How are data and cybersecurity laws/regulations implemented?
Last review date: 31 December 2024
☒ omnibus – all personal data
☒ sector-specific
E.g., healthcare and social welfare sector, telecoms sector, law enforcement, employment context
☒ constitutional
What are the key data privacy laws and regulations?
Last review date: 31 December 2024
Please refer to the EU Chapter for detailed information regarding EU-wide cybersecurity and other data-related legislation.
- EU General Data Protection Regulation
- The Finnish Data Protection Act (1050/2018, "DPA") (up-to-date and legally binding versions available only in Finnish and Swedish, unofficial English translation available on https://www.finlex.fi/fi/laki/kaannokset/2018/en20181050_20230239.pdf)
- The Finnish Act on Electronic Communications Services (917/2014, "AECS") (up-to-date and legally binding versions available only in Finnish and Swedish, unofficial English translation available on https://www.finlex.fi/fi/laki/kaannokset/2014/en20140917_20201207.pdf)
- The Finnish Act on the Protection of Privacy in Working Life (759/2004) (up-to-date and legally binding versions available only in Finnish and Swedish, unofficial English translation available on https://www.finlex.fi/fi/laki/kaannokset/2004/en20040759_20190347.pdf)
- The Finnish Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security (1054/2018) (up-to-date and legally binding versions available only in Finnish and Swedish, unofficial English translation available on https://www.finlex.fi/fi/laki/kaannokset/2018/en20181054_20231226.pdf)
What are the key cybersecurity laws and regulations?
Last review date: 31 December 2024
Please refer to the EU Chapter for detailed information regarding EU-wide cybersecurity and other data-related legislation.
- Cybersecurity Act (not yet in effect)
- The Government has submitted to Parliament a government bill for legislation to implement the NIS 2 Directive on 23 May 2024 (government bill 57/2024 vp). The parliamentary consideration of the government bill is currently ongoing, and it is not specified when the national laws implementing the NIS2 Directive will come into effect. Finland will implement the NIS 2 Directive with a new Cybersecurity Act. This article has been written according to the provisions found in the government bill for the new Cybersecurity Act. All references to the act in question will be marked with *.
- Act on Strong Electronic Identification and Electronic Trust Services (617/2009) (up-to-date and legally binding versions available only in Finnish and Swedish, unofficial English translation available on https://www.finlex.fi/fi/laki/kaannokset/2009/en20090617_20190412.pdf)
- Act on Electronic Communications Services (917/2014) (up-to-date and legally binding versions available only in Finnish and Swedish, unofficial English translation available on https://www.finlex.fi/en/laki/kaannokset/2014/en20140917_20201207.pdf)
- Act on Information Management in Public Administration (906/2019) (up-to-date and legally binding versions available only in Finnish and Swedish, unofficial English translation available on https://www.finlex.fi/en/laki/kaannokset/2019/en20190906.pdf)
- Criminal Code (39/1889) (up-to-date and legally binding versions available only in Finnish and Swedish, unofficial English translation available on https://www.finlex.fi/fi/laki/kaannokset/1889/en18890039_20210433.pdf)
What are the key laws and regulations relating to non-personal data?
Last review date: 31 December 2024
- EU Regulation on the Free Flow of Non-Personal Data (Regulation 2018/1807)
- EU Data Act (Regulation 2023/2854)
- Act on the Openness of Government Activities (621/1999) (up-to-date and legally binding versions available only in Finnish and Swedish, unofficial English translation available on https://www.finlex.fi/en/laki/kaannokset/1999/en19990621_20150907.pdf)