tietosopimus

Tietosopimus is a contract governing the processing of personal data between parties, typically a data controller and a data processor, and sometimes between organizations sharing data. In Finnish practice the term is used to describe arrangements that ensure compliance with data protection laws when personal data is handled by external or internal service providers.

Purpose and scope

The primary purpose of a tietosopimus is to define how personal data may be collected, used, stored, and protected. It clarifies the roles and responsibilities of each party, the purposes of processing, and the types of data and data subjects involved. The agreement also addresses the lifecycle of data, including retention, deletion, and return of data at the end of the contract.

Key provisions

Core elements typically include the purposes and scope of processing, data categories, and data subjects; confidentiality and security measures; use of subprocessors and subcontracting terms; data transfers, including cross-border transfers; duties to assist data subjects in exercising their rights; breach notification procedures and timelines; audit and inspection rights; data retention and deletion or return; liability and indemnities; and governing law and dispute resolution. Many tietosopimukset reference or incorporate elements required by the GDPR or national data protection laws, such as DPIAs for high-risk processing and standard contractual clauses for international transfers.

Relation to law and practice

A tietosopimus helps demonstrate lawful processing, facilitates accountability, and supports data subject rights. It is commonly used in IT outsourcing, cloud services, payroll, HR systems, and any scenario where external entities process personal data on behalf of a controller. Regular review and updates are advised to reflect changes in processing activities or law.