FinlandData Protection Act (Tietosuojalaki)
Tietosuojalaki 1050/2018 (amendments up to 380/2026 included)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Finland, including data collected by crawling.
- Treat consent given by a child of at least 13 years as valid for an information society service offered directly to that child, under Data Protection Act Section 5.
These lines are LexLint's reading of the law's text. Also read by: European Data Protection Board (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_202005_consent_en.pdf
- Guidance body
- European Data Protection Board
- Open questions
- What evidence beyond a stated adult-only policy shows that a general-audience service is offered 'suoraan lapselle' under section 5 of the Tietosuojalaki, given that the Board's guidelines point to the content of the site and marketing plans?
- Does a controller that publishes personal data both for journalistic expression and to earn advertising revenue process 'ainoastaan journalistisia tarkoituksia varten' under section 27 of the Tietosuojalaki, so that Articles 6, 7, 9 and 12 to 22 of the GDPR do not apply?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Actor identity
Logging duty
Where special categories of personal data are processed under Section 6, the controller and the processor take suitable and specific measures to safeguard the data subject, and the first measure the Act lists is one that makes it possible afterwards to verify and establish who recorded, altered or transferred the data. The clause names no log fields beyond that identity and sets no retention period.
- Kind
- Explicit
- As of
- Provision
- Data Protection Act (Tietosuojalaki 1050/2018), Section 6, second paragraph, point 1
- Trigger
- personal_data_processing
What this law does
The Data Protection Act specifies and supplements the General Data Protection Regulation (GDPR) within the GDPR's own scope of application. Section 5 sets the digital age of consent for information society services at 13, the lower bound GDPR Article 8 permits.
Section 24 assigns GDPR Article 83 administrative fines to a collegial Sanctions Board made up of the Data Protection Ombudsman and at least two Deputy Ombudsmen, with a three-member quorum, rather than to a single official, and bars a fine against central government and several other public bodies.
Section 27 disapplies specified GDPR articles for processing performed solely for journalistic, academic, artistic or literary purposes, including Chapter V transfer rules where applying them would infringe freedom of expression.
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .