Our Expert in Finland

GOLD

Annastiina Latvasaho

GOLD

Cross‑border Criminal Investigations in Finland 2026: Boards’ & Companies’ Duties When Foreign Authorities Seek Evidence

By Global Law Experts

– posted 2 hours ago

Cross‑border criminal investigations finland has become one of the most operationally sensitive challenges facing Finnish boards, general counsel and compliance leaders in 2026. Foreign prosecutors are issuing more evidence demands, corporate liability doctrines have hardened, and the interplay between criminal procedure and data protection now creates genuine director-level exposure. This guide is written for the people who must make the decision under pressure, whether to comply, produce under protest, or insist that a foreign authority route its request through mutual legal assistance. It sets out a practical, board-level decision framework, an hour-by-hour operational checklist, the legal pathways that govern foreign evidence requests, and the GDPR risks that follow every cross‑border data transfer.

Search-intent summary. Audience: boards, general counsel, compliance officers and executives in Finnish companies facing foreign criminal evidence demands. Purpose: practical decision support, immediate operational checklist, legal pathways (MLA/EIO), data-transfer risk mitigation, and board governance actions. Outcome: a framework that lets you choose between immediate compliance, seeking an MLA, or pushing back, with templates and escalation triggers.

Executive summary for boards and GCs, immediate decisions

When a foreign authority contacts a Finnish company for documents, data or testimony, the first hours determine your legal position for months. The instinct to cooperate quickly can waive privilege, breach GDPR, and expose the company and its directors to secondary liability. Equally, reflexive refusal can trigger foreign enforcement escalation. The correct response is disciplined triage: preserve first, assess the legal basis of the request, and decide the forum before you disclose anything.

Finland is a high‑trust, rule‑of‑law jurisdiction with mature institutions, established central authorities for judicial assistance, and clear statutory routes for cross‑border cooperation. That infrastructure works in your favour, it gives you legitimate grounds to require foreign authorities to use proper channels rather than informal demands. The task for the board is to use those channels deliberately, not to be rushed into disclosure.

Preserve. Issue an immediate legal hold and preservation notice; suspend routine deletion of relevant records and communications.
Notify counsel. Engage Finnish criminal counsel before responding to any foreign request, and flag privilege and data-protection issues at once.
Assess the forum. Determine whether the request is a direct foreign subpoena, a European Investigation Order (EIO), or a mutual legal assistance (MLA) request, and whether it has any basis in Finnish law.
Escalate. Notify the board if the matter carries material financial, regulatory, operational or reputational risk.

Who should be notified internally

Notification should follow a pre-agreed escalation map. At minimum, the general counsel, the CEO and the head of compliance should be informed within hours. Where the request touches senior individuals, core business lines, or regulated activity, the chair of the board and the audit or risk committee should be briefed under legal privilege. A named response owner should coordinate IT forensics, external counsel and communications so that no employee responds unilaterally to the foreign authority.

Legal framework, how foreign evidence requests intersect Finnish law

Cross‑border criminal investigations finland are governed by a layered framework: Finnish criminal procedure rules, EU instruments for intra-EU cooperation, and international conventions for cooperation beyond the Union. Understanding which layer applies is the single most important analytical step, because it dictates who may lawfully compel production, on what terms, and with what safeguards.

As a starting principle, a foreign authority has no direct coercive power inside Finland. It cannot execute a search, seize documents, or compel testimony on Finnish territory on its own authority. It must instead request the assistance of Finnish authorities through a recognised legal channel. This principle is the practical foundation for every push-back decision described later in this guide.

Central authorities and the statutory route for mutual legal assistance finland

Finland channels formal international judicial assistance through designated central authorities. Depending on the type of request, the Ministry of Justice and the Office of the Prosecutor General (Syyttäjälaitos) handle and coordinate mutual legal assistance requests, liaising with foreign central authorities and domestic prosecutors and courts as needed. Under many EU and international instruments, requests may also be transmitted directly between competent judicial authorities. A properly formed MLA request Finland receives is assessed for legitimacy, scope and compatibility with Finnish law before any coercive measure is taken domestically. For companies, the significance is straightforward: where a foreign state wants documents held in Finland, the orderly path runs through these formal channels, not through an email demand to your compliance inbox.

