Processes personal data, in Finland

Laki yksityisyyden suojasta työelämässä 759/2004, 15-17 § · Read the law's page

• Do not require an employee to take part in genetic testing when hiring or during the employment, and do not seek to learn whether a genetic test has been done on an employee (Act on the Protection of Privacy in Working Life Section 15).
• If you operate camera surveillance in premises you use, do it only to ensure the personal safety of employees and others, protect property, monitor the operation of production processes or prevent or investigate situations that endanger them, and do not use it to monitor a particular employee or particular employees (Section 16, paragraph 1).
• Do not place cameras in toilets, changing rooms or similar places, other staff facilities, or rooms assigned to employees' personal use, and target surveillance at a particular workstation only in the cases Section 16, paragraph 3 lists (Section 16, paragraphs 2 and 3).
• Before introducing camera surveillance, examine less intrusive means, keep the intrusion on employee privacy to what is necessary, use recordings only for the purposes of the surveillance, inform employees after the cooperation or consultation procedure, and announce the surveillance visibly in the premises where cameras are placed (Section 17, paragraph 1).
• Destroy recordings as soon as they are no longer needed for the purpose of the surveillance and at the latest one year after the recording ends, subject to the exceptions in Section 17, paragraph 3 (Section 17, paragraph 3).

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify the Data Protection Ombudsman without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Finland, unless the breach is unlikely to risk their rights and freedoms.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
• Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.

Regulation (EU) 2016/679, Arts. 44-49; Tietosuojalaki 1050/2018 sec. 27 · Read the law's page

• Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Finland outside the European Economic Area.

Regulation (EU) 2016/679, Arts. 12-21; Tietosuojalaki 1050/2018 secs. 21, 33-34 · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Finland within one month of receipt, unless a Data Protection Act Section 33 or 34 national security, defence, public order, or tax supervisory ground applies.

Regulation (EU) 2016/679, Arts. 82-83; Tietosuojalaki 1050/2018 sec. 24 · Read the law's page

• Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Tietosuojalaki 1050/2018 (amendments up to 380/2026 included) · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Finland, including data collected by crawling.
• Treat consent given by a child of at least 13 years as valid for an information society service offered directly to that child, under Data Protection Act Section 5.

Hallituksen esitys HE 190/2026 vp, laki tuotevastuulain muuttamisesta · Read the law's page

• If you develop, make or produce software, including software supplied through a cloud or as a service, you answer as its manufacturer; free and open-source software developed or supplied outside commercial activity is outside the Act (Secs. 1 a and 2 point 5).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is under your control: a lack of safety caused by software, an update or upgrade, a related service, a missing necessary update or a substantial modification is not excused because it arose after you put the product on the market (Sec. 7).
• Meet the mandatory product-safety requirements that apply to your product, because a product that fails them is presumed to lack safety (Sec. 4 b).
• Be ready to produce the evidence a court orders disclosed and to present it, on a party's request, in an easily accessible and understandable form, because failing to comply with a disclosure order presumes the product defective (Secs. 4 b and 13 b).
• If you are established outside the European Union, your importer, your authorized representative or, if there is neither, your fulfilment service provider answers beside you (Sec. 5).
• If you distribute a product or run an online platform that lets consumers conclude distance contracts, you answer when no liable operator can be identified or established in the Union, unless you name one within a month of the request (Sec. 6).
• Be ready to show that the objective state of scientific and technical knowledge when you placed the product on the market, or while it was under your control, did not allow the lack of safety to be detected (Sec. 7).
• Count the destruction or corruption of data used exclusively for personal purposes as compensable economic loss, with no lower limit for property damage (Sec. 8).
• A claim must be brought within three years of the injured person learning, or having reason to learn, of the damage, the lack of safety and the liable person, and within ten years of the product being placed on the market or put into use, or 25 years for latent personal injury (Sec. 9).