tietosuojaoikeuksiin

Tietosuojaoikeuksiin, or data protection rights, refer to the legal entitlements individuals have under privacy and data protection legislation. In the European Union, these are primarily defined by the General Data Protection Regulation (GDPR), which took effect in May 2018. Finland incorporates the GDPR into its national legal framework through the Personal Data Act, ensuring that citizens can exercise these rights within the country. The rights apply to all processing of personal data carried out by public authorities, private businesses, and other entities that hold or manage individuals' data.

The core rights encompassed by the GDPR and Finnish law are: the right to be informed about data collection and use; the right of access to personal data held by an organization; the right to rectify inaccurate data; the right to have data erased (right to be forgotten); the right to restrict processing in certain circumstances; the right to data portability, allowing individuals to receive their data in a structured format and transfer it to another controller; the right to object to processing, especially for marketing or profiling purposes; and rights related to automated decision-making. Additional rights are granted in specific sectors, such as medical data under the Health Data Act.

Enforcement of these rights is overseen by the Finnish Personal Data Supervision Authority (Tietosuojavaltuutettu). Individuals can lodge complaints if they believe their rights have been violated. Organizations must respond within a month and can face fines for non‑compliance. Because data protection rights empower individuals to control their personal information, they are central to privacy protection and responsible data handling in both the public and private sectors.