Finland

Three layers stack here. The first is the European General Data Protection Regulation, Regulation (EU) 2016/679. It sets who is covered and the duty to name a representative in Europe. The second is the Finnish Data Protection Act 1050/2018, which adds to the European rules rather than replacing them. The third is Finland's Cybersecurity Act 124/2025. That law brings the European Union's second network and information security directive into Finnish law, and it reaches further than most people expect. It covers a cloud provider, data centre operator, managed service provider, online marketplace, search engine or social platform whose main European office or European representative is in Finland. It also covers an operator with no European office and no European representative at all, if it simply offers services in Finland. Employment adds a further layer. The Act on the Protection of Privacy in Working Life 759/2004 applies to anyone employing people in Finland, whatever the employer's nationality.

Industry by industry, verified on 18 August 2026. GAMBLING. data must stay in the country from 1 July 2027. The new Gambling Act 10/2026 says the gaming systems and draw devices of licence holders must be in Finland. There are two ways out. The operator is licensed in another state whose regulator has signed a supervision agreement with the Finnish supervisor. Or the operator lets the Finnish supervisor check the system remotely. Fifty licence applications were already in by 8 June 2026. GOVERNMENT SECURITY NETWORK. data must stay in the country Act 10/2015 requires the equipment rooms and equipment directly connected to the public administration security network to be owned or held by the Finnish state. They must be in Finland. The services must be produced in Finland. Administration and supervision must happen in Finland. There is a narrow exception where it is operationally necessary. HEALTH, REUSE FOR RESEARCH. data must stay in the country in effect. Under Act 552/2019, person-level data released for research, statistics, teaching, development or official supervision is not handed over as a file. It is opened inside a secure environment run by the data permit authority, or by an audited outside provider. Only results come out. HEALTH, DIRECT CARE. data can leave only if conditions are met Patient records can be shared with a foreign care provider through Finland's national contact point, with the patient's consent. We found no rule about where the data must be stored. MAPPING AND SEABED. data can leave only if conditions are met The Territorial Surveillance Act 755/2000 makes three things an offence without a permit. Surveying the shape or make-up of the seabed in Finnish waters. Running low-altitude airborne geophysical surveys. And recording defence-significant sites from the air. Once you have a permit, the permit's conditions govern the data. BANKING, PAYMENTS, INSURANCE, SECURITIES. data can leave only if conditions are met We found no rule forcing data to stay in the country. The Finnish Financial Supervisory Authority's outsourcing rules require advance notice of major outsourcing, and continuous access for the supervisor. For outsourcing outside Europe you must also show that the host country's law lets the supervisor get the information it needs. The European Union's digital operational resilience rules sit on top, and they too do not force data to stay in any country. TELECOMS. data can leave only if conditions are met Call and connection records kept for the police under Act 917/2014 must be kept for 12, 9 or 6 months, depending on the service. We found no rule requiring those records to be held in Finland or in Europe. That is a real difference from some neighbouring countries. GOVERNMENT CLOUD IN GENERAL. data can leave only if conditions are met Finland's public administration cloud policies were last updated in 2024. They are guidance, not law. Security-classified material is the real limit. The higher classification levels need approved environments rather than ordinary public cloud. EDUCATION, DEFENCE PROCUREMENT, ARTIFICIAL INTELLIGENCE. We found no separate Finnish rule forcing data to stay in the country, checked 18 August 2026, medium confidence.

The approved list has entries and is current as at 18 August 2026. It covers Andorra, Argentina, Brazil (new, 26 January 2026, and mutual), Canada for commercial organisations, Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States for organisations signed up to the EU-US Data Privacy Framework, and the European Patent Organisation. None has been withdrawn or suspended. The 2021 standard contract clauses are still the ones you use. The promised extra clauses, for recipients already covered by the European rules directly, are still not adopted. Group-wide internal rules are still available. The narrow one-off exceptions cannot be used for routine or bulk transfers. The United States route is under pressure. A court challenge is on appeal. On 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether recent changes in the United States affect the decision. It has not been suspended. One Finnish quirk. The Data Protection Ombudsman may ask the Helsinki Administrative Court to send a question to the European Union court. The question is whether an approval decision is lawful.

