7. Data processing (processing environment)
Enter the processing environment, the persons who will process the data and the retention period. Individual-level data is primarily processed in a secure processing environment that meets the requirements of the Secondary Use Act.
Check the list of people who will process the data carefully before you submit the application. Changing them later requires an amendment permit. If you need to keep the data after the analysis is finished, the data permit must be valid for the whole retention period.
8. Data protection matters
Almost all data authorised by Findata is special category personal data, which sets requirements for the legal basis for processing. If needed, contact your organisation’s data protection officer when you fill in this section.
This section asks, for example:
- what the legal basis for processing is
- how the principle of data minimisation has been taken into account
- how the target group has been informed
- whether personal data will be transferred outside the EU or EEA
The Office of the Data Protection Ombudsman provides guidance on these topics:
- Minimisation of data (tietosuoja.fi)
- Informing data subjects (tietosuoja.fi)
- Impact assessment (tietosuoja.fi)
- Processing special categories of personal data (tietosuoja.fi)
- Legal bases for processing personal data (tietosuoja.fi)
- Transfers of personal data outside the European Economic Area (tietosuoja.fi)
Learn more about researchers’ data protection responsibilities in our training portal: Data protection for researchers