Data

You can book a time for personal consultation with an expert from Findata. Appointments are available three days a week and last for 20 minutes. The meetings are held remotely via Teams.

We offer help in the following topics:

• General consultation on Findata’s services
• Data permit applications, amendments, and data requests
• Extraction description form and other forms
• Ordering Findata’s secure processing environment Kapseli, pausing, and data storage service

You can see the available times below.

Make sure you have written your email address correctly. After booking, we will send a confirmation to your email and a downloadable calendar reminder. We will send the link to the Teams meeting later.

If you have not received a confirmation or Teams link, email us at info@findata.fi.

_{The personal consultation service is provided as a part of the FinHITS project funded by the European Union.}

If you want to combine data authorised by other data controllers with data from Findata, you must submit a data permit or data request application to Findata via the e-service.

Please note before submitting your application

• The data permits for all datasets to be combined must have been granted for the same research project, and they must be valid at the time the data is processed.
• Permits granted by different data controllers must be consistent with each other (e.g. data processors, processing environment, as well as data combining and processing).

If you are applying for a permit as part of a decentralised permit process

• If you need to make changes to existing permits after they have been granted (e.g. changes to data processors), you must apply for a separate amendment permit from each organisation that issued a permit.
• If changes are made to permits issued by other data controllers, or if additional data is requested, you must submit an amendment application to Findata regarding the combination of datasets.

Include in the application

• Details of the datasets to be combined
  • For example, the format of the datasets to be combined, and the target population for which the datasets will be or have been created.
• If permits from other data controllers have already been granted:
  • permit reference number (diary number), issuing authority, and date of issue
• If permits from other data controllers are still being processed:
  • which controllers the permit has been requested from, and when the process was initiated
• If the combined data is based on participant consent:
  • participant information sheet and consent templates
• If the data combination is part of a decentralised permit model:
  • a description of how data compilation and phased processing have been planned

If you have a valid data permit granted by Findata and want to combine it with data authorised by another data controller, apply for an amendment permit through Findata’s e-service.

In this case, select the amendment type: “Combining data with a prior permit to data with a Findata permit”

Please note the following when completing the application:

• Describe the datasets to be combined.
• Add preliminary information on the datasets to the table provided in the application.
• Specify the legal basis for using data that falls outside the scope of the Secondary Use Act.
• Do not attach datasets to the application. Findata will provide instructions on how to deliver the data securely.

Before placing an order

• The organisation placing the order must be the same organisation that has received the data permit or data request decision related to the data processing.
• The relevant data permits or data request decisions must be valid when the order is submitted.
• Data processing orders are billed based on the actual working hours used and in accordance with the current price list.
  • You may request an indicative cost estimate either during processing or before submitting your order by contacting us at data@findata.fi.
  • More information: Pricing

How to place an order

1. Submit the data processing order form through Findata’s e-service.
2. Please include the following attachments:
   • Data processing request (Word file, 39 kB)
   • Data permits or data request decisions and their appendices
   • If the order relates to a data request, also include:
     • A tabulation plan
     • Additional information related to anonymisation
     • Use Findata’s template: Tabulation plan (Excel file 24 kB)
3. We will contact you once your order has been taken into processing.
   • If necessary, we may ask the contact person for additional information.

After the order has been approved

4. We will notify you once the order has been approved.
5. We will send data requests to the relevant data controllers. The data controllers are responsible for delivering the datasets within 30 working days.
   • We will keep you informed throughout the process so that, if necessary, you can coordinate with data controllers regarding timing and extraction details if necessary.
   • The requester is responsible for ensuring that the data controllers deliver the datasets within the required timeframe.
6. Once all datasets have been delivered to Findata, we will process and deliver them within 30 working days.
   • This timeframe may be extended if the processing is exceptionally extensive or complex.
7. Verify that the delivered data corresponds to the granted permit.
   • Any errors must be reported within three months of the date when Findata delivered the data.

Findata has issued a regulation specifying the information security requirements for secure processing environments used for secondary use of social and health data.

These requirements apply to all purposes covered by the Act on the Secondary Use of Health and Social Data, including:

• Scientific research
• Statistics
• Teaching (only for preparing teaching materials, not actual teaching)
• Planning and investigation tasks of public authorities

Since 1 May 2022, compliance with these requirements has been mandatory for any data processed outside Findata’s Kapseli environment. In addition, the processing environment must be assessed by a data security assessment body that must issue a certificate on the assessment.

The regulation allows for different technical solutions. Secure environments may range from:

• A physically and technically secure space with an isolated analysis device
• Cloud-based solutions, provided they meet the required security standards

Foreign researchers’ processing environments must also comply with these requirements. Compliance can be demonstrated through internationally recognised security certifications, verified by an approved Finnish assessment body.

Read more on the Regulation on processing environments page.

Under section 51 d of the Secondary Use Act, Findata may, for a specific reason, grant a data permit allowing anonymised data to be disclosed outside a secure processing environment.

A permit for anonymised data may be granted if all three of the following conditions are met:

1. the data cannot, for justified reasons, be processed in a secure processing environment
2. the risks related to the data are considered low
3. the data can be anonymised reliably

In the application, the applicant must explain why the data cannot be processed in a secure processing environment compliant with the Secondary Use Act. The application must include sufficient information for Findata to assess whether the conditions are met.

If the application does not meet the required conditions, it will be processed as a standard data permit application. In that case, the data will be disclosed to a secure processing environment in accordance with section 20 of the Act.

How to apply

1. Apply for a data permit for anonymised data in Findata’s e-service using the standard data permit application form.
2. In the application, indicate that you are applying for disclosure of anonymised data under section 51 d of the Secondary Use Act.
3. Complete and attach the supplementary information form:
   • Form: Anonymised datasets (Word file, 41 kb)
4. In the form, describe:
   • why the data cannot be processed in a secure processing environment
   • why the risks related to the data are considered low
   • how the data can be anonymised reliably
5. You may also attach a separate anonymisation plan to the application.
6. Findata will assess the application and may request additional information if needed.
7. Once the permit has been granted, Findata will deliver the data to the permit holder either by email or through the secure Tunneli transfer service.

Please note that anonymised data does not provide the same level of usability as personal data. If the data cannot be anonymised reliably, it will instead be disclosed to a secure processing environment. For this reason, the application must also specify the secure processing environment to which the data will be disclosed in such cases.