Cybersecurity law in Finland: NIS2 compliance (2026)

Finland's first horizontal Cybersecurity Act took effect, consolidating NIS2 risk-management, incident-reporting and supervision obligations into a single statute and replacing the prior sector-by-sector model. NCSC-FI/Traficom serves as the central coordinating authority alongside sectoral supervisors.

The Government adopted a long-horizon national cyber strategy reflecting the deteriorated security environment and NIS2 requirements, with an accompanying implementation plan assigning responsibilities and metrics. It sets Finland's strategic cyber direction into the 2030s.

Aleksanteri Kivimäki was convicted on roughly 9,600 counts of privacy violation and over 20,000 attempted extortions tied to the Vastaamo psychotherapy breach. The case, Finland's largest criminal investigation, drove public and political momentum for stronger data and cybersecurity protections.

The undersea gas pipeline and a parallel telecommunications cable linking Finland and Estonia were severed by 'external activity', later attributed to a ship's dragged anchor. The incident heightened Finnish concern over critical-infrastructure and subsea-cable security amid regional tensions.

The pro-Russian group NoName057(16) knocked the Finnish Parliament's website offline, citing Finland's NATO application. It underscored the wave of politically motivated DDoS targeting against Finnish public bodies.

The websites of Finland's Ministry of Foreign Affairs and Ministry of Defence were knocked offline by a DDoS attack as President Zelensky addressed parliament, assessed as Russia-linked and tied to Finland's NATO trajectory. It marked a visible escalation of state-aligned cyber pressure.

A breach at psychotherapy provider Vastaamo exposed roughly 33,000 patients' therapy records, followed by ransom demands against the company and tens of thousands of individual patients. The shock catalyzed reforms in health-data security and victim protection across Finland.

The Government renewed the 2013 strategy with three guidelines, international cooperation, better coordination of cyber management/preparedness, and developing cyber competence. It modernized governance ahead of growing threats and EU obligations.

Rather than enacting a standalone law, Finland implemented the EU NIS Directive by amending some twelve existing statutes (including the Act on Electronic Communications Services and transport acts), introducing security and incident-notification duties for operators of essential services and digital service providers.

This consolidating statute (later the Act on Electronic Communications Services) merged ten communications laws and set core duties on information security, confidentiality of communications, and traffic/location data, a foundational pillar of Finland's electronic-communications cybersecurity regime.

NCSC-FI was set up within the communications regulator (then FICORA, now Traficom) as the national CSIRT and situational-awareness hub for incident response and threat coordination. It remains the operational core of Finland's cyber framework.

The Government adopted Finland's inaugural national Cyber Security Strategy, defining objectives for securing the cyber domain and laying the groundwork for NCSC-FI and subsequent implementation programmes. It established the structural basis of today's framework.