--- title: "Finland Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/finland/ source_html: /jurisdictions/finland/index.html description: "Finland data protection and privacy regulation: 10 categories, 66 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: a8fd0b7445e72e793ab8f4cff1f8b710cd8d24f206e662dd65e1833f49b94df1 generator: "fe-fleet/md-twin@1.0" --- # Finland Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Finland Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/finland/), [World Payments](https://payments.gi/jurisdictions/finland/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 66 claims · 36 sources in the cumulative register Download report (PDF) Expand all Finland's data protection enforcement environment tightened materially this cycle, anchored by the Supreme Administrative Court's June 2026 affirmance of a fine of approximately 795,000 euro against Verkkokauppa.com for failing to define a data storage period for online-purchase data. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Sectoral Watch, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=FINLAND)[Build Report](/reports/?j=FINLAND)[Compare](/compare/?j=FINLAND) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2026-Q4 HE 46/2026 vp public-sector-fines amendment Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 66 Claims 8 Tier-1 sources Traffic-light mix 5 green 5 amber (sums to 10 rendered categories; click to filter) No red categories; 11 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Finland is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Finland’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction lead brief ###### Latest update · 25 October 2026 #### Lead Signal Finland's data protection enforcement architecture is in the process of being extended to cover public-sector bodies, a sector that has until now sat outside the reach of administrative fines. A pending Parliamentary proposal, HE 46/2026 vp, would amend the Data Protection Act (1050/2018) and the Act on the Processing of Personal Data in Criminal Matters (1054/2018) to permit administrative fines against public-sector controllers and processors for the first time, with fixed maxima of 500,000 euros or 1,000,000 euros depending on the nature of the infringement. The proposal was submitted to Parliament in April 2026 and its current reading stage has not been established. Under the existing regime, fines are decided by a three-member Sanctions Board comprising the Data Protection Ombudsman and two Deputy Ombudsmen, acting by majority decision, with a statutory ceiling of 20 million euros or four percent of global annual turnover, whichever is higher, for private-sector controllers and processors already within scope. #### Other Developments Active Sanctions Board enforcement continues across sectors. On 13 October 2026, the Sanctions Board fined Plastic Surgery Center Helsinki Oy 20,200 euros for failing to provide a customer's medical records despite an Ombudsman order to do so. This sits alongside the Supreme Administrative Court's June 2026 decision upholding an approximately 795,000 euro fine against Verkkokauppa.com for failing to specify storage periods for customer account data, together indicating that enforcement against both large commercial controllers and smaller specialist providers remains active. National AI Act enforcement layer now in force. The Act on the Supervision of Certain Artificial Intelligence Systems, approved by the President on 22 December 2025 and effective from 1 January 2026, grants Traficom and sectoral authorities investigatory and sanctioning powers in connection with the EU AI Act. A separate Ombudsman order, reported as probable, required an unnamed company operating a loyalty scheme to revise its customer-information policies after it was found not to disclose automated decision-making or profiling performed within that scheme, illustrating how algorithmic-governance questions are surfacing within standing data protection oversight even as the dedicated AI Act enforcement layer beds in. #### Cross-Monitor Connections The pending public-sector fines reform and the active enforcement record against both large and small private controllers have no immediate cross-sectoral financial-crime or payments dimension identified, so no link-out to financial-integrity or world-payments tracking is warranted at this stage. The national AI Act enforcement layer, however, intersects with algorithmic governance questions that a reader tracking artificial-intelligence regulatory developments more broadly would want to be aware of, given Traficom's new investigatory and sanctioning role running in parallel with the EU AI Act's own high-risk obligations. #### Outlook The reading stage and likely timeline of HE 46/2026 vp remain the central item to watch: if enacted, it would for the first time expose public-sector controllers and processors to administrative fines of up to 500,000 or 1,000,000 euros, materially extending the Sanctions Board's reach beyond its current private-sector scope. Alongside that legislative track, continued Sanctions Board activity against both large commercial entities and smaller specialist providers suggests enforcement intensity is unlikely to ease in the near term, and the interaction between the national AI Act enforcement layer and existing profiling-related Ombudsman oversight is a further area where the regulatory picture may sharpen as more decisions emerge. 3 earlier updates not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Finland's data protection enforcement environment tightened materially this cycle, anchored by the Supreme Administrative Court's June 2026 affirmance of a fine of approximately 795,000 euro against Verkkokauppa.com for failing to define a data storage period for online-purchase data. Confirmed at the level of Finland's highest administrative court, the fine converts what had been an administrative-level enforcement position into a durable judicial precedent on retention-period compliance. The case matters beyond its size because it establishes that failure to define a retention period is treated as a chargeable violation with real financial consequence, not merely a documentation gap, and it is understood to sit alongside a broader escalation in Finnish enforcement activity across multiple modules this cycle. #### Other Developments A financial-sector security fine. The Data Protection Ombudsman fined Aktia