Finland

Layer 1 is Regulation (EU) 2016/679, whose Article 3 sets the territorial reach and whose Article 27 sets the representative duty. Layer 2 is the Finnish Data Protection Act 1050/2018, which supplements rather than replaces it. Finland's separate Cybersecurity Act 124/2025, which implements the EU NIS2 directive, reaches further than most people expect: its section 6 catches a cloud provider, data centre operator, managed service provider, online marketplace, search engine or social platform whose EU main establishment or EU representative is in Finland, and also catches an operator with no EU establishment and no EU representative at all if it simply offers services in Finland. Employment is a third layer: the Act on the Protection of Privacy in Working Life 759/2004 applies to anyone employing people in Finland, whatever the employer's nationality.

Sector by sector, verified on 18 August 2026. GAMBLING — data must stay in the country from 1 July 2027. Section 46 of the new Gambling Act 10/2026 says the gaming systems and draw devices of an exclusive-right licence holder and of a gambling licence holder must be located in Finland. Two escape hatches: the operator is licensed in another state whose regulator has signed a supervision agreement with the Finnish supervisor, or the operator lets the Finnish supervisor verify the system remotely. Fifty licence applications were already in by 8 June 2026. GOVERNMENT SECURITY NETWORK — data must stay in the country. Section 5 of Act 10/2015 requires the equipment rooms and equipment directly connected to the public administration security network to be owned or held by the Finnish state, to be located in Finland, for the services to be produced in Finland, and for administration and supervision to be carried out in Finland. There is a narrow exception where operationally necessary. HEALTH, SECONDARY USE — data must stay in the country in practice. Under Act 552/2019 an individual-level dataset released for research, statistics, teaching, development or authority supervision is not handed over as a file. It is opened inside a secure processing environment run by the data permit authority or by an audited third party, and only results come out. HEALTH, DIRECT CARE — data can leave with paperwork. Patient records can be shared with a foreign care provider through Finland's national contact point with the patient's consent. No storage-location rule was found. MAPPING AND SEABED — data can leave with paperwork. The Territorial Surveillance Act 755/2000 makes it an offence to survey the shape or composition of the seabed in Finnish waters, to run low-altitude airborne geophysical surveys, or to record defence-significant sites from the air, without a permit. Once a permit exists, the data itself is governed by the permit's conditions. BANKING, PAYMENTS, INSURANCE, SECURITIES — data can leave with paperwork. No localisation found. The Finnish Financial Supervisory Authority's outsourcing rules require advance notification of material outsourcing and continuous supervisory access, and for outsourcing outside Europe they require you to show the host country's law lets the supervisor get the information it needs. The EU digital operational resilience rules sit on top and also impose no localisation. TELECOMS — data can leave with paperwork. Call and connection records kept for the police under Act 917/2014 must be retained for 12, 9 or 6 months depending on the service. No provision was found requiring those records to be held in Finland or in Europe, which is a real difference from some neighbours. GOVERNMENT CLOUD GENERALLY — data can leave with paperwork. Finland's public administration cloud policies, last updated in 2024, are guidance and not law. Security-classified material is the constraint: the higher classification levels need approved environments rather than ordinary public cloud. EDUCATION, DEFENCE PROCUREMENT, ARTIFICIAL INTELLIGENCE — no separate Finnish localisation rule found, checked 18 August 2026, confidence medium.

The list is populated and current as at 18 August 2026: Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada for commercial organisations, Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States for organisations self-certified under the EU-US Data Privacy Framework, and the European Patent Organisation. None has been withdrawn or suspended. The 2021 standard contractual clauses remain the operative set; the promised extra clauses for importers already directly caught by the European rules are still not adopted. Binding corporate rules remain available. The narrow one-off exceptions are not a basis for routine or bulk transfers. The US framework is under pressure: a court challenge is on appeal, and on 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether recent changes in the United States affect the decision's validity. It has not been suspended. One Finnish quirk: the Data Protection Ombudsman may ask the Helsinki Administrative Court to refer a question to the EU court about whether an approval decision is lawful.

