The FinRegistry ready-made dataset is a register dataset administered by Findata, the Finnish Social and Health Data Permit Authority. This article explains who the dataset covers, what data it contains and how you can object to the use of your data.
On this page
What the FinRegistry ready-made dataset is Who the ready-made dataset covers Who can obtain data and for what purpose How the data is protected Why the secondary use of health and social data is not based on consent Your rights to your own data How to submit a request to Findata Frequently asked questionsWhat the FinRegistry ready-made dataset is
Findata’s FinRegistry ready-made dataset is based on data collected in the FinRegistry research project of the Finnish Institute for Health and Welfare (THL) and the Institute for Molecular Medicine Finland (FIMM) at the University of Helsinki. The project, which ended in December 2024, studied the onset and prediction of diseases at the level of the entire population.
At the research project’s proposal, Findata published the data as a ready-made dataset in April 2024 as part of the FinHITS project, co-funded by the European Union. A ready-made dataset is a pre-assembled and pre-processed dataset for which the permit process is more straightforward than usual, because the data does not have to be collected separately from each original controller.
The FinRegistry ready-made dataset is therefore not the same as the FinRegistry research project, and the dataset is narrower in content than the original research data.
As of September 2026, data from the FinRegistry ready-made dataset has been used in approximately 12 studies.
Who the ready-made dataset covers
The target population of the FinRegistry ready-made dataset consists of persons who, according to the Population Information System, lived in Finland on 1 January 2010, together with their spouses, children, parents and siblings. Data on spouses, children and siblings was extracted up to 19 May 2020.
Data concerning persons who have objected to the processing of their data at Findata has been removed from the ready-made dataset. Where the person who submitted the objection belongs to the core population, the dataset also excludes data on those relatives and spouses who were included in the target population through that person.
The ready-made dataset contains data from the Digital and Population Data Services Agency, the Finnish Centre for Pensions, the Kanta Services, the Social Insurance Institution of Finland (Kela), the Finnish Cancer Registry, the Finnish Institute for Health and Welfare and Statistics Finland, insofar as the data falls within the scope of the Act on the Secondary Use of Health and Social Data. It comprises more than 20 datasets and covers data spanning several decades.
Detailed descriptions of the datasets and lists of variables: Aineistokatalogi.fi
Who can obtain data and for what purpose
Data from the ready-made dataset can be accessed under a fixed-term data permit granted by Findata. A permit may be granted if the conditions laid down in the Act on the Secondary Use of Health and Social Data are met. Anonymous statistics can also be produced from the dataset through a data request under the same Act.
Anyone may apply for a permit, including a company or a private individual, but the purposes of use are strictly limited. Individual-level data may be released only for scientific research, teaching, statistics, and authority planning and investigation duties.
Data cannot be purchased, and it may not be used for marketing, for setting insurance premiums, or in administrative decision-making concerning individual persons. Permits granted by Findata are official administrative decisions, and information on them is published on the Issued permits page.
A permit is granted only for strictly defined data, and direct identifiers such as names and personal identity codes are removed. Research is typically concerned with findings drawn from the dataset as a whole, such as averages and distributions, rather than with individual persons.
How the data is protected
As with all personal data materials permitted by Findata, data extracted from the FinRegistry ready-made dataset may be processed only in secure processing environments. These environments are closed by default: the user cannot transfer data into or out of them.
The processing environments record a history of processing and events. These log data show, for example, who has processed the data, how it was processed and when. Log data is collected both on processing carried out by the authorities and controllers handling the data and on processing carried out by permit holders. Once the connection to the processing environment is terminated, permit holders no longer have any means of accessing the data.
If we suspect a breach of the permit conditions, we report the matter to the Data Protection Ombudsman.
Why the secondary use of health and social data is not based on consent
The aim of the secondary use of health and social data is to enable researchers and authorities to make effective use of Finnish register data while ensuring that the data is used safely and responsibly.
Register data may be used on the basis of consent, but it may also be used without consent in accordance with the Act on the Secondary Use of Health and Social Data. In that case, permission is not sought separately from each patient. Instead, the authorities responsible for granting permits ensure that the data is used safely, lawfully and for a justified reason.
If only the data of those who had given their consent were included, population coverage would remain partial and the results would not describe the population reliably. The research value of register data rests precisely on its comprehensiveness.
In place of consent, the law imposes other requirements: limited purposes of use, assessment by a public authority, data minimisation, pseudonymisation, a closed processing environment, fixed-term permits, and the right to object to processing.
Your rights to your own data
You have the right to be informed of what personal data we process concerning you, and the right to object to the use of your data for secondary purposes.
If you submit an objection to Findata, we will remove data concerning you from the materials in our possession and from those delivered to us, including the FinRegistry ready-made dataset. Your data will not subsequently be released for secondary use through Findata. An objection remains in force until further notice and takes effect once the request has been processed.
An objection submitted to Findata covers only the materials processed by Findata. Controllers such as Kela and the wellbeing services counties may also disclose data for secondary use directly, without Findata. If you wish to object to secondary use by those controllers as well, you must submit a separate objection to each of them.