Bank Plc approximately 865,000 euro for a security flaw, under GDPR Article 32, in its electronic identification service. The fine is a material controller/processor-duties enforcement event, and its size relative to the Suomen Numerokeskus fine below suggests Finnish enforcement calibrates penalty severity to the sensitivity of the underlying processing. A cross-border transfer finding. The Data Protection Ombudsman found insufficient protection of personal data in Finnish government cloud services, particularly data transferred to the United States. This is an active-scrutiny signal that persists despite the continued operation of the EU-US Data Privacy Framework, suggesting that adequacy-mechanism coverage at the framework level does not, in the regulator's assessment, eliminate the need for adequate transfer-impact-assessment practice at the level of individual public-sector cloud deployments. A modest access-right fine. The Ombudsman fined Suomen Numerokeskus 5,000 euro for failing to provide access to call recordings, a violation of GDPR Articles 15(1) and 15(3). Though modest in size, the fine is a further data-subject-rights enforcement data point this cycle, reinforcing that access-right failures are a live enforcement category alongside the larger security and retention cases above. Regulator powers expansion. Finland has proposed legislation strengthening the EU Data Act that grants Traficom supervisory powers and sanctioning authority, effective 1 January 2026, expected to run concurrently with the Data Protection Ombudsman's existing competence. This is enacted-not-yet-effective legislation as of this cycle, and its practical delineation from the Ombudsman's remit is not yet detailed in available evidence. Direct-marketing guidance. The Data Protection Ombudsman updated its FAQs on direct marketing, emphasising information disclosure and the honouring of opt-out requests. This is a guidance-level update rather than a binding rule change, and should be read as clarifying existing obligations rather than introducing new ones. #### Cross-Monitor Connections The government-cloud transfer finding touches on cross-border data-flow architecture also of interest to the world-payments and financial-integrity monitors, insofar as public-sector cloud dependency on United States providers intersects with broader questions of jurisdictional data control; readers tracking those monitors should treat this as a related but separately analysed signal, not a re-analysis performed here. The Traficom powers expansion sits adjacent to the crypto monitor's supervisory-architecture tracking given Traficom's broader digital-infrastructure remit, though no crypto-specific finding is asserted from this cycle's evidence, and this brief does not extend its analysis into that domain. #### Outlook Finland's enforcement trajectory is escalating rather than stabilising: the Supreme Administrative Court's affirmance of the Verkkokauppa.com fine, read together with the Aktia Bank security fine and the Suomen Numerokeskus access-right fine, signals a durable pattern of enforcement spanning retention-period, security-of-processing and access-right failures within a single cycle. The Traficom powers expansion, effective 1 January 2026, is worth watching for how concurrent competence between Traficom and the Ombudsman is delineated in practice once the provisions take effect. The government-cloud US-transfer finding also bears watching for whether it prompts a broader transfer-impact-assessment review across the Finnish public sector, given that the finding was made despite the continued operation of the EU-US Data Privacy Framework. Read full brief · 1190 words Key regulatory facts for Finland Regulatory Dimension Finland Standing Position Jurisdiction Finland (FI) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 66 sourced findings) Regulator & Framework Comprehensive, mature GDPR-aligned omnibus framework with an active, resourced supervisory authority and clear national implementing act. Lawful Processing & Special Data GDPR Art 6/9 lawful bases apply directly; national supplementary safeguards for sensitive data are documented and enforced. Data Subject Rights GDPR rights framework applies directly and is actively enforced by the Ombudsman across access, objection and transparency dimensions. Controller/Processor Duties Core GDPR accountability, DPIA, security and breach duties apply directly and are actively enforced with multiple recent fines. Primary Instruments Cited DataGuidance, EDPB, INPLP, Tietosuojavaltuutetun toimisto, Office of the Data Protection Ombudsman Last Confirmed / Updated 2026-10-25 (36 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Finland: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive, mature GDPR-aligned omnibus framework with an active, resourced supervisory authority and clear national implementing act. Primary framework GDPR (Regulation (EU) 2016/679) as supplemented by the Data Protection Act (1050/2018) Supervisory authority [Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)](https://tietosuoja.fi/en/) Traffic-light rationale — Green Comprehensive, mature GDPR-aligned omnibus framework with an active, resourced supervisory authority and clear national implementing act. #### Sub-modules (5) #### Regulator And AuthorityGreen The Office of the Data Protection Ombudsman acts as Finland's sole GDPR supervisory authority, including a sanctions board that issues administrative fines and reprimands. Claims (4): - The Office of the Data Protection Ombudsman acts as the Finnish supervisory authority for GDPR and its supplementing national legislation. - Sanctions Board, Office of the Data Protection Ombudsman — Administrative fines under GDPR Article 83 are decided by a three-member Sanctions Board (the Ombudsman and two Deputy Ombudsmen), by majority decision. - Finland has proposed legislation to strengthen the EU Data Act, granting Traficom supervisory powers and sanctioning authority, effective 1 January 2026. - Data Protection Ombudsman / Sanctions Board — The Data Protection Ombudsman and deputy ombudsmen form the Sanctions Board tasked with imposing GDPR administrative fines, distinct from the Ombudsman's own investigative function. #### Act And InstrumentsGreen The Data Protection Act (1050/2018) supplements the GDPR nationally; related sectoral amendments cover working-life privacy, the Criminal Code, and fines enforcement. Claims (4): - Finland implemented the GDPR through the Data Protection Act (1050/2018), which entered into force on 1 January 2019 and repealed the Personal Data Act (523/1999). - GDPR implementation in Finland led to consequential amendments in sectoral legislation, including the Act on the Protection of Privacy in Working Life (759/2004, amended 2019), the Criminal Code, the Act on Enforcement of Fines, and the Act on the Grey Economy Information Unit. - HE 46/2026 vp — Amending the Data Protection Act (1050/2018) and the Act on the Processing of Personal Data in Criminal Matters (1054/2018) to permit administrative fines against public-sector controllers/processors, with fixed maxima of EUR 500,000 or EUR 1,000,000 depending on the infringement. - Finland implements the GDPR nationally through the Data Protection Act (Tietosuojalaki 1050/2018). #### Material ScopeGreen Material scope tracks GDPR Article 2/4 definitions of personal data and processing directly, with no identified Finnish derogation narrowing scope. #### Territorial ScopeAmber Territorial scope follows GDPR Article 3 (establishment and targeting tests) directly; no Finland-specific extension or carve-out was identified in this research pass. #### Regulator Registration And FilingAmber No general controller registration/notification regime exists (abolished EU-wide by GDPR), but Section 31(3) of the Data Protection Act requires controllers processing special-category or criminal-offence data to submit a DPIA in writing to the Ombudsman at least 30 days before processing begins, unless an approved code of conduct is followed instead. Claims (1): - Under Section 31(3) of the Data Protection Act, controllers processing special categories of personal data or criminal-offence data must either submit a written DPIA to the Ombudsman 30 days prior to processing, or comply with an approved code of conduct under Section 31(1) as an alternative safeguard. Finland is an EU Member State operating under the directly-applicable GDPR, nationally supplemented by the Data Protection Act (1050/2018), which entered into force 1 January 2019 and repealed the earlier Personal Data Act (523/1999). The Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) is the sole national supervisory authority for GDPR and its supplementing legislation, including a dedicated sanctions board empowered to impose administrative fines. Periodic update · new data 2026-10-25 #### Regulator & Framework Finland's data protection enforcement architecture is on the verge of a structural extension. Administrative fines under GDPR Article 83 are decided by a three-member Sanctions Board, comprising the Data Protection Ombudsman and two Deputy Ombudsmen, acting by majority decision. That Board's jurisdiction has to date covered only private-sector controllers and processors; public authorities have remained outside the reach of administrative fines since the General Data Protection Regulation took effect in Finland on 25 May 2018. A pending Parliamentary proposal, HE 46/2026 vp, would change that. It would amend the Data Protection Act (1050/2018) and the Act on the Processing of Personal Data in Criminal Matters (1054/2018) to permit, for the first time, administrative fines against public-sector controllers and processors, with fixed statutory maxima of 500,000 euros or 1,000,000 euros depending on the category of infringement. The proposal was submitted to Parliament in April 2026, and its current reading stage has not been established as of this period. If enacted, it would be a long-awaited shift away from the public sector's historical exemption from the Sanctions Board's fining power, bringing Finland's enforcement architecture closer in line with the full scope the GDPR permits Member States to apply. In the meantime, the existing private-sector maximum remains the standard GDPR ceiling: 20 million euros or four percent of global annual turnover, whichever is higher, imposed by the same three-member Sanctions Board. That ceiling and the Board's decision-making structure are unaffected by the pending reform, which is additive rather than a replacement of the existing mechanism. #### Outlook The principal item to watch is the progress of HE 46/2026 vp through Parliament: its current reading stage is not yet established, and its eventual passage would be the first extension of administrative-fine exposure to Finnish public authorities since the GDPR took domestic effect. Until enacted, the public sector remains outside the Sanctions Board's fining jurisdiction, even as enforcement against private-sector controllers continues at pace under the existing framework. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (9) - [DataGuidance](https://www.dataguidance.com/jurisdictions/finland) — The Office of the Data Protection Ombudsman acts as the Finnish supervisory authority for GDPR and its supplementing national legislation. - [DataGuidance](https://www.dataguidance.com/jurisdictions/finland) — Finland implemented the GDPR through the Data Protection Act (1050/2018), which entered into force on 1 January 2019 and repealed the Personal Data Act (523/1999). - [DataGuidance](https://www.dataguidance.com/jurisdictions/finland) — GDPR implementation in Finland led to consequential amendments in sectoral legislation, including the Act on the Protection of Privacy in Working Life (759/2004, amended 2019), the Criminal Code, the Act on Enforcement of Fines, and the Act on the Grey Economy Information Unit. - [EDPB](https://www.edpb.europa.eu/system/files/2022-01/legalstudy_on_the_appropriate_safeguards_89.1.pdf) — Under Section 31(3) of the Data Protection Act, controllers processing special categories of personal data or criminal-offence data must either submit a written DPIA to the Ombudsman 30 days prior to processing, or comply with an approved code of conduct under Section 31(1) as an alternative safeguard. - [INPLP](https://www.inplp.com/publications/finland-extends-gdpr-fines-to-public-authorities-a-long-awaited-shift-in-enforcement) — HE 46/2026 vp — Amending the Data Protection Act (1050/2018) and the Act on the Processing of Personal Data in Criminal Matters (1054/2018) to permit administrative fines against public-sector controllers/processors, with fixed maxima of EUR 500,000 or EUR 1,000,000 depending on the infringement. - [Tietosuojavaltuutetun toimisto](https://tietosuoja.fi/en/-/administrative-fine-imposed-on-posti-for-data-protection-shortcomings-in-the-omaposti-service?languageId=fi_FI) — Sanctions