Cybersecurity

Cybersecurity

Data is a valuable commodity in many organisations. We help you handle data in a compliant manner and protect it from misuse.

The legal requirements for cybersecurity are scattered across different regulations. The European Union is introducing a growing number of sector-specific regulations on information security requirements, such as DORA, NIS2, CRA and CER. We can help you identify the provisions that apply to your specific business and explain what they mean in practice. We speak the same language as ICT professionals. Several of our legal experts are also computer science graduates.

In addition to day-to-day advice, we can help you with a range of incidents. Data systems are vulnerable to disruptions and outside threats. In emergencies, the statutory and contractual obligations relating to data and personal data must be fulfilled in order to mitigate risks and safeguard your business’s ability to operate as effectively as possible. Our experts are experienced at resolving a wide range of disruptions, whether they originate from inside or outside the company.

Latest references

The Finnish Ministry of Foreign Affairs – A precedent setting cyber security incident court case

The Finnish Supreme Administrative Court has handed down decision KHO 2024:115 on balancing data protection and national security interests in cyber security incidents. We acted for the Finnish Ministry of Foreign Affairs in this precedent setting case, in which the Supreme Administrative Court agreed with our client’ core submissions and decided to overturn key parts of a data protection authority decision against our client. The court held that the Ministry had acted lawfully when taking a bit of time between discovering information about a cyber incident concerning certain diplomats and notifying all potentially affected people. The key point of principle for our client was the extent to which Article 34 of the GDPR requires such (essentially public) notifications when foreign policy and national security might require a more discrete initial approach. The court’s reasoning is important: since Finland has voluntarily, but not unreservedly, extended the scope of the GDPR to also cover foreign policy and national security, the primacy of EU law does not apply in that extended context. Thus, more specific local Finnish rules on freedom of information/confidentiality in these areas override the general Article 34 notification obligation (under the classic lex specialis derogat legi generali rule), even absent express statutory carve-outs to Article 34. Had Article 34 applied as a matter of EU law, the outcome could have been different, since the GDPR, under primacy, would override all local Finnish rules, irrespective of whether they are lex specialis or not. It’s important to understand why, and on what basis, an EU law applies to any given situation, since this could affect the principles of interpretation so much that the outcome changes significantly. The court did, however, hold that the Ministry will need to notify the DPA itself within the customary deadlines, since the DPA under Finnish law has the right to receive information confidentiality rules notwithstanding. We hope this outcome will contribute to authorities dealing with foreign policy and national security being able to balance all relevant interests going forward. Read the decision in Finnish or in Swedish .

Banyan Software – Acquisition of Carus Ferry

We acted as legal adviser to Banyan Software on its acquisition of Carus Ferry, a Finland-based provider of reservation, check-in and port operations software for ferry and passenger shipping operators. The acquisition further strengthens Banyan Software’s presence in the Nordic region while providing Carus with a long-term partner to support its continued growth and development. Carus was founded in 1998 and is headquartered in Mariehamn on the Åland Islands, Finland. The company develops mission-critical software for ferry, cruise and passenger shipping operators, covering the full passenger journey from booking and ticketing to capacity management, check-in and boarding. Carus also provides port automation, onboard sales systems and business information tools. The company serves approximately 30 operators across four continents and is the largest vendor by customer count in ferry reservation and departure control. Banyan Software is an acquirer and long-term operator of mission-critical software businesses serving specialised industries. Founded in 2016, Banyan follows a buy-and-hold-for-life approach and supports the long-term growth and development of its portfolio companies. Banyan operates more than 130 portfolio companies across North and South America, the United Kingdom, Europe and APAC. Following the acquisition of Carus, Banyan operates three businesses in the Nordic region.

Move Energy – Combination of 3North Partners and Steady Energy and related private placement and IPO

We advised Move Energy as an investor in connection with the combination of 3North Partners Plc and Steady Energy Oy and the related private placement and initial public offering of the combined company on Nasdaq First North Growth Market Finland. In connection with the transaction, 3North Partners received approximately EUR 69.8 million in investor commitments from a group of institutional and other investors, including Move Energy, to fund the combined company. Steady Energy is a Finnish nuclear technology company developing a new generation of small modular reactors (SMRs) particularly suited for district heating. Its LDR-50 reactor is designed to provide cities and utilities with a scalable and low-carbon alternative to combustion-based heat production.

Efima – Sale of AI business

We advised Efima Oyj on the sale of its AI business to Better Care Technologies Oy. The transaction included Efima’s Moiva AI platform developed for the care sector, the related technology and brand, customer contracts, and the experts working in the business. Efima is a Finnish digital company that supports the sustainable growth of large and mid-sized companies by streamlining their business processes and by creating competitive advantage through the innovative use of artificial intelligence and data. The company has nearly 200 experts based in Helsinki and Tampere.

Latest insights

1.10.2026 – Financial Regulation New EU-driven banking M&A rules entered into force in Finland on 1 October 2026

Hannu Huotilainen

Hannu Huotilainen

24.9.2026 – Environment, Energy & Green Transition Electricity Market Act: Proposed priority procedure to significantly change new electricity network connections in situations of scarce capacity

Marius af Schultén

Kanerva Sunila

Samuli Tarkiainen

Jonas Holm

Noora Ahonen

Marius af Schultén, Kanerva Sunila, Samuli Tarkiainen, Jonas Holm & Noora Ahonen

11.9.2026 Finland proposes a new data centre register – draft legislation open for comments

Marius af Schultén

Antti Kaakkola

Samuli Tarkiainen

Mikko Alakare

Janne Juusela

Jerker Pitkänen

Marius af Schultén, Antti Kaakkola, Samuli Tarkiainen, Mikko Alakare, Janne Juusela & Jerker Pitkänen

1.9.2026 – Intellectual Property New marketing and consumer protection requirements call for action

Hilma-Karoliina Rozell

Hilma-Karoliina Rozell

Search from the site.