The new IT2018 general terms and conditions have just be published to replace the IT2015 general terms and conditions. The update is motivated by the EU’s General Data Protection Regulation (GDPR), which will be applied starting on 25 May 2018. The IT2018 general terms and conditions are meant to be applied in small and mid-size IT procurements between businesses.
5.3.2018
New IT2018 General Terms and Conditions Published – Key Update, GDPR-Compliant Special Terms and Conditions Processing Personal Data
Tags
The largest change is that special terms and conditions for the processing of personal data (EHK) have been added to help meet the GDPR’s requirements in IT deliveries. These special terms and conditions will be a welcome aid both in future IT projects and in updating existing agreements. The general terms and conditions and cloud service terms and conditions have also been updated.
The GDPR requires that the outsourcing of personal data processing must be agreed in writing between the data controller and the data processor. This means that when a supplier processes personal data on behalf of its client as part of an IT delivery, this processing requires a written agreement fulfilling certain minimum requirements. This applies to both new and existing agreements, which means that existing agreements will have to be reviewed and updated to meet the GDPR’s requirements. The GDPR sets the minimum requirements for such agreements, such as commitments to comply with the data controller’s instructions and implementing sufficient data security.
The IT2018 EHK terms and conditions meet the GDPR’s minimum requirements and can be used as a base for data processing agreements. However, when drafting an agreement, it is important to account for the nature of the product or service being delivered and to ensure that the obligations concerning, for example, data security are sufficient with respect to the risk of the processing being outsourced. The IT2018 general terms and condition assume that the EHK terms and conditions take precedence over the other IT2018 terms and conditions.
The IT 2018 general terms and conditions have been drafted in cooperation by the Finland Chamber of Commerce, Ohjelmistoyrittäjät ry, the Finnish Association of Purchasing and Logistics LOGY, Technology Industries of Finland and the Finnish Information Processing Association, TIVIA.
Read more about outsourcing personal data processing on out blog.
For more information, please contact:
Mikko-Pekka Partanen
Kimmo Rekola
Latest news
Latest references
Fortum – AI workshop
We delivered two AI workshops for Fortum Corporation’s Mergers and Acquisitions team, with both legal and business professionals participating. The sessions combined fundamental AI principles with custom use cases for commercially available AI tools tailored to Fortum’s needs. We also presented a bespoke solution merging AI with a script-based tool developed by our Legal Tech team, enabling a more automated way of working. Our experts conducted the training drawing on their legal background and leading experience in this emerging field of legal technology. Participants particularly appreciated the clarity and relevance of the implementations demonstrated. ‘C&S delivered an excellent, well-structured series of workshops, with directly applicable takeaways,’ says Sabina Hautaviita, Legal Counsel for M&A at Fortum.
Case published 9.3.2026
VR – Supreme Court decision clarifies working time practices
We successfully represented VR Group before the Supreme Court in a case concerning the meal break practice of commuter train drivers. On 6 February 2026, the Supreme Court ruled in VR’s favour (decision KKO:2026:12), confirming that VR had the right to amend the commuter train drivers’ meal break practice in 2021 by rendering the break unpaid in accordance with the applicable collective agreement. This decision clarifies the interpretation of collective agreements and employment legislation as well as the limits of the employer’s right to direct work. Over 250 commuter train drivers challenged the unpaid meal break practice which VR introduced in April 2021. Before the change, meal breaks had a long history of being paid. The change was based on the train drivers’ collective agreement, which allows for meal breaks to be organised either as paid or unpaid time. The Supreme Court ruled that the scheduling and managing of breaks falls within the core area of the employer’s right to direct work. This increases the threshold for an established practice becoming a binding condition for the parties. Merely following a practice consistently and over a long period of time does not make the practice binding; instead, the employer’s intent to commit to the practice must be clearly evident from the employer’s conduct or other circumstances. As both alternatives – paid and unpaid – for organising meal breaks had been retained in the collective agreement despite other amendments over the years, it could not be considered that VR had intended to commit to the paid break practice and waive its right to direct work as regards break scheduling. It was also significant that the employment contracts explicitly referred only to the collective agreement as regards working time. The Supreme Court deemed that the employees’ paid meal break was not an established term of employment and that VR was entitled to change the practice based on the collective agreement. The employer had the right, by virtue of its right to direct work, to unilaterally change the meal break practice by choosing to apply the other arrangement permitted by the collective agreement.
Case published 3.3.2026
CapMan Growth – Investment in Kuntokeskus Liikku
We are assisting CapMan Growth in its significant investment in Kuntokeskus Liikku, a Finnish gym chain known for its high-quality self-service facilities and excellent value for money. The investment will further strengthen Liikku’s position as a market leader and support the continued execution of its growth strategy. Liikku is one of Finland’s leading fitness chains, with more than 70 locations across the country serving nearly 90,000 members. The company’s concept is to offer high-quality self-service gyms at an exceptionally competitive price point which, combined with strong operational efficiency, provides a solid foundation for profitable growth. The company’s main shareholder is COR Group, a long-time partner of CapMan Growth, and a Finnish health and wellness conglomerate known for active ownership and long-term value creation. CapMan Growth is a leading Finnish growth investor that makes significant investments in entrepreneur-led growth companies with a turnover of €10–200 million. CapMan Growth is part of CapMan, which is a leading Nordic private equity investor engaged in active value creation work. CapMan has been listed on the Helsinki Stock Exchange since 2001.
Case published 27.2.2026
Terrafame – Environmental and water management permit processes concerning the company’s entire operations and the KL1 side rock area
Castrén & Snellman successfully assisted Terrafame Ltd in environmental and water management permit processes concerning the company’s entire operations and the KL1 side rock area, on which the Supreme Administrative Court issued its decision on 12 February 2026 (KHO 366/2026 and 367/2026). The changes made to the decisions of the Vaasa Administrative Court as a result of Terrafame’s appeals, enable the company to implement its new strategy and develop its operations as planned. The decisions of the Supreme Administrative Court brought the nearly ten-year-long permit process to a close.
Case published 20.2.2026