The new IT2018 general terms and conditions have just be published to replace the IT2015 general terms and conditions. The update is motivated by the EU’s General Data Protection Regulation (GDPR), which will be applied starting on 25 May 2018. The IT2018 general terms and conditions are meant to be applied in small and mid-size IT procurements between businesses.
5.3.2018
New IT2018 General Terms and Conditions Published – Key Update, GDPR-Compliant Special Terms and Conditions Processing Personal Data
Tags
The largest change is that special terms and conditions for the processing of personal data (EHK) have been added to help meet the GDPR’s requirements in IT deliveries. These special terms and conditions will be a welcome aid both in future IT projects and in updating existing agreements. The general terms and conditions and cloud service terms and conditions have also been updated.
The GDPR requires that the outsourcing of personal data processing must be agreed in writing between the data controller and the data processor. This means that when a supplier processes personal data on behalf of its client as part of an IT delivery, this processing requires a written agreement fulfilling certain minimum requirements. This applies to both new and existing agreements, which means that existing agreements will have to be reviewed and updated to meet the GDPR’s requirements. The GDPR sets the minimum requirements for such agreements, such as commitments to comply with the data controller’s instructions and implementing sufficient data security.
The IT2018 EHK terms and conditions meet the GDPR’s minimum requirements and can be used as a base for data processing agreements. However, when drafting an agreement, it is important to account for the nature of the product or service being delivered and to ensure that the obligations concerning, for example, data security are sufficient with respect to the risk of the processing being outsourced. The IT2018 general terms and condition assume that the EHK terms and conditions take precedence over the other IT2018 terms and conditions.
The IT 2018 general terms and conditions have been drafted in cooperation by the Finland Chamber of Commerce, Ohjelmistoyrittäjät ry, the Finnish Association of Purchasing and Logistics LOGY, Technology Industries of Finland and the Finnish Information Processing Association, TIVIA.
Read more about outsourcing personal data processing on out blog.
For more information, please contact:
Mikko-Pekka Partanen
Kimmo Rekola
Latest news
Latest references
Efima – Sale of AI business
We advised Efima Oyj on the sale of its AI business to Better Care Technologies Oy. The transaction included Efima’s Moiva AI platform developed for the care sector, the related technology and brand, customer contracts, and the experts working in the business. Efima is a Finnish digital company that supports the sustainable growth of large and mid-sized companies by streamlining their business processes and by creating competitive advantage through the innovative use of artificial intelligence and data. The company has nearly 200 experts based in Helsinki and Tampere.
Case published 21.9.2026
Neoen – Sale of data centre
We advised Neoen Renewables Finland Oy, part of the French Neoen Group, in its sale of a data centre project to a consortium consisting of international data centre developers and operators. This marked Neoen’s first data centre development project in Finland. Founded in 2008, Neoen is one of the world’s leading independent renewable energy producers. The company operates in 15 countries. It develops, finances, builds, owns, and operates solar power plants, wind farms, and battery storage systems. Neoen Group is owned by global alternative asset manager Brookfield Corporation.
Case published 17.9.2026
Jolt Capital and Tesi – Investment in VEV
We advised Jolt Capital and Tesi in connection with their investment in VEV, a leading provider of commercial fleet electrification solutions. The investment, led by Jolt Capital with Tesi as co-investor, will support VEV’s next phase of growth and expansion across Europe. As part of the transaction, VEV became an independent company following the acquisition of Vitol’s stake in the business. Founded by Vitol, VEV provides integrated fleet electrification solutions combining fleet strategy, charging infrastructure, energy supply and operational services. Through its VEV IQ platform, the company supports more than 6,000 commercial electric vehicles across Europe and has been deployed across more than 600 sites spanning the transport, logistics and waste sectors. Jolt Capital is a private equity firm focused on growth investments in European deeptech companies. Tesi is a Finnish state-owned investment company that promotes Finnish business and economic growth through investments. We advised Jolt Capital and Tesi on the equity financing and structuring aspects of the transaction. International law firm Goodwin advised the investors on the acquisition of VEV.
Case published 10.9.2026
VR Group – Intellectual property matters
VR-Group Plc is a transport and logistics group owned by the Finnish State, operating passenger and freight rail transport in Finland with activities also in the Swedish market. VR Group provides passenger, logistics and maintenance services with over 160 years’ experience in developing responsible transport of the future. We advise VR Group in intellectual property matters as part of the company’s wider brand protection efforts. Our assignments have included advice on copyright, design rights and trademarks, focusing on the protection of the company’s visual identity – including its distinctive green colour – in connection with transport services as part of a comprehensive IP protection strategy. VR Group’s consistent brand building has also received recognition, including the Finland Chamber of Commerce’s Brand of the Year award in 2026. In the competition, brands were viewed comprehensively from various perspectives, including their story, strategic role, brand renewal ability and intellectual property protection. The jury found that VR had understood the importance of the protection of its brand as part of a comprehensive business strategy.
Case published 9.9.2026