Board, Office of the Data Protection Ombudsman — Administrative fines under GDPR Article 83 are decided by a three-member Sanctions Board (the Ombudsman and two Deputy Ombudsmen), by majority decision. - [DataGuidance](https://www.dataguidance.com/jurisdictions/finland) — Finland has proposed legislation to strengthen the EU Data Act, granting Traficom supervisory powers and sanctioning authority, effective 1 January 2026. - [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/office-of-the-data-protection-ombudsman) — Data Protection Ombudsman / Sanctions Board — The Data Protection Ombudsman and deputy ombudsmen form the Sanctions Board tasked with imposing GDPR administrative fines, distinct from the Ombudsman's own investigative function. - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=authority&c=FI) — Finland implements the GDPR nationally through the Data Protection Act (Tietosuojalaki 1050/2018). ### Finland: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ GDPR Art 6/9 lawful bases apply directly; national supplementary safeguards for sensitive data are documented and enforced. Primary framework GDPR Articles 6, 7, 9 as supplemented by Data Protection Act (1050/2018) Section 31 Supervisory authority [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/) Traffic-light rationale — Green GDPR Art 6/9 lawful bases apply directly; national supplementary safeguards for sensitive data are documented and enforced. D2 · Lawful Processing — Full Module Record 4 sub-modules · 51 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Finland: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ GDPR rights framework applies directly and is actively enforced by the Ombudsman across access, objection and transparency dimensions. Primary framework GDPR Articles 12-22 Supervisory authority [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/) Traffic-light rationale — Green GDPR rights framework applies directly and is actively enforced by the Ombudsman across access, objection and transparency dimensions. #### Sub-modules (5) #### Access RightAmber The Ombudsman actively enforces Article 15 access rights; a company was fined for failing to provide access to call recordings. Claims (2): - The Ombudsman fined Suomen Numerokeskus €5,000 for failing to provide data subjects access to call recordings, in violation of GDPR Articles 15(1) and 15(3). - Data Protection Ombudsman — Fined Suomen Numerokeskus €5,000 for failing to provide access to call recordings, violating GDPR Articles 15(1) and 15(3). #### Rectification And ErasureGreen Rectification/erasure follow GDPR Art 16/17 directly; Finland's Ombudsman participates in EDPB coordinated work on erasure implementation challenges. Claims (1): - The EDPB's 2025 Coordinated Enforcement Framework (CEF) report, in which the Finnish Ombudsman participates as a national SA, identifies challenges and best practices in implementing the GDPR right to erasure. #### Restriction And ObjectionAmber Enforcement action against Posti Oy found the company failed to properly inform customers of their right to object to disclosure of personal data collected via change-of-address notifications. Claims (1): - The Ombudsman found that Posti Oy failed to inform data subjects of their right to object to disclosure of their personal data in connection with change-of-address notifications, resulting in a €100,000 administrative fine affecting 161,000 customers in 2019 alone. #### Data PortabilityAmber Portability rights follow GDPR Art 20 directly; no Finland-specific enforcement or derogation was identified in this pass. #### Deadlines And Response WindowsGreen Statutory response deadlines follow GDPR Art 12(3) (one month, extendable by two further months for complex requests) directly, with no Finnish national variation identified. Finland applies the GDPR Chapter III data subject rights (Articles 12-22) directly, with no material national derogation identified. Enforcement activity demonstrates active policing of the access right, the right to object, and transparency obligations connected to profiling. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (4) - [DataGuidance](https://www.dataguidance.com/jurisdictions/finland) — The Ombudsman fined Suomen Numerokeskus €5,000 for failing to provide data subjects access to call recordings, in violation of GDPR Articles 15(1) and 15(3). - [DataGuidance](https://www.dataguidance.com/jurisdictions/finland) — The EDPB's 2025 Coordinated Enforcement Framework (CEF) report, in which the Finnish Ombudsman participates as a national SA, identifies challenges and best practices in implementing the GDPR right to erasure. - [EDPB](https://www.edpb.europa.eu/news/national-news/2020/finnish-dpa-imposed-three-administrative-fines-data-protection-violations_en) — The Ombudsman found that Posti Oy failed to inform data subjects of their right to object to disclosure of their personal data in connection with change-of-address notifications, resulting in a €100,000 administrative fine affecting 161,000 customers in 2019 alone. - [DataGuidance](https://www.dataguidance.com/jurisdictions/finland) — Data Protection Ombudsman — Fined Suomen Numerokeskus €5,000 for failing to provide access to call recordings, violating GDPR Articles 15(1) and 15(3). ### Finland: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core GDPR accountability, DPIA, security and breach duties apply directly and are actively enforced with multiple recent fines. Primary framework GDPR Articles 24-39 as supplemented by Data Protection Act (1050/2018) Supervisory authority [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/) Traffic-light rationale — Green Core GDPR accountability, DPIA, security and breach duties apply directly and are actively enforced with multiple recent fines. Periodic update · new data 2026-10-11 #### Controller/Processor Duties Finland's Sanctions Board, the body within the Office of the Data Protection Ombudsman holding sole competence under section 24 of the Data Protection Act to impose GDPR Article 83 administrative fines, imposed a EUR33,000 administrative fine and reprimand on Mindemo Oy on 8 October 2026. Mindemo, a health-adjacent booking service formerly operating under the name Heltti Oy, was found to have serious deficiencies in the secure processing of appointment-related data. The data at issue included appointment start and confirmation details and