Runs an essential service, in Finland

Laki digitaalisten palvelujen tarjoamisesta (306/2019), 3 §, 3 luku (7-10 §) ja 4 luku (11-15 §) · Read the law's page

• If you provide a digital service within section 3(1), paragraphs 4 to 6 of the Act, ensure the perceivability and understandability of the content of your website or mobile application and the operability and robustness of its interfaces and navigation, in accordance with the accessibility requirements (s. 7(1)).
• Make the content of your digital service meet the accessibility requirements when it is available to users, and make pre-recorded time-based media meet them within 14 days of its first or repeated publication (s. 7(3)).
• If procurement law applies to your activity, take account of the accessibility requirements when you procure, as the Public Procurement Act (1397/2016) section 71(1) and the Act on Procurement by Entities in the Water, Energy, Transport and Postal Services Sectors (1398/2016) section 75(1) provide (s. 7(4)).
• Maintain an accessibility statement that contains at least an account of the parts of the content that do not meet the requirements and the reasons for departing, instructions for getting the information or service in an alternative way, an electronic contact for accessibility feedback, and a link to the supervisory authority's website for an accessibility complaint or request for clarification (s. 9(1)).
• Keep the statement in the format set by the European Commission's implementing act under Article 7(2) of Directive (EU) 2016/2102, easily available on your website in an accessible form; for a mobile application, make the statement accessible and available on your website or when the application is downloaded (s. 9(2) to (4)).
• Accept accessibility feedback, and requests for clarification of your disproportionate-burden grounds, from anyone at the electronic contact in your statement (s. 10(1)).
• Where a user needs content that does not meet the requirements to establish or exercise interests, rights or obligations, give that content, for a justified reason in an individual case, in a form that meets the requirements or in another way the user can access; the user makes the request to the electronic contact in your statement or to another alternative contact you publish, and if you do not give the content you draw up a written reasoned certificate for the requester (s. 10(2) and (4)).
• Send an electronic acknowledgement of receipt that states the time received, and answer feedback and requests without delay and within two weeks of the contact; you may extend the time by up to two weeks for a request that concerns a wide range of content, and must tell the requester (s. 10(3)).
• Bring the digital service into line with the requirements within a reasonable time when the supervisory authority, the Finnish Transport and Communications Agency (Traficom), orders it, and give a user the content they need in an accessible form within the time it sets when it so orders on the user's clarification request; the authority may back an order under section 12(3) with a conditional fine (ss. 11(2), 12(3) and 14).
• Give the supervisory authority, free of charge and notwithstanding secrecy provisions, the information and explanations it needs to handle a complaint or carry out supervision, in the time and form it orders; allow an inspection on your premises other than premises used for permanent residence, and give the access rights needed to reach services whose use is restricted online (s. 13).
• The accessibility requirements are those in the references to harmonized standards, or parts of them, that the European Commission publishes in the Official Journal of the European Union; the Act itself names no standard (s. 7(1)).
• Depart from the accessibility requirements only if a prior accessibility assessment lets you show that meeting them would impose a disproportionate burden on your activities, taking account of the needs of disabled people and of your size, financial position, and the nature and scale of your operations (s. 8).
• The Act does not apply to workplace intranets and extranets for a limited number of persons, teaching sites and applications used within a limited group for a limited time, public broadcasters' services other than audiovisual access services, live time-based media that is not stored for republication, maps and map services (although the essential guidance content of a navigation map must be offered in another accessible digital form), content you did not produce, finance or control, and heritage collection items that cannot be made accessible (s. 3(3)).
• The duties applied from 23 September 2019 to websites published on or after 23 September 2018, from 23 September 2020 to earlier websites and to pre-recorded time-based media, and from 23 June 2021 to mobile applications (s. 17(1), (2) and (5)); for entities in water and energy supply, transport and postal services and for credit, payment, investment and insurance providers the Act has applied from 1 January 2021 (s. 17(6)); content archived before 23 September 2019 is outside the Act, and office-software files published before 23 September 2018 are within chapter 3 only where they are needed to establish or exercise a party's interests, rights or obligations (s. 17(3) and (4)).

