Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Finland supplements GDPR via the Tietosuojalaki, enforced by the Office of the Data Protection Ombudsman, and transposed NIS2 through the Cybersecurity Act (124/2025), supervised by Traficom's National Cyber Security Centre (NCSC-FI).
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Directly applicable EU regulation; sets the 72-hour breach notification standard and the €20m/4% fine cap uniformly across the EEA.
SourceFinland's supplementary GDPR legislation, applicable since 1 January 2019, replacing the old Personal Data Act. Notably sets the digital age of consent at 13, lower than the GDPR's default 16 and most other member states' thresholds.
SourceFinland's NIS2 transposition, adopted 13 March 2025 and in force since 8 April 2025, expanding the number of covered entities from roughly 1,100 to about 5,500.
Source72 hours
Controllers must notify the Office of the Data Protection Ombudsman without undue delay and, where feasible, within 72 hours of becoming aware of a breach, per GDPR Article 33.
Notify: Office of the Data Protection Ombudsman
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceApplicable , as of 2026-09-08
Transposed via the Cybersecurity Act (124/2025), in force since 8 April 2025, with entities required to register by 8 May 2025 and complete risk-management operating models by 8 July 2025. Traficom's National Cyber Security Centre (NCSC-FI) is the single point of contact and lead competent authority.
SourceOffice of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)(Data Protection Ombudsman)
Visit authority siteThe Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), within 72 hours of becoming aware of the breach where feasible, per GDPR Article 33.
13 years old. Finland's Data Protection Act (1050/2018) sets a lower threshold than the GDPR's default age of 16, meaning Finnish children can consent to information society services from age 13 without parental authorization.
Traficom's National Cyber Security Centre (NCSC-FI) is the lead competent authority and single point of contact under the Cybersecurity Act (124/2025).
Talk to us about scoping an engagement around your specific regulatory context.