the name of the selected therapist, which were transmitted to Google, Meta and Microsoft through tracking tools over a period running from April 2024 to May 2025. The decision frames the failure as a security-of-processing issue: the deficiency lies not in the existence of a lawful basis for the underlying appointment-booking activity but in the absence of adequate technical and organisational safeguards preventing sensitive, health-adjacent scheduling data from flowing to third-party advertising and analytics platforms through embedded tracking tools. The fact that the data concerned therapist selection and appointment confirmation for a health-adjacent service elevates the sensitivity of the processing failure beyond a routine cookie-consent question, even though the decision is also separately relevant to adtech-specific scrutiny of the tracking mechanism itself. Mindemo has stated that it has since removed the tracking tools responsible for the transmission and has requested deletion of the data already transmitted to Google, Meta and Microsoft from those platforms. This remediation step was noted but did not prevent the Sanctions Board from proceeding to a fine and reprimand, indicating that post-hoc remediation does not retroactively cure a security-of-processing failure that persisted for over a year. The structural architecture underlying this decision is the standing Sanctions Board competence confirmed via Finland's primary rules of procedure: the Ombudsman and Deputy Ombudsmen together constitute the Sanctions Board for Article 83 fines and for Article 58(2)(f) and (j) restriction, processing-ban and transfer-suspension measures, while the Ombudsman alone retains other corrective powers. This decision was therefore issued through the Sanctions Board's dedicated fining competence rather than through the Ombudsman's general supervisory powers. #### Outlook The Mindemo decision, falling within the current recency window, signals that security-of-processing obligations connected to third-party tracking integrations remain a live area of Sanctions Board scrutiny, particularly where the underlying data concerns health-adjacent services. Whether further controller/processor duty decisions follow against comparable health-adjacent or booking-platform operators in Finland is not yet established from this cycle's material, and the remediation steps taken by Mindemo, including tool removal and deletion requests to recipient platforms, have not been reported to have altered the fine outcome. Periodic update · new data 2026-09-28 #### Controller/Processor Duties The Supreme Administrative Court's June 2026 confirmation of the roughly EUR 795,000 fine against retailer Verkkokauppa.com closes the appeal cycle on one of Finland's most significant controller-accountability enforcement actions. The fine was upheld against both the Administrative Court's and the Sanctions Board's original decisions, for the retailer's failure to define a data-retention period for online-purchase data — a straightforward accountability and storage-limitation finding that the courts have now fully endorsed on appeal. Separately, following the KHO:2023:82 ruling, a more restrictive development is understood to be developing in how controllers respond to Ombudsman information requests, given a tension identified between accountability obligations and the privilege against self-incrimination. This is not yet a settled doctrine but a case-law-driven pressure point that controllers facing Ombudsman inquiries should watch, since it may reshape the practical scope of cooperation duties during investigations. The number of cases initiated annually at the Office of the Data Protection Ombudsman is understood to have grown to exceed 13,000, including a rising volume of breach notifications, which points to an increasingly active supervisory caseload against which controller-processor compliance will be tested. #### Outlook The Verkkokauppa.com precedent is likely to sharpen retention-period practices across Finnish e-commerce controllers going forward. The KHO:2023:82 tension over information-request compliance remains to be resolved in practice, and how the Ombudsman calibrates its investigative approach in light of it is a matter to watch closely. D4 · Controller & Processor — Full Module Record 7 sub-modules · 53 words · 10 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Finland: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ EU-level transfer mechanisms apply directly, but active Ombudsman scrutiny of US cloud transfers signals unresolved TIA/localisation risk for government and public-sector data flows. Primary framework GDPR Articles 44-49 (Chapter V) Supervisory authority [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/) Traffic-light rationale — Amber EU-level transfer mechanisms apply directly, but active Ombudsman scrutiny of US cloud transfers signals unresolved TIA/localisation risk for government and public-sector data flows. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 69 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Finland: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Multiple active sectoral overlays (financial, health, employment, credit) show real enforcement friction with the general GDPR regime, though no sector operates fully outside GDPR. Primary framework GDPR supplemented by sector laws: Act on the Protection of Privacy in Working Life (759/2004); Credit Information Act; FIN-FSA supervisory framework Supervisory authority [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/) Traffic-light rationale — Amber Multiple active sectoral overlays (financial, health, employment, credit) show real enforcement friction with the general GDPR regime, though no sector operates fully outside GDPR. