Tietosuoja

Tietosuoja is data protection. If you handle personal data (customer names, emails, employee data, mailing lists, camera footage, online shop orders), the EU GDPR and the Finnish Data Protection Act apply. Company to company data about a legal person is not the same as data about a human being, but invoices and web forms often contain both.

You must have a lawful basis for each use (for example a contract, a legal duty, or consent). You must tell people what you collect and why. You must not keep data longer than needed. If a processor (an accounting firm, an email tool, a web shop platform) handles data for you, you need a written data-processing agreement.

A data protection statement on the website is standard when you collect data online. Some organisations must keep a more detailed processing record. A data protection officer is required only in the cases listed in GDPR, not for every micro-firm.

A personal-data breach that risks people’s rights must be reported to the Office of the Data Protection Ombudsman, as a rule within 72 hours of becoming aware of it, unless the law says the risk is unlikely. The Ombudsman publishes the form and the exceptions.

Open data on Avoindata.fi and statistics from Tilastokeskus are not a licence to publish someone else’s customer list.

Practical advice

List what personal data you hold, where it sits, and who can access it.

Use a processor contract with your accountant and your web-shop provider.

If you send marketing email, follow both GDPR and the Information Society Code rules on direct marketing.

Where to seek advice

The best place to start is Office of the Data Protection Ombudsman: https://tietosuoja.fi/

Guidance for organisations, breach reporting and contact details are on tietosuoja.fi. English material is linked from the same site. This office supervises GDPR in Finland. It does not write your privacy statement for you; a lawyer or your industry association can help with wording if the case is not simple.

All the necessary links

tietosuoja.fi — Ombudsman guidance and breach notification.
eur-lex.europa.eu — GDPR text.
traficom.fi — Direct marketing and cookies where Traficom is competent.
Toimialajärjestöt — Some associations publish model statements.