Operates a social platform, in Finland

Freedom of Expression in Mass Media Act (Laki sananvapauden käyttämisestä joukkoviestinnässä 460/2003), Sections 3, 17, 18 and 22 · Read the law's page

• If you keep a transmitter, server or other device that carries online messages and a court orders you to, hand over the identifying data needed to identify the sender of a message the court has found probably punishable, and expect a conditional fine if you do not.
• If a court orders you to suspend the distribution of a published online message that is evidently punishable, suspend it, and do not make it available again while a request to revoke the order is pending unless the court allows.
• If a court orders an online message found unlawful in content to be removed from public availability and destroyed, remove and destroy it.

Act on Electronic Communications Services (Laki sähköisen viestinnän palveluista 917/2014), Sections 185 and 186, as amended by Act 20/2024 · Read the law's page

• If a district court orders you, as a hosting service provider, to block access to information you store, block access to it; the order is backed by a fine.
• Do not make the information available again while a request to revoke the blocking order is pending, unless the court hearing it allows.
• If the court so orders because the content producer is unknown, take care of serving the blocking order on the content producer.

Act on the Supervision of Online Intermediary Services (Laki verkon välityspalvelujen valvonnasta 18/2024), Sections 1 to 4, 13 to 16, 18 and 31 · Read the law's page

• Hand the competent authorities the information, clarifications and documents they need about a suspected breach of the Digital Services Act or this Act without undue delay, in the form they ask for, and free of charge.
• Meet the duties of Regulation (EU) 2022/2065 that Sections 14 to 17 make subject to a penalty payment: for every provider of an intermediary service, the single point of contact for authorities, the electronic point of contact for recipients and the legal representative (Articles 11 to 13); for a hosting service, the notice procedure, confirmation of receipt, notice of the decision, the statement of reasons and the report to the police (Articles 16 to 18); for an online platform, the internal complaint-handling system, priority for trusted flaggers, advertising transparency, recommender system parameters and the protection of minors (Articles 20, 22, 24(3) and 26 to 28).
• Carry out a supervision decision or other order of the competent authority, because the authority may enforce it with a daily conditional fine.

Kyberturvallisuuslaki (124/2025), 11-14 ja 22 § · Read the law's page

• This binds you on the same scope as this jurisdiction's companion risk-management row: an Annex I or Annex II activity at medium-enterprise size or above, or, regardless of size, if you are a public electronic communications provider, a trust service provider, a top-level-domain registry operator, a DNS service provider, or a certain critical entity; the online marketplace, online search engine and online social-networking-platform digital-service-providers named in Annex II are flagged here.
• Notify your supervisory authority without delay of a significant incident, one that has caused or could cause a serious service disruption or considerable financial loss to you, or that has affected or could affect another person with considerable material or immaterial damage.
• File an early notification within 24 hours of detecting the significant incident, stating whether it is suspected to result from an unlawful or hostile act and the likelihood of cross-border effects, and a follow-up notification within 72 hours of detection, both clocks running from detection rather than from each other; if you are a trust service provider whose trust services are affected, file your follow-up notification within 24 hours instead of 72.
• Provide an interim report on the authority's request, or within one month of your follow-up notification if the incident is long-running, and a final report within one month of the follow-up notification, or within one month of the incident's resolution if it is still ongoing at that point, describing the incident, its likely root cause, mitigation measures taken, and any cross-border effects.
• Notify the recipients of your services without delay of a significant incident likely to adversely affect your service to them, and of a significant cyberthreat that may affect them together with the measures available to counter it.

Kyberturvallisuuslaki (124/2025), 3 ja 7-10 § · Read the law's page

• Identify, assess and manage the risks to the network and information systems you use in your operations or to provide your services, and act to prevent or minimise an incident's impact on your operations, their continuity, the recipients of your services and other services.
• Maintain a documented cybersecurity risk-management operating model covering at minimum: risk-management policy and effectiveness assessment; network and information system security policy; security in acquisition, development and maintenance, including vulnerability handling and disclosure; supply-chain security, covering the quality and resilience of your direct suppliers' products and services and their cybersecurity practices; asset management and identification of security-critical functions; personnel security and cybersecurity training; access-control and authentication procedures; cryptography policy and, where needed, measures for secured electronic communication; incident detection and handling; backup, recovery planning, crisis management and business continuity; basic information-security practices; and security of the physical environment and premises and of essential resources.
• Have your board, supervisory board or chief executive approve and oversee this operating model; they must hold sufficient familiarity with cybersecurity risk management to do so.
• This binds you if you carry out an Annex I or Annex II activity and meet or exceed the medium-enterprise thresholds of Commission Recommendation 2003/361/EC, or, regardless of size, if you are a public electronic communications network or service provider, a trust service provider, a top-level-domain registry operator, a DNS service provider, or a critical entity designated outside the public administration sector under the Act on Protecting and Improving the Resilience of Critical Infrastructure (310/2025); an online marketplace, online search engine or online social-networking platform named in Annex II is reached as such, and the wider Annex I and Annex II sector classes are reached by declaring that you are an essential or important entity.
• The public administration sector named in NIS2 Annex I point 10 is carved out of this Act's own scope and governed instead by the Act on Information Management in Public Administration (906/2019), a different Finnish instrument.

Hallituksen esitys HE 190/2026 vp, laki tuotevastuulain muuttamisesta · Read the law's page

• If you develop, make or produce software, including software supplied through a cloud or as a service, you answer as its manufacturer; free and open-source software developed or supplied outside commercial activity is outside the Act (Secs. 1 a and 2 point 5).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is under your control: a lack of safety caused by software, an update or upgrade, a related service, a missing necessary update or a substantial modification is not excused because it arose after you put the product on the market (Sec. 7).
• Meet the mandatory product-safety requirements that apply to your product, because a product that fails them is presumed to lack safety (Sec. 4 b).
• Be ready to produce the evidence a court orders disclosed and to present it, on a party's request, in an easily accessible and understandable form, because failing to comply with a disclosure order presumes the product defective (Secs. 4 b and 13 b).
• If you are established outside the European Union, your importer, your authorized representative or, if there is neither, your fulfilment service provider answers beside you (Sec. 5).
• If you distribute a product or run an online platform that lets consumers conclude distance contracts, you answer when no liable operator can be identified or established in the Union, unless you name one within a month of the request (Sec. 6).
• Be ready to show that the objective state of scientific and technical knowledge when you placed the product on the market, or while it was under your control, did not allow the lack of safety to be detected (Sec. 7).
• Count the destruction or corruption of data used exclusively for personal purposes as compensable economic loss, with no lower limit for property damage (Sec. 8).
• A claim must be brought within three years of the injured person learning, or having reason to learn, of the damage, the lack of safety and the liable person, and within ten years of the product being placed on the market or put into use, or 25 years for latent personal injury (Sec. 9).