European instruments, EIO vs EAW vs MLA

Within the EU, the European Investigation Order under Directive 2014/41/EU is the primary mechanism for gathering cross‑border evidence Finland-based entities may hold. An EIO is issued by a judicial authority in one Member State and executed by the competent authority in another, subject to defined grounds for refusal and time limits. It is distinct from the European Arrest Warrant, which concerns the surrender of persons, and from classic MLA, which applies to cooperation with states outside the EIO regime. In broad terms:

EIO. Use between participating EU Member States for obtaining evidence, bank records, documents, witness statements, under a harmonised, judicially controlled procedure.
EAW. Use for arrest and surrender of a person, not for document production.
MLA. Use for cooperation with non-EIO states, framed by conventions such as the European Convention on Mutual Assistance in Criminal Matters (1959).

Relevant Finnish statutes and the 2026 enforcement climate

The domestic procedural rules governing searches, seizures and compelled production, including the Coercive Measures Act (pakkokeinolaki) and the Act on International Legal Assistance in Criminal Matters, are available through the Finlex gateway. In 2026 the practical significance of these rules has increased: broader corporate liability thinking and more active cross-border enforcement mean that the way a company responds to a foreign request can itself become a governance and liability issue. Practical cooperation between authorities is further supported at EU level through Eurojust, which coordinates complex cross-border casework. Where a specific statutory provision or amendment governs your situation, confirm the current consolidated text on Finlex with counsel before acting.

Immediate operational steps, a 10-point checklist for companies

The following checklist is time-bound and owner-assigned. It is designed to protect evidence, preserve legal defences, and prevent unauthorised disclosure during an international criminal investigation Finland companies may face. Adapt the owners to your organisation, but keep the sequencing.

0–24 hours: containment and preservation

Issue a legal hold (owner: GC). Send a preservation notice to all custodians likely to hold relevant records, suspending automatic deletion and archiving policies.
Secure systems and devices (owner: Head of IT/Forensics). Preserve email, messaging platforms, server logs and mobile devices in forensically sound form; do not let anyone “clean up” files.
Log the request (owner: GC). Record exactly how the request arrived, from whom, in what form, and what it demands, this preservation request Finland record is critical for later legal assessment.
Instruct staff (owner: Compliance). Direct that no employee communicates with the foreign authority or transfers any material without counsel sign-off.

24–72 hours: legal assessment and engagement with Finnish counsel

Engage Finnish criminal counsel (owner: GC). Confirm whether the request is a direct foreign demand, an EIO, or an MLA, and whether it has any Finnish legal basis.
Map privilege (owner: External counsel). Identify potentially privileged material and segregate it before any review for production.
Assess data-protection exposure (owner: DPO). Identify personal data within scope and the lawful basis, if any, for transferring it abroad.

72 hours and beyond: procedural decisions

Choose the response path (owner: Board/GC). Decide whether to comply with safeguards, produce under protest, or require the requesting state to use MLA/EIO.
Prepare narrow production or objection (owner: External counsel). If producing, scope it tightly; if declining, prepare a reasoned objection and, where appropriate, seek judicial review of scope.
Document board decisions (owner: Company Secretary). Record the rationale, approvals and safeguards in board minutes to evidence good governance.

Template: preservation notice language (short sample)

“You are directed to preserve, and must not delete, alter or move, all documents, emails, messages, files and records (in any format) relating to [subject/matter/date range]. This includes materials on company systems and personal devices used for work. Automatic deletion for these materials is suspended until further notice. Direct any questions to [named legal contact] only.”

On the practical question of legal cost: fees for Finnish counsel vary by seniority, complexity and urgency, and cross-border criminal matters typically command specialist rates. Agree a scope and fee framework early, and consult the Finnish Bar Association for guidance on engaging qualified advocates.

MLA, EIO and requesting-country demands, pathways and tactical decisions

Responding to foreign prosecutors well is a matter of sequencing and forum control. Evaluate every incoming demand against four questions: Is it a direct foreign subpoena or a formal MLA/EIO? Is it legitimate and proportionate in scope? Should you refuse or seek judicial review? What timelines and appeal routes apply? The answers determine whether you produce, negotiate, or push the request into a formal channel.

