FinlandGDPR Articles 82-83 and Data Protection Act Section 24, Enforcement in Finland
Regulation (EU) 2016/679, Arts. 82-83; Tietosuojalaki 1050/2018 sec. 24
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 January 2019.
An enforcement supervision rule binding public and private bodies.
As of 2 September 2026.
What it requires
- Expect a Sanctions Board of the Data Protection Ombudsman and at least two Deputy Ombudsmen to decide any General Data Protection Regulation (GDPR) Article 83 administrative fine against your processing of personal data of a person in Finland, under Data Protection Act Section 24.
- Expect any person who suffered material or non-material damage from an infringement to have a direct right to claim compensation from you as controller or processor in the ordinary Finnish courts, under GDPR Article 82.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Tietosuojalaki Section 26 provides that punishment for a data protection offence (tietosuojarikos) is set out in Criminal Code (rikoslaki) Chapter 38, Section 9: a controller or processor who intentionally or through gross negligence obtains personal data incompatibly with its purpose, or discloses or transfers personal data in violation of the GDPR, the Tietosuojalaki, the law on processing personal data in criminal matters (1054/2018), or another data protection law's purpose-limitation, disclosure or transfer rules, thereby violating the data subject's right to privacy or causing them damage or material harm, is sentenced to a fine or imprisonment of at most one year; the same offence covers a violation of those laws' data security requirements. Section 26 separately cross-references Criminal Code offences for violating communications secrecy, unlawful computer intrusion, and breach of the Tietosuojalaki's own confidentiality duties (Sections 35 to 36).
Penalty structure
GDPR Article 83(5) sets the higher administrative-fine (seuraamusmaksu) tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher; Article 83(4) sets the narrower EUR 10,000,000 or 2 percent tier for the Article 25 to 39 obligations. Tietosuojalaki (1050/2018) Section 24 makes this fine available in Finland but expressly exempts the entire public sector from it: state authorities, state enterprises, municipal authorities, independent public-law institutions, parliamentary agencies, the Office of the President of the Republic, and the Evangelical Lutheran and Finnish Orthodox Churches and their parishes cannot be fined under this provision at all, leaving a private-sector-only fine regime. The fine is decided by a three-member college within the Office of the Data Protection Ombudsman rather than the Ombudsman alone, and may not be imposed more than ten years after the violation occurred (or, for a continuing violation, after it ended).
- Rule
- Higher of
- As of
- 2 September 2026
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland's supervisory authority. Under Tietosuojalaki Section 24, the administrative fine specifically (as opposed to the Ombudsman's other corrective powers) is decided by a three-member college of the Office rather than the Data Protection Ombudsman personally.
What it reaches
Obligation class
Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Data Protection Ombudsman is Finland's supervisory authority. Section 24 assigns a General Data Protection Regulation (GDPR) Article 83 administrative fine to a collegial Sanctions Board chaired by the Ombudsman with at least two Deputy Ombudsmen and a three-member quorum, carries a ten-year limitation period from the infringement and a five-year limitation on enforcing an already-imposed fine, and bars a fine against central government authorities, municipal authorities, and several other named public bodies.
GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor, enforceable in the ordinary Finnish courts.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisionsprocesses_biometricsprocesses_voice
Read the law
Ministry of Justice, Finland, official English translation, Data Protection Act Section 24
Official Journal text, EUR-Lex, Regulation (EU) 2016/679
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.