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 74 words · 9 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Finland: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct-marketing and consent-quality enforcement is active, but several sub-modules (dark patterns, opt-out signals, clean rooms) show no Finland-specific evidentiary record. Primary framework ePrivacy Directive (2002/58/EC) and GDPR consent framework Supervisory authority [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/) Traffic-light rationale — Amber Direct-marketing and consent-quality enforcement is active, but several sub-modules (dark patterns, opt-out signals, clean rooms) show no Finland-specific evidentiary record. Periodic update · new data 2026-10-18 #### AdTech & Commercial Privacy The Sanctions Board of the Office of the Data Protection Ombudsman imposed a EUR 33,000 administrative fine on Mindemo Oy, published 8 October 2026, for introducing cookies and tracking tools into its online health-appointment booking service without sufficient risk assessment or protective measures. The decision found that health-related data was transmitted to tracking-service providers for at least a year as a result. Mindemo Oy was formerly known as Heltti Oy. This is a cookies-and-trackers finding concerning a service handling special-category health data, which heightens the significance of the risk-assessment failure identified. The decision reflects the Sanctions Board's willingness to impose administrative fines where a controller introduces third-party tracking technology into a service touching health data without conducting an adequate risk assessment of that integration beforehand, and without implementing protective measures proportionate to the sensitivity of the data being transmitted as a result. #### Outlook The Mindemo Oy decision sets a reference point for how the Sanctions Board assesses cookie and tracker deployments in services touching special-category data. Whether further AdTech-sector decisions follow in the near term, and whether the Board's approach extends to services outside the health sector, remains to be observed. Periodic update · new data 2026-10-11 #### AdTech & Commercial Privacy Finland's Sanctions Board fined Mindemo Oy EUR33,000 on 8 October 2026 for transmitting appointment-related data, including appointment start and confirmation details and the selected therapist's name, to Google, Meta and Microsoft via cookies and tracking tools embedded in its health-adjacent booking service. The transmission occurred over a period of at least a year, between April 2024 and May 2025, meaning the tracking integration operated continuously across multiple booking cycles before the deficiency was addressed. The adtech dimension of this decision concerns the mechanism of data transmission rather than the underlying data-processing purpose: cookies and tracking tools integrated into the booking flow sent appointment and therapist-selection data to three major advertising and analytics platforms as a byproduct of standard web-tracking configurations, rather than through any deliberate direct-marketing use of the data by Mindemo itself. This is a now-familiar typology in Finnish enforcement practice, where health-adjacent or otherwise sensitive booking and scheduling services deploy third-party tracking tools without adequately isolating sensitive categories of data from advertising-platform pixels and scripts. Mindemo has stated it has since removed the tracking tools responsible for the transmission and has requested that Google, Meta and Microsoft delete the data already received. The Sanctions Board proceeded to a fine and reprimand notwithstanding this remediation, indicating that the adtech-and-commercial-privacy failure, once it had occurred and persisted for the duration described, was treated as a completed infringement rather than one cured by subsequent tool removal. The fine amount, EUR33,000, is moderate in scale relative to some other enforcement actions reported this cycle, but the Sanctions Board's choice to combine a monetary fine with a formal reprimand indicates the Board treated the duration and sensitivity of the data at issue, appointment and therapist-selection information tied to a health-adjacent service, as aggravating factors within the adtech-and-commercial-privacy assessment. #### Outlook The Mindemo decision reinforces a continuing Sanctions Board focus on cookie and tracking-tool configurations in sectors handling health-adjacent or otherwise sensitive booking data, an area where commercial tracking infrastructure and sensitive personal data intersect without always being separately risk-assessed by controllers. Future adtech-and-commercial-privacy enforcement in Finland may continue to target this intersection, particularly where tracking tools are deployed by default across booking platforms without sector-specific data-sensitivity review, though no further dated action in this specific area has surfaced this cycle beyond the Mindemo decision itself. Periodic update · new data 2026-09-28 #### AdTech & Commercial Privacy The Office of the Data Protection Ombudsman is understood to have updated its FAQs on direct marketing, emphasising information-disclosure duties toward data subjects and the obligation to honour opt-out requests. This is non-binding guidance rather than a change in binding legal obligation, but it signals where the Ombudsman's current supervisory attention within commercial-privacy practice is directed. #### Outlook As non-binding guidance, this FAQ update does not itself create new enforcement exposure, but organisations engaged in direct marketing to Finnish data subjects should note the Ombudsman's emphasis on disclosure and opt-out handling as an indicator of likely supervisory focus areas going forward. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 67 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Finland: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ AI Act national implementation is newly in force and institutionally still bedding in (organisational reform ongoing), while ADM/profiling enforcement is active but biometric/genetic/surveillance sub-modules lack dedicated national instruments. Primary framework GDPR Article 22; EU AI Act as nationally implemented in Finland (effective 1 January 2026) Supervisory authority [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/) Traffic-light rationale — Amber AI Act national implementation is newly in force and institutionally still bedding in (organisational reform ongoing), while ADM/profiling enforcement is active but biometric/genetic/surveillance sub-modules lack dedicated national instruments. