Smart city technologies can have detrimental effects on human rights, making it crucial to mitigate them in the R&D phase. This qualitative socio-legal study of the Helsinki metropolitan area (HMA) explores how public funding for smart city research and development (R&D), and the data protection by design principle (DPbD) of the General Data Protection Regulation (GDPR), facilitate the development of human rights compliant technology. Our study shows that the tension between the neoliberal logic of smart cities and that human rights compliance extends from the local to the global level. High compliance and localisation costs, one-sided inputs and a push for scalability in smart city technology development in Finland and other EU states may attract companies to overlook human rights risks and pursue markets outside the EU with lower standards of respect for human rights and the rule of law. We propose policy measures to facilitate human rights compliant smart city R&D, localisation and procurement, and discuss human rights due diligence and export control measures as means to mitigate the potential adverse effects of smart city technology exported from the EU. The study contributes to research on human rights-based approaches to smart city technology development and European innovation and export policy, with attention given to the role of public R&D funding agencies. Issue 1 This paper is part of Future-proofing the city: A human rights-based approach to governing algorithmic, biometric and smart city technologies, a special issue of Internet Policy Review guest-edited by Alina Wernick and Anna Artyushina. Wernick, Banzuzi, Mörelius-Wulff E8 City data manager #1 City funding E9 City data manager #2 City funding E10 City project manager #1 EU funding E11 City project manager #2 City funding E12 City procurement expert