Provides telecom services, in Finland

274 ja 275 §, Laki sähköisen viestinnän palveluista (917/2014) · Read the law's page

• If you are a telecommunications operator (teleyritys) providing a communications service in Finland, notify your subscribers and users without delay when a significant information-security breach, or another event that prevents the service from working or materially disturbs it, affects or threatens your service (Act 917/2014, section 274).
• If you provide a value-added service as a value-added service provider (lisäarvopalvelun tarjoaja), notify your users without delay of a significant information-security breach, or the threat of one, affecting your service (section 274).
• In each such notice state the estimated duration of the disturbance or its threat, the protective measures open to subscribers and users, their probable costs and where more information is available, and keep records of the notices (section 274).
• As a telecommunications operator, notify the Finnish Transport and Communications Agency without delay of the same kind of breach or event, then report without undue delay its estimated duration and effects, the corrective measures taken and the measures taken to prevent it recurring (section 275).

Tietoyhteiskuntakaari (917/2014), 132 § · Read the law's page

• If you are a telecommunications company, offer a service that lets the recipient of a call see the caller's number before answering, and make it possible to block the display of the number (section 132).
• Give the subscriber an easy way to block identification of the subscriber's own line, identification of incoming calls, receipt of incoming calls whose identification is blocked where that is technically possible without unreasonable cost, and identification of the line to which incoming calls are forwarded. The first, second and fourth blocks must be free of charge to the subscriber (section 132).
• Give each user an easy and free way to block identification of the user's line for every outgoing call separately (section 132).
• Make sure the blocks can be overridden when information is handed to the authorities that receive emergency notifications or to the police (section 132).

Tietoyhteiskuntakaari (917/2014), 86 ja 87 § · Read the law's page

• If you are a telecommunications company designated as a universal service undertaking for public telephone services, provide a connection to the public communications network to a user or microenterprise at a permanent residence or location, wherever it is, at a price reasonable for the average user (section 86).
• Deliver that connection within a reasonable time of the order, and make it available without mandatory additional services or functions (section 86).
• If you are designated as a universal service undertaking for internet access service, provide a connection to the public communications network on the same terms, and let all users and microenterprises have an adequate internet connection, taking into account the connection speed used by the majority of users, technical feasibility and cost (section 87).

Kyberturvallisuuslaki (124/2025), 11-14 ja 22 § · Read the law's page

• This binds you on the same scope as this jurisdiction's companion risk-management row: an Annex I or Annex II activity at medium-enterprise size or above, or, regardless of size, if you are a public electronic communications provider, a trust service provider, a top-level-domain registry operator, a DNS service provider, or a certain critical entity; the online marketplace, online search engine and online social-networking-platform digital-service-providers named in Annex II are flagged here.
• Notify your supervisory authority without delay of a significant incident, one that has caused or could cause a serious service disruption or considerable financial loss to you, or that has affected or could affect another person with considerable material or immaterial damage.
• File an early notification within 24 hours of detecting the significant incident, stating whether it is suspected to result from an unlawful or hostile act and the likelihood of cross-border effects, and a follow-up notification within 72 hours of detection, both clocks running from detection rather than from each other; if you are a trust service provider whose trust services are affected, file your follow-up notification within 24 hours instead of 72.
• Provide an interim report on the authority's request, or within one month of your follow-up notification if the incident is long-running, and a final report within one month of the follow-up notification, or within one month of the incident's resolution if it is still ongoing at that point, describing the incident, its likely root cause, mitigation measures taken, and any cross-border effects.
• Notify the recipients of your services without delay of a significant incident likely to adversely affect your service to them, and of a significant cyberthreat that may affect them together with the measures available to counter it.

Kyberturvallisuuslaki (124/2025), 3 ja 7-10 § · Read the law's page

• Identify, assess and manage the risks to the network and information systems you use in your operations or to provide your services, and act to prevent or minimise an incident's impact on your operations, their continuity, the recipients of your services and other services.
• Maintain a documented cybersecurity risk-management operating model covering at minimum: risk-management policy and effectiveness assessment; network and information system security policy; security in acquisition, development and maintenance, including vulnerability handling and disclosure; supply-chain security, covering the quality and resilience of your direct suppliers' products and services and their cybersecurity practices; asset management and identification of security-critical functions; personnel security and cybersecurity training; access-control and authentication procedures; cryptography policy and, where needed, measures for secured electronic communication; incident detection and handling; backup, recovery planning, crisis management and business continuity; basic information-security practices; and security of the physical environment and premises and of essential resources.
• Have your board, supervisory board or chief executive approve and oversee this operating model; they must hold sufficient familiarity with cybersecurity risk management to do so.
• This binds you if you carry out an Annex I or Annex II activity and meet or exceed the medium-enterprise thresholds of Commission Recommendation 2003/361/EC, or, regardless of size, if you are a public electronic communications network or service provider, a trust service provider, a top-level-domain registry operator, a DNS service provider, or a critical entity designated outside the public administration sector under the Act on Protecting and Improving the Resilience of Critical Infrastructure (310/2025); an online marketplace, online search engine or online social-networking platform named in Annex II is reached as such, and the wider Annex I and Annex II sector classes are reached by declaring that you are an essential or important entity.
• The public administration sector named in NIS2 Annex I point 10 is carved out of this Act's own scope and governed instead by the Act on Information Management in Public Administration (906/2019), a different Finnish instrument.

Laki digitaalisten palvelujen tarjoamisesta (306/2019), 3 a luku (10 a-10 g §), ja valtioneuvoston asetus eräiden digitaalisten palvelujen saavutettavuusvaatimuksista (179/2023) · Read the law's page

• If you offer passenger transport, e-book, online shop, consumer credit, investment, payment, basic payment account or electronic money services to consumers through a website or app, or a service that gives access to audiovisual content services or a communications service, make the digital service meet the additional requirements of section 10 c on top of section 7, from 28 June 2025 (ss. 10 a and 10 c(1)). Chapter 3a does not apply to the digital services of a microenterprise, which section 4, paragraph 2 of Act 102/2023 defines as an undertaking that employs fewer than 10 employees and has an annual turnover of at most EUR 2 million or an annual balance sheet total of at most EUR 2 million (s. 10 b).
• Meet chapter 3 as well: keep the accessibility statement of section 9 and handle accessibility feedback and requests for content in an accessible form within two weeks under section 10, which the government bill treats as part of the Directive's support-services requirement (ss. 9, 10 and 10 f).
• Give information on how the digital service works, and where it needs a particular product, state in the accessibility statement how the product relates to the service, what accessibility features it has and how it works with assistive devices (s. 10 c(3); Decree 179/2023 s. 2).
• Keep the information on consumer credit, investment, payment and banking services understandable, at no more than level B2 of the Common European Framework of Reference for Languages (s. 10 c(3); Decree 179/2023 s. 3).
• Make an e-book accessible so that it can be processed, read, used and navigated, with synchronized text and audio where it has both, files that do not stop assistive technology from working, access and navigation as the user chooses, alternative presentations, accessibility metadata and digital rights management that does not block the accessibility features (s. 10 c(3); Decree 179/2023 s. 4).
• Give information on the accessibility of the products and services in your online shop when the economic operator responsible for them has supplied that information to you (Decree 179/2023 s. 5).
• Where you rely on an alternative, equally accessible way of using the service instead of the requirements, meet the ten functional performance requirements of the Decree (s. 10 c(4); Decree 179/2023 s. 6).
• If you provide communications services or services that give access to audiovisual content services, meet the additional requirements in sections 194 c and 194 d of the Act on Electronic Communications Services (917/2014) (s. 10 c(5)).
• If you depart from the requirements, notify the supervisory authority, document the assessment, submit it on request and keep it for five years from when you last offered the digital service, and make the assessment again when the content changes, when the authority asks and at least every five years (s. 10 e).
• Publish in the accessibility statement that section 9 requires, in addition to its contents, a general description of the digital service and an account of how it meets the additional requirements of the Directive (s. 10 f).
• Notify the supervisory authority of any shortcomings in the accessibility of the digital service and of the corrective measures (s. 10 g).
• Bring the digital service into line within a reasonable time when Traficom orders it, and give Traficom the information it needs free of charge and access to your premises for an inspection; Traficom may back the order, the information duty and the inspection with a conditional fine (ss. 12(3), 13 and 14).
• Follow the harmonized standards or technical specifications that the Directive's Article 15 refers to if you want the digital service treated as meeting the requirements those standards or specifications cover (s. 10 c(2)).
• Depart from the accessibility requirements only if an accessibility assessment lets you show that compliance would impose the disproportionate burden of section 8 or a fundamental change to the basic nature of the service, and do not rely on the burden if you receive funding from outside your own funds that is granted for improving accessibility (s. 10 d).
• The Act does not apply to live time-based media that is not stored for republication, online maps and map services (although the essential guidance content of a navigation map must be offered in another accessible digital form), content you did not produce, finance or control, heritage collection items that cannot be made accessible, or the digital services of a public service broadcaster other than services giving access to audiovisual content services (s. 3(3)).
• Chapter 3a does not apply to website and app content archived before 28 June 2025, to pre-recorded time-based media or office files published before that day, and a service contract made before 28 June 2025 may continue unchanged until it expires, but for no longer than five years from that day (Act 104/2023, transitional provisions; Decree 179/2023 s. 7).

Laki sähköisen viestinnän palveluista (917/2014), 22 a luku (194 a-194 h §), ja valtioneuvoston asetus sähköisen viestinnän palvelujen ja audiovisuaalisiin sisältöpalveluihin pääsyn tarjoavien palvelujen esteettömyysvaatimuksista (180/2023) · Read the law's page

• If you offer interpersonal communications, internet access or audiovisual-content-access services to consumers, keep procedures in place so that the applicable accessibility requirements are met for as long as you provide the service, from 28 June 2025 (ss. 194 a and 194 b(1)).
• Give information on how the service works and, where products are used to provide it, on how they relate to the service, what accessibility features they have and how they work with assistive devices, in the forms Decree 180/2023 section 1 lists (s. 194 b(2); Decree 180/2023 s. 1).
• Have your support services give information on the accessibility of the service and its compatibility with assistive technology, using accessible means of communication (s. 194 b(3)).
• If you provide an interpersonal communications service, offer real-time text in addition to voice, and full interactivity features where you offer video in addition to voice (s. 194 c).
• If you provide a service that gives access to audiovisual content services, offer electronic programme guides that are easily perceivable, controllable, understandable and robust and that include information on the availability of accessibility features, and make sure that the accessibility features of the audiovisual content services are transmitted in sufficient quality, accurately presented, synchronized with audio and video, and controllable by the user (s. 194 d).
• Notify Traficom of any shortcoming in the accessibility of the service and of the corrective measures, supply on request all information needed to show that the service meets the requirements, and cooperate in bringing it into conformity (s. 194 e).
• Depart from the requirements only if an assessment shows that meeting them would fundamentally alter the basic nature of the service or impose a disproportionate burden on you, do not rely on the burden if you receive funding from outside your own funds granted for improving accessibility, notify the supervisory authority, document the assessment, keep it for five years from when you last offered the service, give the authority a copy on request, correct the shortcomings the authority finds in it within the period it sets, and make the assessment again when the service is changed, when the authority orders it and at least every five years (s. 194 f).
• Publish in accessible form a description of the service and its operation so that it can be assessed how the service meets sections 194 b to 194 d, state which requirements the service does not meet where you depart under section 194 f, and keep that information for as long as you offer the service (s. 194 g).
• Where you rely on an alternative way of using the service that follows the ten functional performance requirements of Decree 180/2023 section 2, make sure the service is at least as accessible as one meeting sections 194 b to 194 d (s. 194 h; Decree 180/2023 s. 2).
• Correct a breach when Traficom orders it within a reasonable time; the order may be backed by a conditional fine, a threat of discontinuation or a threat that the omitted measure is carried out at your expense (ss. 330 and 332).
• Chapter 22 a does not apply to a microenterprise, which section 3, paragraph 11 a defines by Commission Recommendation 2003/361/EC (an enterprise that employs fewer than 10 persons and whose annual turnover or annual balance sheet total does not exceed EUR 2 million), or to machine-to-machine transmission services (s. 194 a(1)).
• Follow the harmonized standards or technical specifications that Article 15 of Directive (EU) 2019/882 refers to if you want the service treated as meeting the requirements of sections 194 b to 194 d that those standards or specifications cover (s. 194 b(4)).
• Service contracts within chapter 22 a made before 28 June 2025 may continue unchanged until they expire, but for no longer than five years from that day, and the products you use to provide the services must conform by 28 June 2030 (Act 105/2023, entry into force).