When a foreign search warrant or subpoena arrives directly at a Finnish entity

A foreign search warrant or subpoena served directly on a Finnish company generally has no coercive effect in Finland. It is, in effect, a request. Treat it as the start of a negotiation about forum, not as a binding order. You may lawfully decline to act on a direct foreign demand absent Finnish legal authority, and instead invite the requesting state to proceed through the appropriate central authority or judicial channel. There are cases where voluntary, narrowly scoped production is commercially sensible, but that is a decision to be taken deliberately, with counsel, and with data-protection safeguards, not under informal pressure.

When to require the requesting authority to send an MLA

Insist on a formal MLA or EIO where the request is broad, where it seeks personal data of employees or third parties, where privilege is engaged, or where compliance could itself create liability. Requiring the formal channel is not obstruction, it is the legally correct route, and it produces a defensible record. It forces the foreign authority to specify the offence, the legal basis and the precise material sought, and it interposes Finnish authorities who can test proportionality and apply domestic safeguards. It also buys time to consult the data protection authority and to negotiate the scope of any eventual production.

Expected timeline and reality

Formal channels take longer than informal demands. Initial administrative processing of an MLA or EIO can take weeks; complex productions, judicial authorisations or contested scope can take months. The EIO Directive sets indicative deadlines for recognition and execution, though practice varies with complexity. Liaison arrangements and coordination through EU agencies can accelerate straightforward matters. The practical implication is critical: because the formal route is slower, preservation is non-negotiable. You must lock down the evidence immediately so that nothing is lost while the MLA or EIO process runs.

When to seek limitation, clarification, or narrow production

Rarely is the right answer “all or nothing”. Where a request is over-broad, ask the requesting or executing authority to limit it by date range, custodian or category. Where terms are ambiguous, seek clarification in writing before producing. Where a narrow, clearly relevant set of documents answers the legitimate core of the request, conditional narrow production, with redactions and a privilege log, can resolve matters without surrendering the whole file.

Data protection and cross‑border transfers, GDPR, the DPA, and compelled disclosure

Every disclosure of personal data to a foreign authority is a processing operation governed by the GDPR (and, for competent authorities processing in the criminal-justice context, the Law Enforcement Directive framework as implemented in Finnish law). Handling data transfer requests police or prosecutors make without a lawful basis and appropriate safeguards can turn a criminal-cooperation issue into a data-protection breach with its own regulatory exposure. This is where cross‑border criminal investigations finland companies face most often go wrong.

GDPR versus criminal process, can you share personal data with foreign prosecutors?

You can, but only where you have an adequate legal basis and, where required, a lawful transfer mechanism. A transfer compelled by a valid Finnish court order or executed EIO stands on a firmer footing than a voluntary hand-over in response to an informal foreign demand. Notably, GDPR Article 48 provides that a judgment or decision of a third-country authority requiring a transfer is not, by itself, a recognised basis for transfer unless it rests on an international agreement such as an MLA treaty. Where you are contemplating voluntary production, you must identify the lawful basis, assess whether the transfer to a third country is permitted, and document that analysis before any data leaves the company.

Practical steps to minimise data-protection risk

Data minimisation. Produce only what is strictly responsive; do not over-disclose to appear cooperative.
Redaction. Remove personal data of uninvolved third parties before production.
Pseudonymisation. Where identity is not essential to the request, pseudonymise to reduce exposure.
Protective conditions. Seek assurances or protective orders limiting onward use and disclosure of the material.

Liaising with the Finnish Data Protection Authority

For contested or high-volume disclosures, consult the guidance of the Office of the Data Protection Ombudsman on disclosure to law enforcement and document your decision-making. Recording your data protection assessment, the safeguards applied and the reasons for any transfer demonstrates accountability and provides a defence if the disclosure is later questioned. The formal MLA/EIO route is advantageous here too: it gives time to consult the authority and to build that record before you produce.

Sample wording for conditional production

“The enclosed material is produced solely in response to [reference], on the condition that it is used only for the stated investigation, is not further disclosed without notice to us, and is handled in accordance with applicable data-protection safeguards. Personal data of uninvolved third parties has been redacted. Privileged material has been withheld and is listed in the accompanying schedule.”

