Cybersecurity

Cybersecurity

Data is a valuable commodity in many organisations. We help you handle data in a compliant manner and protect it from misuse.

The legal requirements for cybersecurity are scattered across different regulations. The European Union is introducing a growing number of sector-specific regulations on information security requirements, such as DORA, NIS2, CRA and CER. We can help you identify the provisions that apply to your specific business and explain what they mean in practice. We speak the same language as ICT professionals. Several of our legal experts are also computer science graduates.

In addition to day-to-day advice, we can help you with a range of incidents. Data systems are vulnerable to disruptions and outside threats. In emergencies, the statutory and contractual obligations relating to data and personal data must be fulfilled in order to mitigate risks and safeguard your business’s ability to operate as effectively as possible. Our experts are experienced at resolving a wide range of disruptions, whether they originate from inside or outside the company.

Latest references

The Finnish Ministry of Foreign Affairs – A precedent setting cyber security incident court case

The Finnish Supreme Administrative Court has handed down decision KHO 2024:115 on balancing data protection and national security interests in cyber security incidents. We acted for the Finnish Ministry of Foreign Affairs in this precedent setting case, in which the Supreme Administrative Court agreed with our client’ core submissions and decided to overturn key parts of a data protection authority decision against our client. The court held that the Ministry had acted lawfully when taking a bit of time between discovering information about a cyber incident concerning certain diplomats and notifying all potentially affected people. The key point of principle for our client was the extent to which Article 34 of the GDPR requires such (essentially public) notifications when foreign policy and national security might require a more discrete initial approach. The court’s reasoning is important: since Finland has voluntarily, but not unreservedly, extended the scope of the GDPR to also cover foreign policy and national security, the primacy of EU law does not apply in that extended context. Thus, more specific local Finnish rules on freedom of information/confidentiality in these areas override the general Article 34 notification obligation (under the classic lex specialis derogat legi generali rule), even absent express statutory carve-outs to Article 34. Had Article 34 applied as a matter of EU law, the outcome could have been different, since the GDPR, under primacy, would override all local Finnish rules, irrespective of whether they are lex specialis or not. It’s important to understand why, and on what basis, an EU law applies to any given situation, since this could affect the principles of interpretation so much that the outcome changes significantly. The court did, however, hold that the Ministry will need to notify the DPA itself within the customary deadlines, since the DPA under Finnish law has the right to receive information confidentiality rules notwithstanding. We hope this outcome will contribute to authorities dealing with foreign policy and national security being able to balance all relevant interests going forward. Read the decision in Finnish or in Swedish .

Neste – A EUR 250 million 10-year loan with NIB

We advised Neste as it signed a EUR 250 million 10-year loan with NIB. The loan will finance Neste’s investments related to research and development (R&D) in processing lower-quality feedstocks into high-quality renewable products; as well as the liquefied waste plastics (LWP) investment at Neste’s refinery in Porvoo, Finland. The R&D activities supported by the loan focus on the development of renewable solutions. These include, for example, expanding feedstock capabilities and technologies that enable the processing of new and lower-quality waste and residues into high-quality renewable end products. Part of the financing supports Neste’s liquefied waste plastics investment in Porvoo, related to upgrading low-quality plastic waste into high-quality feedstock at an industrial scale. The investment contributes to advancing circular economy solutions by enabling the use of hard-to-recycle plastic waste as a replacement for virgin fossil raw materials. The unit has an annual capacity to process up to 150,000 tonnes of liquefied waste plastic. Production ramp-up commenced in 2026.

Aspo – Demerger and finance matters

We advised Aspo Plc, ESL Shipping Ltd and AtoBatC Shipping AB in relation to finance matters in connection with the demerger of Aspo, by which all the shares in ESL Shipping Ltd held by Aspo, together with the related assets and liabilities, will be transferred to a new independent company to be named ESL Shipping Group Plc. Aspo intends to apply for the shares of ESL Shipping Group to be admitted to trading on the regulated market of Nasdaq Helsinki. It is further intended that Aspo be renamed Telko Group Plc.

Lenders and Export Credit Agencies – EUR 514.4 million green project financing for Easpring Finland New Materials’ CAM plant

We acted as Finnish law legal adviser to the lenders and the export credit agencies in connection with the EUR 514.4 million green project financing for the development and construction of Easpring Finland New Materials Oy’s cathode active material (CAM) manufacturing plant in Kotka, Finland. The borrower, Easpring Finland New Materials Oy, is a joint venture owned by Beijing Easpring Material Technology, Finnish Minerals Group and LG Energy Solution. The financing was provided by six international commercial banks, with Société Générale acting as financial adviser and mandated lead arranger together with Natixis as co-mandated lead arranger, and DNB, ICBC, ING and Standard Chartered participating as lenders, with support from the export credit agencies Finnvera and Sinosure. The project represents a significant milestone for Finland and the European battery value chain by strengthening Europe’s domestic supply of cathode active materials, a key component in lithium-ion batteries for electric vehicles and energy storage applications. Once the first phase of the project is operational, the Kotka facility is expected to produce approximately 60,000 tonnes of cathode active material annually, making it one of the largest CAM production plants in Europe and supplying leading battery manufacturers across Europe.

Latest insights

17.7.2026 – Real Estate Investments & Transactions Special features of real estate transactions in Finland: Formal requirements, permit requirements and pre-emption rights

Jessica Salmia

Elina Marttala

Jessica Salmia & Elina Marttala

18.6.2026 AI is an opportunity to reinvent legal business

Jarno Tanhuanpää

Jarno Tanhuanpää

13.5.2026 – Venture Capital & Minority Investments Newly launched Series Seed 4.0 is a comprehensive standard seed financing documentation for the Finnish market

Jarno Tanhuanpää

Tuomas Honkinen

Jussi Mäkikangas

Jarno Tanhuanpää, Tuomas Honkinen & Jussi Mäkikangas

8.5.2026 – Environment, Energy & Green Transition Reform of Finland’s land use legislation – key takeaways for project developers

Tarja Pirinen

Marius af Schultén

Joel Aartolahti

Tarja Pirinen, Marius af Schultén & Joel Aartolahti

Search from the site.