Enforcement rating the regulator is active, not aggressive: the regulator issues a steady stream of decisions and its fines are appealed to and reviewed by the administrative courts, but the volume and the values are moderate by European standards. Evidence of a working system: the Supreme Administrative Court has ruled on the fine framework and upheld a fine against the postal operator; on 1 June 2026 the Helsinki Administrative Court annulled a 1.1 million euro fine against University Pharmacy while upholding most of the underlying findings. There is a large hole. Finnish law says a fine cannot be imposed on state authorities, state enterprises, municipal authorities, independent public-law institutions, parliamentary offices, the President's office or the two national churches. So the public sector is supervised, ordered and criticised, but not fined. The government proposed on 9 April 2026 to change this. Cybersecurity supervision is split by sector, with the Finnish Transport and Communications Agency and its National Cyber Security Centre as the main body. Gambling is licensed and supervised by the National Police Board until 30 June 2027, after which it passes to the new Finnish Licensing and Supervisory Agency.

Accounting Act 1336/1997 chapter 2 sets both the retention periods and Finland's only general storage-location style rule, and it is a light one: the records must be kept so that an authority or an auditor can inspect them from Finland without undue delay. That permits storage abroad with a working access path, and does not require a copy in Finland. Retained telecoms records under Act 917/2014 section 157 are 12 months for mobile telephony and text messaging, 9 months for internet access, and 6 months for internet telephony, counted from the communication event, and the content of messages and web-browsing records are excluded. Under the secondary-use health law, access logs for a data permit are deleted or archived 12 years after the permit ends. The general deletion duty comes from the European storage-limitation principle, which Finland does not put a number on.

The 24-hour and 72-hour cyber clocks come from the Cybersecurity Act 124/2025 section 11, which implements the EU NIS2 directive and has applied since 8 April 2025. A trust service provider has a shorter version: its follow-up report is due within 24 hours, not 72. If an incident is long-running, an interim report is due within one month of the follow-up report. The telecoms clock is in Act 917/2014 section 275 and is written as 'without delay' rather than as a number of hours, which in practice means faster than 24 hours. The privacy clock is the European 72-hour rule, plus telling affected individuals without undue delay where the risk to them is high. Notifications go to different bodies: the Ombudsman for personal data, the sector's designated supervisor for cyber incidents, and the transport and communications agency for telecoms.

(1) Age 13 comes from the Finnish Data Protection Act 1050/2018 section 5. (2) and (3) come from the Act on the Protection of Privacy in Working Life 759/2004: section 3 says the necessity requirement cannot be departed from with the employee's consent; section 4 says the employer must collect personal data primarily from the employee and needs consent to collect it elsewhere, with narrow exceptions for credit and criminal record checks; collecting employee data falls inside the statutory co-operation procedure; section 24 makes a list of breaches a criminal offence punishable by a fine for the employer or the employer's representative, and points onward to the Criminal Code for the more serious personal data, unlawful access, covert surveillance and breach of confidentiality offences. Section 22 gives enforcement jointly to the occupational safety and health authorities and the Data Protection Ombudsman, which is an unusual double-headed supervisor. (4) is the public-sector exemption in section 24 of the Data Protection Act. (5) is the Territorial Surveillance Act 755/2000 sections 12 to 14 and 44. A sixth, less dramatic one: bulk disclosure of Population Information System data abroad is decided by the population register authority rather than by the recipient's contract.

Dormant switches to watch, because they can move without a fresh law. First, the location rule for gambling systems has two discretionary escape hatches, and how narrowly the supervisor reads them will decide whether it is a genuine wall or a paperwork step; the supervisor also changes hands on 1 July 2027, from the National Police Board to the new Finnish Licensing and Supervisory Agency, and the new body may read them differently. Second, Finland's rules on keeping telephone and internet records for the police are under review by the Ministry of Transport and Communications following European court rulings; a working paper went out for comment in 2024 and no bill has followed, so the current periods stand but the design is openly unsettled. Third, the exception in the security network law that allows equipment abroad 'where operationally necessary' has no published threshold. Fourth, at European level the US transfer route is under formal scrutiny after the European Data Protection Board wrote to the Commission on 31 July 2026; a suspension there would hit Finnish exporters immediately. The status of the public-sector fines bill in parliament on 18 August 2026 was not confirmed, so treat it as proposed and not as law.