Aland Finnish Data Protection Act

National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.


Short name	AX DP Act
Region	Europe
Country or scope	Aland
Sector	Privacy
In your workspace	Off until you switch it on in Compliance › Manage.

How Safeguard covers AX DP Act

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`AX-GDPR-32` Security of Processing	Controllers and processors must implement technical measures ensuring ongoing integrity of processing systems, including the ability to verify components against tampering via integrity hashes (GDPR Art. 32; Data Protection Act 1050/2018).	Scan
`AX-GDPR-30` Records of Processing Activities	Maintaining records of processing activities presupposes an inventory of the software components that carry out the processing (GDPR Art. 30).	Scan
`AX-GDPR-28` Processor Guarantees	Processing may only be entrusted to processors providing sufficient guarantees, so third-party components must have named, accountable suppliers (GDPR Art. 28).	Scan
`AX-GDPR-5F` Integrity and Confidentiality Principle	The integrity-and-confidentiality principle requires knowing precisely which components handle personal data, so components should carry standard identifiers such as PURL or CPE (GDPR Art. 5(1)(f)).	Scan
`AX-GDPR-33` Breach-Notification Readiness	Notifying the supervisory authority within 72 hours of a breach presupposes knowing the exact versions of the software processing personal data so impact can be assessed quickly (GDPR Arts. 33-34).	Scan
`AX-GDPR-5-2` Demonstrable Accountability	The accountability principle requires being able to demonstrate compliance, which calls for dated, identifiable documentation of the systems used to process personal data (GDPR Art. 5(2)).	Scan

All 22 from the standard set, adapted to AX DP Act.