Cybersecurity

Cybersecurity

Data is a valuable commodity in many organisations. We help you handle data in a compliant manner and protect it from misuse.

The legal requirements for cybersecurity are scattered across different regulations. The European Union is introducing a growing number of sector-specific regulations on information security requirements, such as DORA, NIS2, CRA and CER. We can help you identify the provisions that apply to your specific business and explain what they mean in practice. We speak the same language as ICT professionals. Several of our legal experts are also computer science graduates.

In addition to day-to-day advice, we can help you with a range of incidents. Data systems are vulnerable to disruptions and outside threats. In emergencies, the statutory and contractual obligations relating to data and personal data must be fulfilled in order to mitigate risks and safeguard your business’s ability to operate as effectively as possible. Our experts are experienced at resolving a wide range of disruptions, whether they originate from inside or outside the company.

Latest references

The Finnish Ministry of Foreign Affairs – A precedent setting cyber security incident court case

The Finnish Supreme Administrative Court has handed down decision KHO 2024:115 on balancing data protection and national security interests in cyber security incidents. We acted for the Finnish Ministry of Foreign Affairs in this precedent setting case, in which the Supreme Administrative Court agreed with our client’ core submissions and decided to overturn key parts of a data protection authority decision against our client. The court held that the Ministry had acted lawfully when taking a bit of time between discovering information about a cyber incident concerning certain diplomats and notifying all potentially affected people. The key point of principle for our client was the extent to which Article 34 of the GDPR requires such (essentially public) notifications when foreign policy and national security might require a more discrete initial approach. The court’s reasoning is important: since Finland has voluntarily, but not unreservedly, extended the scope of the GDPR to also cover foreign policy and national security, the primacy of EU law does not apply in that extended context. Thus, more specific local Finnish rules on freedom of information/confidentiality in these areas override the general Article 34 notification obligation (under the classic lex specialis derogat legi generali rule), even absent express statutory carve-outs to Article 34. Had Article 34 applied as a matter of EU law, the outcome could have been different, since the GDPR, under primacy, would override all local Finnish rules, irrespective of whether they are lex specialis or not. It’s important to understand why, and on what basis, an EU law applies to any given situation, since this could affect the principles of interpretation so much that the outcome changes significantly. The court did, however, hold that the Ministry will need to notify the DPA itself within the customary deadlines, since the DPA under Finnish law has the right to receive information confidentiality rules notwithstanding. We hope this outcome will contribute to authorities dealing with foreign policy and national security being able to balance all relevant interests going forward. Read the decision in Finnish or in Swedish .

Efima – Sale of AI business

We advised Efima Oyj on the sale of its AI business to Better Care Technologies Oy. The transaction included Efima’s Moiva AI platform developed for the care sector, the related technology and brand, customer contracts, and the experts working in the business. Efima is a Finnish digital company that supports the sustainable growth of large and mid-sized companies by streamlining their business processes and by creating competitive advantage through the innovative use of artificial intelligence and data. The company has nearly 200 experts based in Helsinki and Tampere.

Neoen – Sale of data centre

We advised Neoen Renewables Finland Oy, part of the French Neoen Group, in its sale of a data centre project to a consortium consisting of international data centre developers and operators. This marked Neoen’s first data centre development project in Finland. Founded in 2008, Neoen is one of the world’s leading independent renewable energy producers. The company operates in 15 countries. It develops, finances, builds, owns, and operates solar power plants, wind farms, and battery storage systems. Neoen Group is owned by global alternative asset manager Brookfield Corporation.

Jolt Capital and Tesi – Investment in VEV

We advised Jolt Capital and Tesi in connection with their investment in VEV, a leading provider of commercial fleet electrification solutions. The investment, led by Jolt Capital with Tesi as co-investor, will support VEV’s next phase of growth and expansion across Europe. As part of the transaction, VEV became an independent company following the acquisition of Vitol’s stake in the business. Founded by Vitol, VEV provides integrated fleet electrification solutions combining fleet strategy, charging infrastructure, energy supply and operational services. Through its VEV IQ platform, the company supports more than 6,000 commercial electric vehicles across Europe and has been deployed across more than 600 sites spanning the transport, logistics and waste sectors. Jolt Capital is a private equity firm focused on growth investments in European deeptech companies. Tesi is a Finnish state-owned investment company that promotes Finnish business and economic growth through investments. We advised Jolt Capital and Tesi on the equity financing and structuring aspects of the transaction. International law firm Goodwin advised the investors on the acquisition of VEV.

Latest insights

1.10.2026 – Financial Regulation New EU-driven banking M&A rules entered into force in Finland on 1 October 2026

Hannu Huotilainen

Hannu Huotilainen

24.9.2026 – Environment, Energy & Green Transition Electricity Market Act: Proposed priority procedure to significantly change new electricity network connections in situations of scarce capacity

Marius af Schultén

Kanerva Sunila

Samuli Tarkiainen

Jonas Holm

Noora Ahonen

Marius af Schultén, Kanerva Sunila, Samuli Tarkiainen, Jonas Holm & Noora Ahonen

11.9.2026 Finland proposes a new data centre register – draft legislation open for comments

Marius af Schultén

Antti Kaakkola

Samuli Tarkiainen

Mikko Alakare

Janne Juusela

Jerker Pitkänen

Marius af Schultén, Antti Kaakkola, Samuli Tarkiainen, Mikko Alakare, Janne Juusela & Jerker Pitkänen

1.9.2026 – Intellectual Property New marketing and consumer protection requirements call for action

Hilma-Karoliina Rozell

Hilma-Karoliina Rozell

Search from the site.