Data Protection

Key terms in data protection include:

• personal data
• data subject
• data controller
• processor of personal data.

Personal data includes all data related to an identified or identifiable natural person. Personal data may be stored in electronic files, databases, on paper, in cards, in files or in audio or video recordings, among others.

A data subject is the person whom the personal data concerns.

A data controller is a person, company, authority or organisation that defines the purposes and means of the processing of personal data.

A processor of personal data is a party separate from the controller that processes personal data on behalf of the controller.

Core data protection legislation includes:

• the EU General Data Protection
• Regulation (GDPR),
• the Finnish Data Protection Act,
• the Act on the Protection of Privacy in Working Life, andthe Act on the Processing of Personal Data in Criminal Matters.

In addition, there is a significant amount of sector-specific regulation that deals with data protection and the processing of personal data, for example regarding social welfare and healthcare.

Data protection legislation applies to public administration, the private sector, associations and clubs alike. It does not apply to individuals who process personal data for private purposes.