Privilege, corporate investigations and director liability

Privilege in Finland is framed differently from common-law systems, and misunderstanding it is a frequent, costly error in corporate investigations Finland companies run alongside foreign requests. Assess privilege deliberately and early, because inadvertent waiver during a rushed cross-border production cannot be undone.

What is legally protected in Finland?

Under Finnish procedural law, an advocate’s (asianajaja) confidentiality and secrecy obligations, and corresponding limits on compelled testimony and seizure regarding a client’s legal matters, protect certain communications with counsel. However, the reach of this protection is narrower and differs from the broad “legal professional privilege” of common-law systems, and its application to in-house counsel and to internal investigatory material is limited. Internal investigatory notes, factual working papers and communications that are not genuinely legal advice may not be protected in the same way. Confirm the scope with counsel and consult the standards published by the Finnish Bar Association and relevant case law of the Supreme Court of Finland.

Managing privilege during cross-border production

Segregate potentially protected material before any responsiveness review. Apply privilege filters, maintain a privilege log, and never produce documents in bulk without a screen. Where a foreign authority disputes a protection claim, resolve it through the formal channel rather than by capitulating, because unilateral disclosure risks waiving the protection for all purposes.

Board governance: escalation, minutes and indemnities

In the 2026 enforcement climate, directors carry real exposure where a company mishandles a cross-border request. The board should set pre-agreed escalation thresholds, ensure decisions are minuted with their rationale, and consider indemnity and insurance arrangements for directors acting properly in good faith, within the limits permitted by Finnish company law. Good governance here is not administrative box-ticking, clear board minutes evidencing a reasoned, advised decision are themselves a defence.

Decision framework for cross‑border criminal investigations finland, comply or require MLA

The central decision reduces to two archetypes: comply and produce with safeguards, or decline the direct demand and require the requesting state to use MLA/EIO and, where appropriate, seek a judicial route. The table below compares them across the dimensions that matter to a board. Our position is clear: where a request is broad, lacks a Finnish legal basis, or engages significant privilege or data-protection risk, require the formal channel. Reserve immediate compliance for narrow requests backed by a valid Finnish order or executed EIO.

Dimension	Comply / Produce (with safeguards)	Decline / Require MLA & seek judicial route
Legal basis to act	When the request is lawful, narrow and corresponds to a Finnish order or valid EIO; immediate production where compelled by a Finnish court	When the foreign request lacks a Finnish legal basis or is overly broad; refuse direct foreign subpoenas absent Finnish authority
Timing / latency	Fast (hours–days); satisfies the foreign authority quickly and reduces immediate pressure	Slower (weeks–months); requires formal processing and may prompt foreign escalation
Data-protection / GDPR risk	Higher if transferred without safeguards; mitigate with redaction, pseudonymisation and protective conditions; document the assessment	Lower if production is delayed pending MLA and DPA consultation; time to negotiate safeguards
Privilege risk	Immediate production may risk inadvertent waiver; use privilege logs and filters	Preserving documents avoids waiver and allows judicial review of scope
Company / director liability	Reduced short-term pressure; possible long-term exposure if production reveals misconduct without board action	Possible short-term enforcement pressure; protects against careless disclosure and preserves defences
Foreign enforcement risk	May defuse immediate action; could invite further requests if seen as freely cooperative	May provoke warrants or contempt claims abroad, but the formal MLA is standardised and defensible
Board governance	Requires rapid briefing and possibly an emergency resolution authorising production	Requires board approval for refusal, litigation and escalation of risk
Cost / resources	Lower short-term legal cost; potentially higher remediation and liability cost later	Higher immediate legal cost, but better controlled risk allocation and documentation
When to choose	Narrow request, critical business continuity, or a valid Finnish order/EIO exists	Broad request, no Finnish legal basis, or significant privilege/GDPR risk with MLA/EIO available
Tactical safeguards	Narrow productions, redactions, protective conditions, conditional production	Require MLA/EIO, request formal assurances, engage the DPA, escalate to the central authority or court

How to use the table, triggers and escalation points

Read the table top-down against your specific request. If it is a direct foreign subpoena with no Finnish order behind it, the right-hand column is your default. If it is an executed EIO or a Finnish court order, the left-hand column applies and your task is to produce narrowly and safely. Where the answer is mixed, a legitimate but over-broad request, the practical route is to require formalisation and simultaneously offer a narrow, safeguarded voluntary production of the clearly relevant core, resolving the balance through the formal channel. In every case, preserve first and document the decision in board minutes.

