Last review date: 31 December 2025

Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide data privacy and other data-related legislation applicable across all EU Member States, such as the EU GDPR and the EU AI Act.

• Data Protection Act (1050/2018): Legally binding versions available in Finnish and Swedish only. Unofficial English translation available at: https://www.finlex.fi/api/media/statute-foreign-language-translation/687709/mainPdf/main.pdf?timestamp=2018-12-04T22%3A00%3A00.000Z
• Act on Electronic Communications Services (917/2014): Legally binding versions available in Finnish and Swedish only. Unofficial English translation available at: https://www.finlex.fi/api/media/statute-foreign-language-translation/687931/mainPdf/main.pdf?timestamp=2014-11-06T22%3A00%3A00.000Z
• Act on the Protection of Privacy in Working Life (759/2004): Legally binding versions available in Finnish and Swedish only. Unofficial English translation available at: https://www.finlex.fi/api/media/statute-foreign-language-translation/688410/mainPdf/main.pdf?timestamp=2004-08-12T21%3A00%3A00.000Z
• Act on the Processing of Personal Data in Criminal Matters and in Connection with Maintaining National Security (1054/2018): Legally binding versions available in Finnish and Swedish only. Unofficial English translation available at: https://www.finlex.fi/api/media/statute-foreign-language-translation/687710/mainPdf/main.pdf?timestamp=2018-12-04T22%3A00%3A00.000Z
• Criminal Code (39/1889): Legally binding versions available in Finnish and Swedish only. Unofficial English translation available at: https://www.finlex.fi/api/media/statute-foreign-language-translation/893995/mainPdf/main.pdf?timestamp=2025-12-04T06%3A17%3A49.000Z

Last review date: 31 December 2025

Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide cybersecurity and other data-related legislation applicable across all EU Member States, including the Cybersecurity Act, eIDAS Regulation, NIS 2 Directive, Cyber Resilience Act, DORA, Critical Entities Resilience Directive, and PSD2 Directive.

• Implementation of the NIS 2 Directive in Finland
  • Cybersecurity Act (123/2025) entered into force on 8 April 2025, implementing Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 ("NIS 2 Directive") into national legislation. Up-to-date and legally binding versions of the Act are available in Finnish and Swedish only; an unofficial English translation is not available at the moment.

     

• Implementation of the Cyber Resilience Act in Finland
  • Regarding Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) No 2019/1020 and Directive (EU) 2020/1828 ("Cyber Resilience Act"), the Finnish government submitted a legislative proposal to Parliament on 27 November 2025 for the national implementation of the CRA. The proposal introduces a new act concerning the cyber resilience of certain products and cybersecurity certification. It also proposes amendments to the Act on Electronic Communications Services and the Cybersecurity Act, amongst other amendments. The proposed laws are scheduled to enter into force on 1 June 2026, while considering the phased application timeline of the CRA.

     

• Act on Strong Electronic Identification and Electronic Trust Services (617/2009): Legally binding versions available in Finnish and Swedish only. Unofficial English translation available at: https://www.finlex.fi/api/media/statute-foreign-language-translation/688180/mainPdf/main.pdf?timestamp=2009-08-06T21%3A00%3A00.000Z
• Act on Electronic Communications Services (917/2014): Legally binding versions available in Finnish and Swedish only. Unofficial English translation available at: https://www.finlex.fi/api/media/statute-foreign-language-translation/687931/mainPdf/main.pdf?timestamp=2014-11-06T22%3A00%3A00.000Z
• Act on Information Management in Public Administration (906/2019): Legally binding versions available in Finnish and Swedish only. Unofficial English translation available at: https://www.finlex.fi/api/media/statute-foreign-language-translation/687658/mainPdf/main.pdf?timestamp=2019-08-08T21%3A00%3A00.000Z
• Criminal Code (39/1889): Legally binding versions available in Finnish and Swedish only. Unofficial English translation available at: https://www.finlex.fi/api/media/statute-foreign-language-translation/893995/mainPdf/main.pdf?timestamp=2025-12-04T06%3A17%3A49.000Z

Last review date: 31 December 2025

Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide legislation related to non-personal data, also applicable in all EU Member States, such as the Regulation on the free flow of non-personal data, the Data Governance Act, the Data Act, etc.

• Act on Supervision of Data Management and Sharing (1148/2025): Legally binding versions available in Finnish and Swedish only. No unofficial English translation is currently available.
  • Entry into force: 1 January 2026, as part of the national implementation of Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data ("Data Act").

   

• Act on Supervision of Online Intermediary Services (18/2024): Legally binding versions available in Finnish and Swedish only. No unofficial English translation is currently available.
  • Entry into force: 17 February 2024, as part of the national implementation of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services ("Digital Services Act").

     

• Act on the Openness of Government Activities (621/1999): Legally binding versions available in Finnish and Swedish only. Unofficial English translation available at: https://www.finlex.fi/api/media/statute-foreign-language-translation/688690/mainPdf/main.pdf?timestamp=1999-05-20T21%3A00%3A00.000Z