Cybersecurity law & regulation in Finland (2026)

Legal framework

Cybersecurity Act (Kyberturvallisuuslaki, 124/2025) transposing the EU NIS2 Directive, supervised by the National Cyber Security Centre Finland (NCSC-FI) at Traficom together with sector-specific regulators; complemented by GDPR, the Information Management Act and the Act on Electronic Communications Services.

NIS2 & cybersecurity law in Finland

In Finland, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Finland implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Finland

1. 01NIS2 transposition in force

   The Cybersecurity Act 124/2025 entered into force on 8 April 2025, implementing Directive (EU) 2022/2555 (NIS2) as Finland's first horizontal cybersecurity law covering essential and important entities across the NIS2 sectors (excluding banking, financial market infrastructure and public administration, which are covered by separate rules).

   traficom.fi valtioneuvosto.fi

2. 02Competent authorities

   NCSC-FI at Traficom is the national single point of contact and CSIRT and directly supervises sectors such as digital infrastructure, managed service providers, postal/courier, space, research and transport-equipment manufacturing; the Energy Authority, Tukes, Valvira and Fimea act as sector-specific supervisors for energy, industry, health and pharmaceuticals.

   kyberturvallisuuskeskus.fi tukes.fi

3. 03Incident reporting duties (NIS2)

   Entities in scope must file a three-stage report to the competent authority: an early warning within 24 hours of becoming aware of a significant incident, a formal incident notification within 72 hours, and a final report within one month (or within one month of resolution for long-running incidents).

   kyberturvallisuuskeskus.fi traficom.fi

4. 04Risk-management and registration obligations

   Essential and important entities had to register with the relevant supervisory authority by 8 May 2025 and to have an up-to-date cybersecurity risk-management operating model in place by 8 July 2025, covering governance, supply-chain security, incident handling, business continuity and management accountability under NIS2 Article 21.

   roschier.com legal.pwc.de

5. 05Sanctions and enforcement

   Supervisors have NIS2-aligned powers including remedial orders, on-site inspections and administrative fines; maximum penalties for essential entities can reach up to €10 million or 2% of global annual turnover under NIS2, with Finnish commentary highlighting exposure of up to €7 million plus operational and reputational impact.

   roschier.com econ.fi

6. 06Parallel and sectoral obligations

   GDPR personal-data breaches must be notified to the Office of the Data Protection Ombudsman within 72 hours; telecommunications operators additionally report significant information-security incidents to Traficom under the Act on Electronic Communications Services; the financial sector follows EU DORA rather than the Cybersecurity Act.

   resourcehub.bakermckenzie.com dlapiperdataprotection.com

NIS2 in Finland: FAQ

Timeline of decisions

1. 8 Apr 2025Law · official
   Cybersecurity Act (124/2025) enters into force, transposing NIS2

   Finland's first horizontal Cybersecurity Act took effect, consolidating NIS2 risk-management, incident-reporting and supervision obligations into a single statute and replacing the prior sector-by-sector model. NCSC-FI/Traficom serves as the central coordinating authority alongside sectoral supervisors.

   Traficom

2. 10 Oct 2024Guidance · official
   Cyber Security Strategy 2024-2035 adopted by Government Resolution

   The Government adopted a long-horizon national cyber strategy reflecting the deteriorated security environment and NIS2 requirements, with an accompanying implementation plan assigning responsibilities and metrics. It sets Finland's strategic cyber direction into the 2030s.

   Finnish Government (Valtioneuvosto)

3. 30 Apr 2024Enforcement
   Hacker sentenced to 6 years 3 months for Vastaamo breach

   Aleksanteri Kivimäki was convicted on roughly 9,600 counts of privacy violation and over 20,000 attempted extortions tied to the Vastaamo psychotherapy breach. The case, Finland's largest criminal investigation, drove public and political momentum for stronger data and cybersecurity protections.

   Recorded Future News

4. 21 Oct 2020Incident
   Vastaamo psychotherapy data breach and mass extortion

   A breach at psychotherapy provider Vastaamo exposed roughly 33,000 patients' therapy records, followed by ransom demands against the company and tens of thousands of individual patients. The shock catalyzed reforms in health-data security and victim protection across Finland.

   Digital Watch Observatory

5. 3 Oct 2019Guidance · official
   Finland's Cyber Security Strategy 2019 adopted

   The Government renewed the 2013 strategy with three guidelines, international cooperation, better coordination of cyber management/preparedness, and developing cyber competence. It modernized governance ahead of growing threats and EU obligations.

   Security Committee (Turvallisuuskomitea)

6. 9 May 2018Law · official
   NIS1 Directive transposed via amendments to twelve sector acts

   Rather than enacting a standalone law, Finland implemented the EU NIS Directive by amending some twelve existing statutes (including the Act on Electronic Communications Services and transport acts), introducing security and incident-notification duties for operators of essential services and digital service providers.

   NCSC-FI / Traficom

7. 1 Jan 2015Law · official
   Information Society Code (917/2014) enters into force

   This consolidating statute (later the Act on Electronic Communications Services) merged ten communications laws and set core duties on information security, confidentiality of communications, and traffic/location data, a foundational pillar of Finland's electronic-communications cybersecurity regime.

   Finlex (official statute database)

8. 1 Jan 2014Guidance · official
   National Cyber Security Centre Finland (NCSC-FI) established

   NCSC-FI was set up within the communications regulator (then FICORA, now Traficom) as the national CSIRT and situational-awareness hub for incident response and threat coordination. It remains the operational core of Finland's cyber framework.

   Traficom

9. 24 Jan 2013Guidance · official
   Finland's first Cyber Security Strategy (Government Resolution)

   The Government adopted Finland's inaugural national Cyber Security Strategy, defining objectives for securing the cyber domain and laying the groundwork for NCSC-FI and subsequent implementation programmes. It established the structural basis of today's framework.

   Finnish Ministry of Defence

Sources

1. 1.traficom.fi/en/news/cybersecurity-act-passed-parliament-obligations-under-nis-2-d
2. 2.kyberturvallisuuskeskus.fi/en/our-activities/regulation-and-supervision/nis2-european-union-cybe
3. 3.kyberturvallisuuskeskus.fi/en/toimintamme/saantely-ja-valvonta/nis2-euroopan-unionin-kyberturval
4. 4.valtioneuvosto.fi/en/-/1410829/government-submits-a-bill-for-cybersecurity-act-for-appr
5. 5.roschier.com/newsroom/nis2-and-finnish-cybersecurity-act
6. 6.legal.pwc.de/content/services/NIS-2/nis-2-finland.pdf
7. 7.resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/finland/topics/secur
8. 8.dlapiperdataprotection.com/index.html?t=breach-notification&c=FI
9. 9.tukes.fi/en/cybersecurity
10. 10.econ.fi/en/blog/regulatory-compliance/NIS2/finlands-new-cybersecurity-act-124