When is guardian consent needed for a child’s personal data in Finland?

In brief

In Finland, a child can give consent to the processing of personal data from the age of 13 in one specific situation. The situation is where the processing is based on consent under the General Data Protection Regulation, and the case concerns an information society service offered directly to a child. If the child is under 13 in that situation, consent or authorisation is needed from the person who has parental responsibility. The rule does not mean that guardian consent is always needed whenever an organisation processes a child’s personal data.

Finland’s age limit is 13 in a specific consent situation

The General Data Protection Regulation’s Article 8 sets the child consent rule for services offered directly to a child. The default age in Article 8 is 16. The same article allows Member States to set a lower age for that purpose, but not below 13.

Finland has used that option. Section 5 of the Data Protection Act sets the Finnish age limit at 13. This is the direct answer to the Finnish age-limit question.

The rule applies only when the processing is based on consent under the General Data Protection Regulation’s Article 6(1)(a). In everyday work, this means that the first question is not the child’s age. The first question is the legal basis for the processing.

Personal data means information about an identified or identifiable person under the General Data Protection Regulation’s Article 4. A name, an identifier, location data or an online identifier can be personal data if it can identify a person directly or indirectly. Processing means actions done to that data, such as collecting, storing, using, disclosing, deleting or otherwise handling it.

For more on recognising personal data in daily work, see What is personal data, and when does it stop being personal data?.

Guardian consent is needed only when all conditions are met

Guardian consent is not a general permission slip for every situation involving a child. It is needed under this age rule only when the relevant conditions are all present.

Question for the organisation	Why it matters
Is the data about an identified or identifiable child?	If yes, the General Data Protection Regulation can apply under Article 4.
Is the organisation processing the data?	Collecting, storing, using or deleting data are examples of processing under Article 4.
Is the legal basis consent under Article 6(1)(a)?	Article 8 and section 5 of the Data Protection Act concern this consent-based situation.
Is the service offered directly to a child?	Article 8 is limited to this type of situation.
Is the child under 13 in Finland?	If yes, consent or authorisation must come from the person with parental responsibility.

If the child is at least 13, section 5 of the Data Protection Act says the processing is lawful in that specific consent-based service situation. If the child is under 13, the General Data Protection Regulation’s Article 8 requires consent or authorisation from the person with parental responsibility, but only to the extent covered by that rule.

This matters for municipalities, schools, clubs, online services and companies that handle children’s data. A form that asks for an age does not by itself solve the legal question. The organisation must know why it processes the data, what legal basis it relies on, and whether Article 8 is actually the relevant rule.

Consent is not the same as any permission

The General Data Protection Regulation’s Article 4 defines consent as a freely given, specific, informed and unambiguous expression of the data subject’s wishes. In practical terms, consent is not the same as a general “yes” hidden inside broad terms. It must relate to a specific purpose, and the person must know what they are agreeing to.

Article 6 gives the lawful bases for processing personal data. Consent is only one of them. The others in Article 6 are contract, legal obligation, vital interests, a task carried out in the public interest or in the exercise of official authority, and legitimate interests. The legitimate interests basis does not apply to processing carried out by public authorities in the performance of their tasks.

This is why the choice of legal basis changes the guardian-consent question. If a municipality processes a child’s data because a legal obligation applies, the Article 8 consent age rule is not the reason for processing. If a company relies on consent for a service offered directly to a child, the age rule may become central.

Special categories of personal data need extra care. The General Data Protection Regulation’s Article 9 concerns data revealing matters such as health, biometric data used for identification, or religious belief. Article 9 starts from a prohibition, then lists situations where the prohibition does not apply. Consent may be one of those situations, but Article 9 must be assessed separately from the Article 8 child consent age rule.

For the broader choice of legal basis, see What do the GDPR’s six principles mean at work?.

A child must receive information in an understandable way

Consent cannot be informed if the child does not understand what is happening to the data. The General Data Protection Regulation’s Article 12 requires information to be provided in a concise, transparent, easily understandable and accessible form, using clear and plain language, especially when the information is addressed specifically to a child.

In work terms, this affects privacy notices, forms, registration pages and service messages. The organisation should explain the processing in language the intended child audience can understand. The point is not to simplify the law into slogans. The point is to make the real processing understandable.

The General Data Protection Regulation’s Article 13 lists information to give when personal data is collected from the data subject. This includes the controller’s identity and contact details, the purposes of processing, the legal basis, recipients or recipient groups where relevant, retention time or criteria, rights, and the right to lodge a complaint with a supervisory authority.

Article 14 applies when data is not obtained from the data subject. It also requires information about the purposes and legal basis of processing, the categories of personal data, recipients, retention, rights, and where the data came from. Article 14 sets timing rules, including a latest point of one month after obtaining the personal data, unless a listed exception applies.

Children also have data subject rights. The General Data Protection Regulation’s Articles 15 to 20 cover access, rectification, erasure, restriction, notification of corrections or erasure to recipients, and data portability. For a practical continuation, see Data subject rights: when a customer asks for their data, you have a month.

The controller must check guardian consent reasonably

The General Data Protection Regulation’s Article 8 also gives the controller a verification duty. When guardian consent or authorisation is needed under Article 8, the controller must take reasonable steps to verify that the person with parental responsibility has given it or authorised it. The controller must take available technology into account.

This does not give one universal method. The law in Article 8 speaks of reasonable measures, not a single mandatory tool. The level of checking should therefore be tied to the service, the data, the child’s age, and the practical risk that the consent is not really from the person with parental responsibility.

The controller is the organisation that decides the purposes and means of processing under the General Data Protection Regulation’s Article 4. A processor acts on the controller’s behalf. If the organisation uses another party to process data for it, the controller still needs to understand who decides the purposes and who acts under instructions. For that boundary, see Controller or processor: when a data processing agreement is needed and what Article 28 requires.

Article 5 also matters here. It says the controller is responsible for compliance with the data protection principles and must be able to demonstrate it. That is the accountability duty. In a child consent case, evidence can include the selected legal basis, the information given to the child, the consent wording, and the reasonable verification steps used for guardian consent.

When the 13-year rule does not decide the case

The 13-year rule is important, but it has limits. It does not answer every question about children’s personal data.

The rule does not decide the case when processing is based on another legal basis under Article 6. It does not replace a legal obligation, a public task, official authority, contract, vital interests or legitimate interests where those bases lawfully apply. It also does not decide the separate conditions for special categories of personal data under Article 9.

The rule does not mean that a child under 13 can never have personal data processed. It means that, in the Article 8 situation, processing based on the child’s own consent is not enough below the Finnish age limit. The person with parental responsibility must give consent or authorisation for that processing to be lawful under that rule.

The rule also does not settle contract-law questions. The General Data Protection Regulation’s Article 8 says it does not affect Member States’ general contract law, including rules on the validity, formation or effect of a contract in relation to a child. So the data protection consent age and the validity of a contract are separate questions.

Finally, the rule does not remove breach duties. If a personal data breach occurs, the General Data Protection Regulation’s Article 33 requires the controller to notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to natural persons’ rights and freedoms. Article 34 concerns communication to the data subject when the breach is likely to result in a high risk. For that process, see Personal data breach: the 72 hours start when an employee notices.

The decision starts from the legal basis, not an age field

A good decision path starts with the processing purpose. The organisation identifies the personal data, the purpose, and the legal basis under the General Data Protection Regulation’s Article 6. Only after that does it decide whether Article 8 and section 5 of the Data Protection Act apply.

If consent is the legal basis and the service is offered directly to a child, the Finnish age limit is 13. If the child is under 13, the organisation needs consent or authorisation from the person with parental responsibility and must take reasonable steps to verify it. If the child is 13 or older, section 5 says the processing is lawful in that specific consent-based situation.

If consent is not the legal basis, the organisation should not force the case into a consent form just because the data concerns a child. The lawful basis should match the real purpose of the processing. The same processing must still follow the General Data Protection Regulation’s principles: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

In practice, this means that age is a checkpoint, not the whole assessment. The real compliance question is whether the organisation can explain why it processes the child’s data, what legal basis it uses, what the child has been told, what rights apply, and how the organisation can show that it followed the rules.