We rate enforcement an active regulator, not aggressive. The regulator issues a steady stream of decisions. Its fines are appealed to and reviewed by the administrative courts. But the number of cases and the amounts are moderate by European standards. The system clearly works. The Supreme Administrative Court has ruled on how fines are set, and upheld a fine against the postal operator. On 1 June 2026 the Helsinki Administrative Court cancelled a 1.1 million euro fine against University Pharmacy, while upholding most of the findings behind it. There is a large gap. Finnish law says a fine cannot be imposed on state authorities, state enterprises, municipal authorities, independent public-law institutions, parliamentary offices, the President's office or the two national churches. So the public sector is supervised, ordered and criticised, but not fined. The government proposed on 9 April 2026 to change this. Cyber supervision is split by industry. The Finnish Transport and Communications Agency and its National Cyber Security Centre are the main bodies. Gambling is licensed and supervised by the National Police Board until 30 June 2027. After that it passes to the new Finnish Licensing and Supervisory Agency.

The Accounting Act 1336/1997 sets both the keep-times and Finland's only general rule about where records sit. That rule is light. The records must be kept so that an authority or an auditor can inspect them from Finland without undue delay. That allows storage abroad with a working access path. It does not require a copy in Finland. Telecoms records kept for the police under Act 917/2014 run 12 months for mobile telephony and text messaging, 9 months for internet access, and 6 months for internet telephony. The clock starts at the communication. Message content and web-browsing records are left out. Under the health reuse law, access logs for a data permit are deleted or archived 12 years after the permit ends. The general duty to delete comes from the European rule that you keep data no longer than you need it. Finland does not put a number on that.

The 24-hour and 72-hour cyber deadlines come from the Cybersecurity Act 124/2025. That law brings the European Union's second network and information security directive into Finnish law, and has applied since 8 April 2025. A trust service provider has a shorter version. Its follow-up report is due within 24 hours, not 72. If an incident runs on, an interim report is due within one month of the follow-up report. The telecoms deadline is in Act 917/2014. It is written as 'without delay' rather than as a number of hours, which means faster than 24 hours. The privacy deadline is the European 72-hour rule. You must also tell affected individuals without undue delay where the risk to them is high. The notices go to different bodies. Personal data goes to the Ombudsman. Cyber incidents go to your industry's named supervisor. Telecoms incidents go to the transport and communications agency.

(1) The age of 13 comes from the Finnish Data Protection Act 1050/2018. (2) and (3) come from the Act on the Protection of Privacy in Working Life 759/2004. It says the necessity requirement cannot be set aside with the employee's consent. It says the employer must collect personal data mainly from the employee. You need consent to collect it elsewhere. There are narrow exceptions for credit and criminal record checks. Collecting employee data falls inside the staff consultation procedure required by law. The Act makes a list of breaches a crime, punishable by a fine for the employer or the employer's representative. It also points to the Criminal Code for the more serious offences about personal data, unlawful access, covert surveillance and breach of confidence. Enforcement is shared between the occupational safety and health authorities and the Data Protection Ombudsman. That double-headed supervisor is unusual. (4) is the public-sector exemption in the Data Protection Act. (5) is the Territorial Surveillance Act 755/2000. There is a sixth, less dramatic point. Bulk release of Population Information System data abroad is decided by the population register authority, not by the recipient's contract.

Powers and reviews to watch, because they can move without a new law. First, the rule that gambling systems must sit in Finland has two escape routes, and the supervisor decides how narrowly to read them. That decides whether it is a real ban or a paperwork step. The supervisor also changes on 1 July 2027, from the National Police Board to the new Finnish Licensing and Supervisory Agency. The new body may read them differently. Second, Finland's rules on keeping telephone and internet records for the police are under review. The Ministry of Transport and Communications is reviewing them, after European court rulings. A working paper went out for comment in 2024 and no bill has followed. So the current keep-times stand, but the design is openly unsettled. Third, the exception in the security network law that allows equipment abroad 'where operationally necessary' has no published threshold. Fourth, at European level the United States transfer route is under formal review. The European Data Protection Board wrote to the Commission about it on 31 July 2026. Suspending it would hit Finnish exporters immediately. We did not confirm where the public-sector fines bill stood in parliament on 18 August 2026. Treat it as proposed, not as law.