Cybersecurity

Cybersecurity

Data is a valuable commodity in many organisations. We help you handle data in a compliant manner and protect it from misuse.

The legal requirements for cybersecurity are scattered across different regulations. The European Union is introducing a growing number of sector-specific regulations on information security requirements, such as DORA, NIS2, CRA and CER. We can help you identify the provisions that apply to your specific business and explain what they mean in practice. We speak the same language as ICT professionals. Several of our legal experts are also computer science graduates.

In addition to day-to-day advice, we can help you with a range of incidents. Data systems are vulnerable to disruptions and outside threats. In emergencies, the statutory and contractual obligations relating to data and personal data must be fulfilled in order to mitigate risks and safeguard your business’s ability to operate as effectively as possible. Our experts are experienced at resolving a wide range of disruptions, whether they originate from inside or outside the company.

Latest references

The Finnish Ministry of Foreign Affairs – A precedent setting cyber security incident court case

The Finnish Supreme Administrative Court has handed down decision KHO 2024:115 on balancing data protection and national security interests in cyber security incidents. We acted for the Finnish Ministry of Foreign Affairs in this precedent setting case, in which the Supreme Administrative Court agreed with our client’ core submissions and decided to overturn key parts of a data protection authority decision against our client. The court held that the Ministry had acted lawfully when taking a bit of time between discovering information about a cyber incident concerning certain diplomats and notifying all potentially affected people. The key point of principle for our client was the extent to which Article 34 of the GDPR requires such (essentially public) notifications when foreign policy and national security might require a more discrete initial approach. The court’s reasoning is important: since Finland has voluntarily, but not unreservedly, extended the scope of the GDPR to also cover foreign policy and national security, the primacy of EU law does not apply in that extended context. Thus, more specific local Finnish rules on freedom of information/confidentiality in these areas override the general Article 34 notification obligation (under the classic lex specialis derogat legi generali rule), even absent express statutory carve-outs to Article 34. Had Article 34 applied as a matter of EU law, the outcome could have been different, since the GDPR, under primacy, would override all local Finnish rules, irrespective of whether they are lex specialis or not. It’s important to understand why, and on what basis, an EU law applies to any given situation, since this could affect the principles of interpretation so much that the outcome changes significantly. The court did, however, hold that the Ministry will need to notify the DPA itself within the customary deadlines, since the DPA under Finnish law has the right to receive information confidentiality rules notwithstanding. We hope this outcome will contribute to authorities dealing with foreign policy and national security being able to balance all relevant interests going forward. Read the decision in Finnish or in Swedish .

Nala Renewables – Development, acquisition and financing of battery energy storage system (BESS) project

We advised Nala Renewables on the Finnish law aspects of the development, acquisition and financing of its battery energy storage system (BESS) project in Vuolijoki, Finland. The project comprises a 125 MW / 250 MWh battery energy storage system. Our advice extended beyond financing to the transaction’s legal due diligence and the acquisition of the project company. We also advised on key project contracts and financing documentation for the project finance facilities provided by Coöperatieve Rabobank U.A. The project is part of Nala Renewables’ growing portfolio of battery storage assets in Finland and the wider Nordic region, supporting the integration of renewable energy and contributing to the flexibility and stability of the Finnish electricity grid.

Foundation Clinic – Funding Round

We advised Foundation Clinic in connection with its funding round backed by a group of prominent Finnish technology entrepreneurs and investors, including founders behind Supercell and Wolt. Foundation Clinic is a Finnish healthcare company developing a new approach to private healthcare focused on preventive, data-driven and continuous care. The company aims to combine comprehensive health data with ongoing medical care to identify and address health risks at an early stage.

Delta Capacity – Project financing of two battery energy storage systems (BESS)

We advised Delta Capacity AG in a project financing of two battery energy storage systems (BESS). The financed projects are among the largest BESS developments in Finland to enter construction with 250 MW / 600 MWh combined capacity. The financing was provided by Société Générale with support from Finnvera. Construction of both projects, located in Lapinlahti and Teuva, has already begun and the commercial operations are targeted to commence in late 2027 with partial tolling agreements already in place for both assets. The project in Lapinlahti is executed in partnership with Covenergo, while the project in Teuva is executed in partnership with Strioga Family Foundation. Delta Capacity is a Swiss developer of utility-scale battery storage systems. The projects strengthen Delta Capacity’s growing Nordic portfolio and support the flexibility of Finland’s electricity system by adding energy storage capacity, enabling production optimization as well as participation in electricity markets and reserve services.

Latest insights

26.10.2026 – FDI Regulatory Service Reform of Finnish FDI screening moves forward: significant changes and broader scope

Kiti Karvinen

Joachim Wik

Johanna Kyllöinen

Kiti Karvinen, Joachim Wik & Johanna Kyllöinen

1.10.2026 – Financial Regulation New EU-driven banking M&A rules entered into force in Finland on 1 October 2026

Hannu Huotilainen

Hannu Huotilainen

24.9.2026 – Environment, Energy & Green Transition Electricity Market Act: Proposed priority procedure to significantly change new electricity network connections in situations of scarce capacity

Marius af Schultén

Kanerva Sunila

Samuli Tarkiainen

Jonas Holm

Noora Ahonen

Marius af Schultén, Kanerva Sunila, Samuli Tarkiainen, Jonas Holm & Noora Ahonen

11.9.2026 Finland proposes a new data centre register – draft legislation open for comments

Marius af Schultén

Antti Kaakkola

Samuli Tarkiainen

Mikko Alakare

Janne Juusela

Jerker Pitkänen

Marius af Schultén, Antti Kaakkola, Samuli Tarkiainen, Mikko Alakare, Janne Juusela & Jerker Pitkänen

Search from the site.