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance Finland's algorithmic-governance landscape now operates across two layers: the longstanding data protection framework applied by the Office of the Data Protection Ombudsman, and a dedicated national AI Act enforcement layer that came into force at the start of this year. The Act on the Supervision of Certain Artificial Intelligence Systems, approved by the President on 22 December 2025, took effect on 1 January 2026, granting Traficom and relevant sectoral authorities investigatory and sanctioning powers in connection with the EU AI Act. This gives Finland a designated domestic enforcement structure for AI Act obligations, running alongside the EU regulation's own compliance timeline. Within the data protection framework proper, the Deputy Data Protection Ombudsman has ordered a company operating a customer loyalty scheme to change its customer-information policies after finding that the policy did not disclose the automated decision-making and profiling the scheme actually performed. This is a profiling-transparency enforcement action under the existing GDPR framework rather than an AI Act matter, but it illustrates the kind of algorithmic-governance question Finnish authorities are actively willing to intervene on: not the underlying use of automated decision-making itself, but the adequacy of disclosure to the individuals affected by it. Together, these two threads, the new AI Act enforcement layer at Traficom and continuing profiling-disclosure enforcement at the Ombudsman, indicate that algorithmic governance in Finland is becoming a genuinely dual-track oversight area, with sectoral and data protection authorities each exercising powers relevant to automated systems. #### Outlook How Traficom's new investigatory and sanctioning powers under the national AI Act enforcement layer interact in practice with the Ombudsman's existing profiling-transparency enforcement is the area to watch, particularly as more AI Act compliance deadlines are reached and as further Ombudsman decisions on automated decision-making and profiling emerge. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 101 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Finland: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The GDPR Art 8 framework is confirmed, but the Finland-specific age figure and children's-project substance require primary-source confirmation; education/dependent-adult sub-modules show no evidentiary record. Primary framework GDPR Article 8, as fixed nationally by the Data Protection Act (1050/2018) Supervisory authority [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/) Traffic-light rationale — Amber The GDPR Art 8 framework is confirmed, but the Finland-specific age figure and children's-project substance require primary-source confirmation; education/dependent-adult sub-modules show no evidentiary record. D9 · Children's Privacy — Full Module Record 5 sub-modules · 87 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Finland: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Active, escalating enforcement record with full GDPR corrective/fining powers and judicial appeal route in place; regulator funding/headcount data and collective-redress implementation detail remain unconfirmed. Primary framework GDPR Articles 58, 77-84, as supplemented by the Data Protection Act (1050/2018) Supervisory authority [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/) Traffic-light rationale — Green Active, escalating enforcement record with full GDPR corrective/fining powers and judicial appeal route in place; regulator funding/headcount data and collective-redress implementation detail remain unconfirmed. Periodic update · new data 2026-10-25 #### Enforcement & Redress Finland's Sanctions Board continued active enforcement across sectors this period. On 13 October 2026, the Board fined Plastic Surgery Center Helsinki Oy 20,200 euros for failing to provide a customer's medical records despite an existing Ombudsman order requiring it to do so, illustrating that enforcement reaches both large commercial controllers and smaller specialist healthcare-adjacent providers. This sits alongside the Supreme Administrative Court's June 2026 decision upholding an administrative fine of approximately 795,000 euros against Verkkokauppa.com for failing to specify storage periods for customer account data, a decision that confirms judicial backing for the Sanctions Board's reasoning on data-retention transparency even when a fined company seeks court review. Taken together with the leading breach-notification precedent against Aktia Bank Plc, fined approximately 865,000 euros for a security flaw under GDPR Article 32 that exposed other customers' health and financial data to around 350 people, the current enforcement record spans retention practices, security obligations, and data-subject access failures, indicating a broad and active enforcement posture rather than concentration on any single type of infringement. This enforcement intensity is set against the backdrop of the pending HE 46/2026 vp reform, which would for the first time extend the Sanctions Board's fining power to public-sector controllers and processors, with statutory maxima of 500,000 or 1,000,000 euros. Enforcement and redress against public authorities currently remains limited to non-monetary remedies, since administrative fines are not yet available against that sector. #### Outlook Continued enforcement activity against both large commercial controllers and smaller specialist providers suggests the Sanctions Board's enforcement intensity is unlikely to ease in the near term. The passage of HE 46/2026 vp, whenever it occurs, would be the next structural shift to watch, since it would extend fining power to the public sector for the first time and materially broaden the population of entities exposed to administrative sanction under the Finnish GDPR regime. Periodic update · new data 2026-10-18 #### Enforcement & Redress The Sanctions Board of the Office of the Data Protection Ombudsman imposed a EUR 20,200 administrative fine on Plastic Surgery Center Helsinki Oy, published 13 October 2026, for knowingly failing to comply with an earlier order from the Ombudsman's office, issued in June 2026, which had required the company to provide a client access to their patient data within two months. The company did not appeal the underlying access order. The fine was therefore imposed not for the original access-rights failure itself but for the company's knowing non-compliance with the Ombudsman's subsequent corrective order. This sequencing, an unappealed investigatory order followed by a separate Sanctions Board fine for non-compliance with that order, illustrates the institutional division in Finland's enforcement architecture: administrative fines under GDPR Article 