The new IT2018 general terms and conditions have just be published to replace the IT2015 general terms and conditions. The update is motivated by the EU’s General Data Protection Regulation (GDPR), which will be applied starting on 25 May 2018. The IT2018 general terms and conditions are meant to be applied in small and mid-size IT procurements between businesses.
5.3.2018
New IT2018 General Terms and Conditions Published – Key Update, GDPR-Compliant Special Terms and Conditions Processing Personal Data
Tags
The largest change is that special terms and conditions for the processing of personal data (EHK) have been added to help meet the GDPR’s requirements in IT deliveries. These special terms and conditions will be a welcome aid both in future IT projects and in updating existing agreements. The general terms and conditions and cloud service terms and conditions have also been updated.
The GDPR requires that the outsourcing of personal data processing must be agreed in writing between the data controller and the data processor. This means that when a supplier processes personal data on behalf of its client as part of an IT delivery, this processing requires a written agreement fulfilling certain minimum requirements. This applies to both new and existing agreements, which means that existing agreements will have to be reviewed and updated to meet the GDPR’s requirements. The GDPR sets the minimum requirements for such agreements, such as commitments to comply with the data controller’s instructions and implementing sufficient data security.
The IT2018 EHK terms and conditions meet the GDPR’s minimum requirements and can be used as a base for data processing agreements. However, when drafting an agreement, it is important to account for the nature of the product or service being delivered and to ensure that the obligations concerning, for example, data security are sufficient with respect to the risk of the processing being outsourced. The IT2018 general terms and condition assume that the EHK terms and conditions take precedence over the other IT2018 terms and conditions.
The IT 2018 general terms and conditions have been drafted in cooperation by the Finland Chamber of Commerce, Ohjelmistoyrittäjät ry, the Finnish Association of Purchasing and Logistics LOGY, Technology Industries of Finland and the Finnish Information Processing Association, TIVIA.
Read more about outsourcing personal data processing on out blog.
For more information, please contact:
Mikko-Pekka Partanen
Kimmo Rekola
Latest news
Latest references
Banyan Software – Acquisition of Carus Ferry
We acted as legal adviser to Banyan Software on its acquisition of Carus Ferry, a Finland-based provider of reservation, check-in and port operations software for ferry and passenger shipping operators. The acquisition further strengthens Banyan Software’s presence in the Nordic region while providing Carus with a long-term partner to support its continued growth and development. Carus was founded in 1998 and is headquartered in Mariehamn on the Åland Islands, Finland. The company develops mission-critical software for ferry, cruise and passenger shipping operators, covering the full passenger journey from booking and ticketing to capacity management, check-in and boarding. Carus also provides port automation, onboard sales systems and business information tools. The company serves approximately 30 operators across four continents and is the largest vendor by customer count in ferry reservation and departure control. Banyan Software is an acquirer and long-term operator of mission-critical software businesses serving specialised industries. Founded in 2016, Banyan follows a buy-and-hold-for-life approach and supports the long-term growth and development of its portfolio companies. Banyan operates more than 130 portfolio companies across North and South America, the United Kingdom, Europe and APAC. Following the acquisition of Carus, Banyan operates three businesses in the Nordic region.
Case published 20.10.2026
Move Energy – Combination of 3North Partners and Steady Energy and related private placement and IPO
We advised Move Energy as an investor in connection with the combination of 3North Partners Plc and Steady Energy Oy and the related private placement and initial public offering of the combined company on Nasdaq First North Growth Market Finland. In connection with the transaction, 3North Partners received approximately EUR 69.8 million in investor commitments from a group of institutional and other investors, including Move Energy, to fund the combined company. Steady Energy is a Finnish nuclear technology company developing a new generation of small modular reactors (SMRs) particularly suited for district heating. Its LDR-50 reactor is designed to provide cities and utilities with a scalable and low-carbon alternative to combustion-based heat production.
Case published 19.10.2026
Efima – Sale of AI business
We advised Efima Oyj on the sale of its AI business to Better Care Technologies Oy. The transaction included Efima’s Moiva AI platform developed for the care sector, the related technology and brand, customer contracts, and the experts working in the business. Efima is a Finnish digital company that supports the sustainable growth of large and mid-sized companies by streamlining their business processes and by creating competitive advantage through the innovative use of artificial intelligence and data. The company has nearly 200 experts based in Helsinki and Tampere.
Case published 21.9.2026
Neoen – Sale of data centre
We advised Neoen Renewables Finland Oy, part of the French Neoen Group, in its sale of a data centre project to a consortium consisting of international data centre developers and operators. This marked Neoen’s first data centre development project in Finland. Founded in 2008, Neoen is one of the world’s leading independent renewable energy producers. The company operates in 15 countries. It develops, finances, builds, owns, and operates solar power plants, wind farms, and battery storage systems. Neoen Group is owned by global alternative asset manager Brookfield Corporation.
Case published 17.9.2026