Get an overview of the basics of data protection

Similarly to risk management and information security, data protection is the responsibility of the entire organisation.

The definition is done in accordance with the

• nature
• scope
• context and
• purpose of data processing.

Data protection risks must be assessed as objectively as possible. Based on the assessment, it is determined whether the data processing activities involve a low, medium or high risk.

Data protection risk management differs from traditional risk management because the risks are examined from the perspective of the data subject, that is, the individual. Due to this difference in perspective, the identification of impacts and probabilities, selection of management methods and acceptance of residual risks are also different from traditional risk management.

In order to avoid and minimise risks related to data protection, legislation dictates that the protection of data subjects must be technologically neutral and extend to both automated and manual processing. This means that the management of data protection risks applies to information both in the digital and paper format.

• Read VAHTI network's support material on privacy policies of cloud services (Tietosuoja pilvipalveluissa) (in Finnish, PDF)Opens in a new window.

Read more about the activities of the Data Protection Ombudsman and data protection on the website of the Office of the Data Protection OmbudsmanOpens in a new window..

The data protection officers is an organisation’s internal specialist who monitors the processing of personal data and helps to comply with data protection regulations (Office of the Data Protection Ombudsman).

The data protection officer does not make any privacy statements or agreements themselves, nor are they responsible for data protection. Instead, they are an independent specialist reviewing and commenting on data protection matters.

Read more about the tasks of a data protection officer on the website of the Office of the Data Protection OmbudsmanOpens in a new window..

Personal data refers to all data related to an identified or identifiable natural person (data subject). An identifiable person is a natural person who can be identified directly or indirectly on the basis of specific identifiers. Personal data includes

• name
• personal identity code
• location details
• online identifier.

Data protection requirements, principles and regulation apply to personal data even if personal data does not form a person register.

A person may also be identifiable on the basis of one or more identifiers. These identifiers include characteristics of the person that are

• physical
• physiological
• genetic
• psychological
• financial
• cultural or
• social factors.

A log is a record of events and their causes in chronological order. Events and changes in information systems, applications, information networks and content are recorded in the log, or logged. Devices and operators connected to the internet collect log data.

− National Cyber Security Centre

With the log, the organisation can monitor its data processing and verify what, why and when something happened.

Read the guidelines Collecting and using log data on the website of the National Cyber Security CentreOpens in a new window.. The guidelines are intended for organisations who have competencies in information security.

Any structured set of personal data where information is available on certain grounds. The dataset can be

• centralised
• decentralised or
• distributed on operational or geographical grounds.

The controller means a natural or legal person, public authority, agency or other body that, alone or together with others, determines the purposes and means of the processing of personal data.

Processor of personal data means a natural or legal person, public authority, agency or other body which processes personal data in addition to the controller.

Typically, the processor of personal data is a service provider or an information system supplier that provides services to the controller. Therefore, the processor of personal data does not refer to a representative of the controller who processes personal data as part of their work duties.

Personal data may also have sub-processors who process the data on behalf of the controller’s processor. A typical example is a party providing services to an outsourced service provider. For example, when an organisation has outsourced HR and financial management services to another organisation that purchases its financial management systems from a third organisation.

The purpose of the DPIA is to help identify, assess and manage risks related to the processing of personal data. The impact assessment must be carried out before the processing of personal data begins and updated as necessary.

You can read more about the DPIA on the website of the Office of the Data Protection OmbudsmanOpens in a new window..

• Data protection glossary (European Union)Opens in a new window.