83 are decided by the Sanctions Board, composed of the Data Protection Ombudsman and two deputy ombudsmen, distinct from the Ombudsman's own investigatory and corrective-order function. #### Outlook The Plastic Surgery Center Helsinki Oy decision illustrates the consequence of non-compliance with an Ombudsman order once it has become final and unappealed. Whether further enforcement follows against the same controller, or whether this fine resolves the matter, is not established on the current record. Periodic update · new data 2026-10-11 #### Enforcement & Redress Finland's Sanctions Board has maintained an active enforcement tempo across several dated actions surfacing this cycle, spanning adtech-adjacent security failures, access-right non-compliance, and a large cross-border cooperation-procedure fine, alongside a live appeal before the Supreme Administrative Court. On 8 October 2026, the Sanctions Board imposed a EUR33,000 fine and reprimand on Mindemo Oy, a health-adjacent booking service formerly known as Heltti Oy, for serious deficiencies in the secure processing of appointment-related data transmitted to Google, Meta and Microsoft via tracking tools between April 2024 and May 2025. This decision falls within the strict recency window for the current cycle and signals continued scrutiny of health-adjacent service providers' use of third-party tracking integrations. Earlier in the year, on 25 March 2026, the Sanctions Board imposed a EUR5,000 fine on Suomen Numerokeskus Oy for systematically failing to honour customers' right of access to their own recorded customer-service calls. The company had deleted call recordings despite pending access requests from customers, a straightforward access-right enforcement action illustrating continued Board attention to Article 15 compliance in sectors handling recorded customer interactions. On 8 May 2026, a substantially larger fine, EUR100 million, was reportedly issued against MLU B.V., operating as Yango, for unlawful transfer of Finnish and other users' personal data to Russia. This fine was issued through the EU data protection authorities' cooperation procedure under GDPR Articles 60 to 66, reflecting cross-border coordination among EU supervisory authorities rather than a purely domestic Finnish enforcement action. The lead authority for this decision, and the extent of the Finnish Ombudsman's role as lead or concerned authority, has not been confirmed this cycle, leaving open the question of how directly this result should be attributed to Finnish enforcement activity as opposed to the broader EU cooperation mechanism. Separately, the redress side of Finland's enforcement architecture saw a significant procedural development on 12 June 2026, when the Supreme Administrative Court granted Verkkokauppa.com Oyj leave to appeal against a 6 March 2024 Sanctions Board decision. That underlying decision had imposed a fine, reported elsewhere as EUR856,000, under GDPR Articles 58(2)(i) and 83 over undefined personal-data retention periods for online-store customer accounts. The Court declined the Ombudsman's request to refer the matter to the Court of Justice of the European Union for a preliminary ruling, meaning the appeal will proceed on national law grounds. The underlying fine remains unresolved while the appeal is live. #### Outlook The Verkkokauppa.com Oyj appeal is the most consequential open item in Finland's enforcement and redress landscape: its outcome will determine whether a multi-hundred-thousand-euro fine over data-retention-period practices for online-store customer accounts is upheld, reduced or overturned, and the Court's decision not to seek a CJEU preliminary ruling means the result will turn on the Supreme Administrative Court's own interpretation of national and EU retention-period requirements. Confirmation of the lead-authority question for the MLU B.V. (Yango) fine would clarify how much of that EUR100 million action should be read as a Finnish enforcement outcome as opposed to a cooperation-procedure result led by another EU authority. Taken together, the dated actions this cycle indicate the Sanctions Board is sustaining enforcement activity across multiple sectors and failure types simultaneously, from adtech-adjacent security lapses to access-right non-compliance to large-scale cross-border transfer violations. Periodic update · new data 2026-09-28 #### Enforcement & Redress Finland's enforcement posture escalated materially this cycle on multiple fronts. The Supreme Administrative Court upheld the approximately EUR 795,000 fine against retailer Verkkokauppa.com in June 2026, confirming the Sanctions Board's and Administrative Court's original decisions for the retailer's failure to define a data-retention period. This is the clearest and most significant confirmed enforcement outcome of the cycle. The Sanctions Board, composed of the Data Protection Ombudsman and deputy ombudsmen, retains the power to impose fines of up to EUR 10 million or 2 percent of worldwide annual turnover for certain violations, and up to EUR 20 million or 4 percent for more serious infringements, the standard GDPR fining tiers as applied in Finland. 2024 fines from the Office of the Data Protection Ombudsman reached a new annual high of EUR 2.4 million, the largest total to date in Finland, and the Ombudsman is expected to participate in the 2026 EDPB Coordinated Enforcement Framework. Most significantly for the forward enforcement landscape, the Government submitted proposal HE 46/2026 vp to Parliament in April 2026 to amend the Data Protection Act so that administrative fines may, for the first time, be imposed on public-sector controllers and processors, a category of entity previously immune from monetary GDPR penalties in Finland. #### Outlook Whether HE 46/2026 vp is enacted remains the single most consequential open question for Finland's enforcement architecture; its passage would close a longstanding public-sector accountability gap. Combined with the record 2024 fine total and the confirmed Verkkokauppa.com appellate outcome, the trajectory points toward an increasingly assertive Sanctions Board and Ombudsman over the coming enforcement cycles. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 82 words · 15 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 8 [Children & Vulnerable Groups](#sec-cat-children_and_vulnerable_groups) parental consent Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties