Law / Finland

Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars

172 a-172 d §, Laki sähköisen viestinnän palveluista (917/2014)

In force since 1 Jun 2026.

A sector security regimes rule binding private bodies.

Private right of action

No

Obligation class

Security, Reporting, Disclosure, Governance

As of 12 October 2026.

What it requires

• If you operate a top-level domain name registry, or are a domain name registrar, for domain names other than those ending in .fi or .ax, and your main establishment or EU-designated representative is in Finland (or you offer registrar services in Finland from outside the EU without a designated representative), the duties below bind you.
• As a registrar, notify the Finnish Transport and Communications Agency of your name, contact details, EU establishments, IP address ranges and the EU Member States where you offer services, and report changes to those details within two weeks (three months for establishment details) (section 172 b).NIST CSF 2.0GV.OC-03
• Collect and maintain domain registration data that includes the data NIS 2 Directive Article 28(2) lists, and keep and publish policies and procedures that ensure the database is accurate and correct (section 172 c).no control in the NIST CSF 2.0
• Publish the registration data that is not personal data without undue delay after a domain is registered, and answer a lawful and duly reasoned request for access to the other registration data without undue delay and within 72 hours of receiving it (section 172 d).no control in the NIST CSF 2.0
• Publish your policies and procedures for disclosing registration data, and cooperate with other registries and registrars to meet sections 172 c and 172 d and to avoid collecting duplicate data (section 172 d).no control in the NIST CSF 2.0

These lines are LexLint's reading of the law's text, as of 12 October 2026.

In the frameworks

NIST CSF 2.0

• GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

CIS Controls

• 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
• 8.2Turning on and gathering logs from the enterprise's systems.
• 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.

FINOS AIGF

• AIR-PREV-005System Acceptance Testing
• AIR-PREV-006Data Quality & Classification/Sensitivity
• AIR-PREV-024Human-in-the-Loop Action Approval Gate
• AIR-DET-004AI System Observability
• AIR-DET-011Human Feedback Loop for AI Systems
• AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

• 1.1Policy on the security of network and information systems
• 1.2Roles, responsibilities and authorities
• 2.2Compliance monitoring
• 3.1Incident handling policy
• 3.2Monitoring and logging
• 3.4Event assessment and classification

4 more

• 3.5Incident response
• 3.6Post-incident reviews
• 4.3Crisis management
• 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

When LexLint raises it

When your app profile says your app runs an essential service.

Back to the example  ·  Lint your app