- Controllers covered by the Secondary Use Act and the contents of their registers: Available data materials
- More information on your rights: Your data rights
How to submit a request to Findata
- Log in to Suomi.fi Messages at suomi.fi/messages or through the Suomi.fi app, and select whether you are acting on your own behalf or on behalf of someone else.
- Select “Compose message”, then choose “Finnish Institute for Health and Welfare” as the recipient and “Registry” as the service or issue.
- Write the subject and content of the message according to which right you are exercising, and send the message.
Right to object (prohibiting the use of your data)
- Subject: Findata: Objection to the processing of personal data
- Message:
- Write “I object to the processing of my personal data for the purposes provided for in the Act on the Secondary Use of Health and Social Data.”
- Add your full name and personal identity code.
Right of access (requesting data concerning you)
- Subject: Findata: Request for access to personal data
- Message:
- Write “I request a copy of my personal data processed by Findata and information regarding the processing of that data.”
- Add your full name, personal identity code, email address and phone number.
If you are acting on behalf of a minor or a person under guardianship, provide the name and personal identity code of the person concerned. Submit a separate message for each right and for each individual.
We process requests within one month. All objections submitted to us are carried out, and no separate notification of their implementation is sent. If you have requested access to your data, we will deliver the data by secure email.
If you are unable to use Suomi.fi Messages or strong electronic identification, you can submit a completed form either in person at our office or by post. See the instructions below by clicking the headings.
Submitting a GDPR request in person
Print and complete the request form.
Deliver the form to an office of the Finnish Institute for Health and Welfare (THL) in Helsinki or Kuopio. Bring a valid identity document with you.
Addresses of THL’s offices:
- Mannerheimintie 166, Helsinki (reception in building A)
- Neulaniementie 4, Kuopio
If you are submitting a request on behalf of a minor child or a person under guardianship, you must also deliver a certificate of child custody obtained from the Population Information System. The request must align with the child’s presumed will and serve the child’s best interests. In cases of joint custody, the request must be made and signed by both guardians.
Submitting a GDPR request by mail
Print and complete the request form.
Notarisate the authenticity of your signature and mail the request to Findata. Consider sending the request as a registered letter as it contains personal information.
- Instructions: Notarisation of the authenticity of a signature (dvv.fi).
- Findata’s postal address: P.O. Box 30, FI-00301 Helsinki, Finland.
If you are submitting a request on behalf of a minor child or a person under guardianship, you must include a certificate of child custody obtained from the Population Information System. The request must align with the child’s presumed will and serve the child’s best interests. In cases of joint custody, the request must be made and signed by both guardians.
Frequently asked questions
What is Findata?
Findata is the Finnish Social and Health Data Permit Authority, established in 2019. Findata operates in connection with the Finnish Institute for Health and Welfare (THL) but is separated from THL’s other activities. Findata’s operations are based on the Act on the Secondary Use of Health and Social Data, commonly known as the Secondary Use Act.
We grant permits for the secondary use of health and social data, compile data materials while ensuring data protection, and maintain the secure Kapseli processing environment in which the materials can be processed.
What is the difference between primary and secondary use?
Primary use means the purpose for which the data was originally recorded, such as examining and treating a patient, providing a social welfare service, or processing a benefit at Kela.
Secondary use means the use of that same data for another purpose. The secondary purposes laid down in the Act on the Secondary Use of Health and Social Data are scientific research, statistics, development and innovation activities, teaching, knowledge management, steering and supervision by authorities, and the planning and investigation duties of authorities.
Read more about the permitted purposes under the Secondary Use Act
What are the benefits of secondary use?
Combining register data on a large number of people makes it possible to produce knowledge that individual patient records cannot reveal. Studying rare diseases, long time spans and differences between population groups requires extensive data.
The findings are used in drawing up treatment guidelines, monitoring the adverse effects of medicines, developing health technology, and researching health and social services and public health, among other purposes.
Permits granted by Findata and their purposes of use are public: Issued permits
Does Findata sell data?
Findata does not sell data and does not engage in commercial activity. We grant fixed-term data permits when the conditions laid down in law are met, and the materials are destroyed once a permit expires. A fee is charged for decisions on data permits, amendment permits and data requests, and for the processing of data materials. The fees are based on the Ministry of Social Affairs and Health’s decree on fees.
Health and social data may not be used for marketing or for setting insurance premiums or other individually priced commercial services.
Does Findata transfer data abroad?
Most permits are granted to Finnish projects, but a permit holder may also be located in another EU or EEA country. Even then, the data may be processed only in a secure processing environment and only for the purpose defined in the permit.
Personal data may be transferred outside the EU or EEA only where there is a legal basis for the transfer under Chapter V of the EU General Data Protection Regulation and the requirements of the law on data protection and information security are met.
Read more: Transfer of personal data outside EU or EEA
What happens when you object to the use of your data at Findata?
When you object to the secondary use of your data, we record your request in the case management system maintained by the Finnish Institute for Health and Welfare and remove data concerning you, on the basis of your personal identity code, from the materials held by Findata and from those delivered to Findata. We retain and process your personal identity code so that your request can also be applied to materials received in future.
Once the request has been processed, we will not release your data for secondary use. The objection remains in force until further notice.
Contact
