# Mindemo Oy (formerly Heltti Oy): Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Deputy Data Protection Ombudsman
- Date: 2026-10-02
- Original: https://www.enforcementtracker.com/ETid-3353
- Canonical: https://overview.legal/posts/603868

## Summary

The Finnish Deputy Data Protection Ombudsman fined Mindemo Oy (formerly Heltti Oy) €33,000 for failing to implement sufficient technical and organizational measures to ensure information security, violating Articles 5(1)(f), 25, and 32 of the GDPR. The enforcement action concerned a healthcare sector entity that did not adequately protect personal data confidentiality and integrity.The Finnish Deputy Data Protection Ombudsman fined Mindemo Oy (formerly Heltti Oy) €33,000 for failing to implement sufficient technical and organizational measures to ensure information security in the healthcare sector. The decision, issued on 2026-10-02, found violations of Article 5(1)(f), Article 25(1) and (2), and Article 32(1) and (2) of the GDPR, relating to inadequate data protection by design and default and insufficient safeguards for personal data confidentiality and integrity.

## Full text

Deputy Data Protection Ombudsman fined Mindemo Oy (formerly Heltti Oy) €33,000 on 2026-10-02 for: Insufficient technical and organisational measures to ensure information security.
GDPR Articles: Art. 5 (1) f) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1), (2) GDPR
Sector: Health Care
Country: Finland
Source: https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/32

---
Generated by overview.legal · https://overview.legal/posts/603868 · 2026-10-24