Sample board resolution and templates

Keep short, editable templates ready in your crisis playbook so decisions can be made and recorded quickly.

Board resolution (sample): “The Board notes the request from [authority] dated [date]. The Board authorises [named counsel] to advise and act on the Company’s behalf, approves the preservation of all relevant records, and directs that no disclosure be made save on counsel’s advice and with appropriate data-protection safeguards. The Board resolves to [require formal MLA/EIO / approve narrow conditional production] and to review this decision at [date]. Directors acting in accordance with this resolution shall be indemnified to the fullest extent permitted by law.”

Response letter to a foreign authority (sample): “We acknowledge your request of [date]. As a Finnish entity, we are able to provide assistance through the appropriate legal channel. We invite your authority to route this request through the competent Finnish authorities (or, within the EU, by way of a European Investigation Order) so that it may be assessed and executed in accordance with Finnish law and applicable data-protection safeguards. We have preserved relevant materials pending that process.”

Next steps and further reading

Handled correctly, cross‑border criminal investigations finland companies face are manageable: preserve immediately, control the forum, protect confidentiality and personal data, and record every decision at board level. The decision framework above is your default, comply narrowly only where a valid Finnish order or EIO exists, and otherwise require the formal MLA/EIO channel while safeguarding evidence. To instruct experienced counsel, consult the Global Law Experts Finland directory for criminal practitioners.

This article is general guidance for boards and companies and is not legal advice. Confirm current statutory texts and any 2026 amendments on Finlex, and take advice on your specific facts before responding to any foreign authority.

Need Legal Advice?

This article was produced by Global Law Experts. For specialist advice on this topic, contact Annastiina Latvasaho at Salingre Attorneys, a member of the Global Law Experts network.

Sources

FAQs

Can a foreign prosecutor compel a Finnish company to hand over documents directly?

Generally no. Foreign authorities should use an MLA or EIO, or request assistance through the competent Finnish authorities. A direct foreign demand has no coercive effect in Finland on its own. A company may choose to comply voluntarily only where Finnish law permits and it is commercially sensible to do so, and always after consulting Finnish counsel and applying data-protection safeguards.

Is sharing employee personal data with foreign prosecutors a GDPR breach?

It can be, if you lack an adequate legal basis or transfer safeguards. Under GDPR Article 48, a third-country authority’s decision does not by itself justify a transfer absent an international agreement such as an MLA treaty. Use narrow, minimised productions, redact third-party data, document your lawful basis, and consult the Data Protection Ombudsman where appropriate. Producing through an MLA or executed EIO generally provides a stronger footing than voluntary disclosure in response to an informal demand.

What legal protection applies to lawyer communications in Finland?

Finnish protection for lawyer–client confidentiality is framed differently from common-law legal professional privilege. Communications with an advocate for legal advice and litigation are protected under confidentiality and secrecy rules, but internal investigatory notes, factual working papers and in-house materials may not enjoy the same protection. Assess this carefully with counsel before any cross-border production and maintain a privilege log to avoid inadvertent waiver.

How long does an MLA or EIO take in Finland?

Timelines vary. Initial administrative processing may take weeks; complex productions or judicial authorisations can take months. The EIO Directive sets indicative deadlines, but practice depends on complexity. Because the formal route is slower than an informal demand, preservation is essential, lock down the evidence immediately so nothing is lost while the process runs.

When should the board be notified of a cross‑border criminal investigation Finland request?

Notify the board whenever the request could cause material financial, regulatory, operational or reputational harm, or where it touches senior individuals or core business lines. Use pre-defined escalation thresholds in the board crisis plan so the decision to escalate is not left to individual judgement under pressure.

How do I choose and instruct counsel, and how are Finnish advocates qualified?

Choose specialist criminal and cross-border counsel with experience of MLA/EIO work and data-protection issues; agree scope and fees early. Finnish advocates (asianajajat) are regulated professionals subject to the standards of the Finnish Bar Association, which also underpins confidentiality discussions. For related governance context, see our guides on company counsel vs independent counsel, Finland and environmental crime in Finland (boardroom guide).