Kyberturvallisuuslaki (124/2025), 11-14 ja 22 § · Read the law's page

• This binds you on the same scope as this jurisdiction's companion risk-management row: an Annex I or Annex II activity at medium-enterprise size or above, or, regardless of size, if you are a public electronic communications provider, a trust service provider, a top-level-domain registry operator, a DNS service provider, or a certain critical entity; the online marketplace, online search engine and online social-networking-platform digital-service-providers named in Annex II are flagged here.
• Notify your supervisory authority without delay of a significant incident, one that has caused or could cause a serious service disruption or considerable financial loss to you, or that has affected or could affect another person with considerable material or immaterial damage.
• File an early notification within 24 hours of detecting the significant incident, stating whether it is suspected to result from an unlawful or hostile act and the likelihood of cross-border effects, and a follow-up notification within 72 hours of detection, both clocks running from detection rather than from each other; if you are a trust service provider whose trust services are affected, file your follow-up notification within 24 hours instead of 72.
• Provide an interim report on the authority's request, or within one month of your follow-up notification if the incident is long-running, and a final report within one month of the follow-up notification, or within one month of the incident's resolution if it is still ongoing at that point, describing the incident, its likely root cause, mitigation measures taken, and any cross-border effects.
• Notify the recipients of your services without delay of a significant incident likely to adversely affect your service to them, and of a significant cyberthreat that may affect them together with the measures available to counter it.

Kyberturvallisuuslaki (124/2025), 3 ja 7-10 § · Read the law's page

• Identify, assess and manage the risks to the network and information systems you use in your operations or to provide your services, and act to prevent or minimise an incident's impact on your operations, their continuity, the recipients of your services and other services.
• Maintain a documented cybersecurity risk-management operating model covering at minimum: risk-management policy and effectiveness assessment; network and information system security policy; security in acquisition, development and maintenance, including vulnerability handling and disclosure; supply-chain security, covering the quality and resilience of your direct suppliers' products and services and their cybersecurity practices; asset management and identification of security-critical functions; personnel security and cybersecurity training; access-control and authentication procedures; cryptography policy and, where needed, measures for secured electronic communication; incident detection and handling; backup, recovery planning, crisis management and business continuity; basic information-security practices; and security of the physical environment and premises and of essential resources.
• Have your board, supervisory board or chief executive approve and oversee this operating model; they must hold sufficient familiarity with cybersecurity risk management to do so.
• This binds you if you carry out an Annex I or Annex II activity and meet or exceed the medium-enterprise thresholds of Commission Recommendation 2003/361/EC, or, regardless of size, if you are a public electronic communications network or service provider, a trust service provider, a top-level-domain registry operator, a DNS service provider, or a critical entity designated outside the public administration sector under the Act on Protecting and Improving the Resilience of Critical Infrastructure (310/2025); an online marketplace, online search engine or online social-networking platform named in Annex II is reached as such, and the wider Annex I and Annex II sector classes are reached by declaring that you are an essential or important entity.
• The public administration sector named in NIS2 Annex I point 10 is carved out of this Act's own scope and governed instead by the Act on Information Management in Public Administration (906/2019), a different Finnish instrument.

172 a-172 d §, Laki sähköisen viestinnän palveluista (917/2014) · Read the law's page

• If you operate a top-level domain name registry, or are a domain name registrar, for domain names other than those ending in .fi or .ax, and your main establishment or EU-designated representative is in Finland (or you offer registrar services in Finland from outside the EU without a designated representative), the duties below bind you.
• As a registrar, notify the Finnish Transport and Communications Agency of your name, contact details, EU establishments, IP address ranges and the EU Member States where you offer services, and report changes to those details within two weeks (three months for establishment details) (section 172 b).
• Collect and maintain domain registration data that includes the data NIS 2 Directive Article 28(2) lists, and keep and publish policies and procedures that ensure the database is accurate and correct (section 172 c).
• Publish the registration data that is not personal data without undue delay after a domain is registered, and answer a lawful and duly reasoned request for access to the other registration data without undue delay and within 72 hours of receiving it (section 172 d).
• Publish your policies and procedures for disclosing registration data, and cooperate with other registries and registrars to meet sections 172 c and 172 d and to avoid collecting duplicate data (section 172 d).