sanctions

   A sanctions board comprising the Ombudsman and two Deputy Ombudsmen imposes administrative fines up to EUR 20 million or 4% of worldwide turnover; recent enforcement includes a ~EUR 795,000 fine against Verkkokauppa.com upheld by the Supreme Administrative Court in June 2026 for failures to define retention periods.

   tietosuoja.fi edpb.europa.eu

4. 04Sector-specific rules

   Additional sectoral instruments apply, including the Act on the Protection of Privacy in Working Life (759/2004) for employee data, the Act on Electronic Communications Services (917/2014) for confidentiality of communications and cookies, and healthcare/patient-data statutes with strict access-logging and retention duties.

   linklaters.com resourcehub.bakermckenzie.com

5. 05Data subject rights

   Data subjects have the full GDPR catalogue of rights (access, rectification, erasure, restriction, portability, objection, and protection against solely automated decision-making); the Ombudsman also handles complaints and has full investigative and corrective powers under Article 58 GDPR.

   tietosuoja.fi tietosuoja.fi

6. 06Reform underway (2025-2026)

   The Ministry of Justice launched an overall reform in spring 2025 proposing amendments to the Data Protection Act and ten related acts; separately, Finland is implementing supervisory powers for Traficom under the EU Data Act as of 1 January 2026.

   tietosuoja.fi valtioneuvosto.fi

GDPR in Finland: FAQ

Timeline of decisions

1. 1 Nov 2025Decision
   Helsinki Administrative Court annuls Posti's €2.4M fine

   The court overturned the Data Protection Ombudsman's 2024 penalty, ruling Posti had a lawful basis to bundle its OmaPosti digital mailbox, while upholding a remark on insufficient transparency. The decision clarifies the line between service bundling and GDPR lawful-basis requirements.

   Posti Group Oyj

2. 10 Sept 2025Enforcement · official
   S-Bank fined €1.8 million for mobile-app security flaw

   The Ombudsman's Sanctions Board fined S-Pankki for a 2022 S-Mobiili authentication bug that let customers access other customers' accounts, breaching GDPR security obligations. It is one of Finland's largest data-protection penalties.

   Data Protection Ombudsman's Office

3. 1 Jun 2025Enforcement · official
   Pharmacy chain Yliopiston Apteekki fined €1.1 million over web tracking

   The Sanctions Board penalised the pharmacy for cookies and tracking tools that sent prescription and OTC purchase data to Google and Meta. It signals tougher enforcement on ad-tech tracking of sensitive health data.

   Data Protection Ombudsman's Office

4. 15 Nov 2024Enforcement · official
   Posti fined €2.4 million for OmaPosti service, Finland's largest GDPR fine

   The Sanctions Board found Posti unlawfully auto-created electronic mailboxes for OmaPosti users without clear information or consent, deeming the infringement intentional. It set a record for Finnish GDPR penalties (later partly reversed on appeal).

   Data Protection Ombudsman's Office

5. 30 Apr 2024Incident
   Hacker Aleksanteri Kivimäki sentenced for Vastaamo breach

   Länsi-Uusimaa District Court sentenced Kivimäki to six years and three months for the aggravated data breach, ~21,000 counts of aggravated blackmail, and mass dissemination of private therapy records. It closed Finland's most notorious data-crime case.

   The Record (Recorded Future News)

6. 6 Mar 2024Enforcement
   Verkkokauppa.com fined €856,000

   The Ombudsman penalised the online retailer for failing to define personal-data retention periods and for forcing account creation to make purchases. It was among Finland's largest fines at the time and stressed data-minimisation principles.

   Bird & Bird

7. 7 Dec 2021Enforcement · official
   Vastaamo psychotherapy centre fined €608,000

   The Sanctions Board fined Vastaamo for neglecting secure processing of patient records (an unprotected, password-less database) and for failing to report the breach it learned of in 2019. The case drove national attention to health-data security.

   Data Protection Ombudsman's Office

8. 21 Oct 2020Incident · official
   Vastaamo data breach disclosed

   Psychotherapy provider Vastaamo revealed that records of roughly 33,000-36,000 patients were stolen, after which extortionists demanded ransoms directly from victims. It is Finland's largest and most damaging personal-data breach.

   European Data Protection Board

9. 18 May 2020Enforcement · official
   Finland imposes its first GDPR administrative fines

   The Sanctions Board issued its first GDPR penalties on three companies (including €100,000 on Posti and €16,000 on Kymen Vesi) for failures around data-subject information and impact assessments. It established the Ombudsman's enforcement posture under the GDPR.

   European Data Protection Board

10. 1 Jan 2019Law · official
    Data Protection Act (1050/2018) enters into force

    Finland's national act supplementing the GDPR took effect, repealing the 1999 Personal Data Act and setting out the powers and organisation of the Data Protection Ombudsman as supervisory authority. It is the backbone of Finland's current framework.

    Finlex

11. 25 May 2018Law · official
    EU GDPR becomes directly applicable in Finland

    As an EU regulation, the GDPR began applying directly in Finland, replacing the directive-based regime with harmonised, enforceable EU data-protection rules. It is the foundation of today's Finnish data-protection law.

    EUR-Lex (EU)

12. 22 Apr 1999Law · official
    Personal Data Act (523/1999) enacted

    Finland adopted the Personal Data Act to implement the 1995 EU Data Protection Directive, modernising the 1987 regime after EU accession. It governed Finnish data protection until the GDPR era.

    Finlex

13. 1 Jan 1987Law · official
    Personal Data File Act and Data Protection Ombudsman established

    Finland's first comprehensive data-protection statute (in force 1988) created the office of the Data Protection Ombudsman to safeguard privacy amid growing use of computerised registries. It originated the supervisory institution that still enforces data protection today.

    Council of Europe

Sources

1. 1.tietosuoja.fi/en/legislation
2. 2.tietosuoja.fi/en/office-of-the-data-protection-ombudsman
3. 3.tietosuoja.fi/en/annual-report-2025
4. 4.legislationline.org/sites/default/files/documents/65/FINN_data%20protection.pdf
5. 5.valtioneuvosto.fi/en/data-protection
6. 6.en.wikipedia.org/wiki/Office_of_the_Data_Protection_Ombudsman
7. 7.linklaters.com/en/insights/data-protected/data-protected---finland
8. 8.resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/finland/topics/key-d
9. 9.edpb.europa.eu/news/national-news/2020/finnish-dpa-imposed-three-administrative-fine
10. 10.tietosuoja.fi/en/right-of-access
11. 11.tietosuoja.fi/en/roles-and-responsibilities-for-processing-personal-data