Article updated on 20 May 2026: information regarding clinical research added
The amendments to the Finnish Secondary Use Act that entered into force on 1 May 2026 introduced changes to data permit procedures, data processing, and the disclosure of results. Following the reform, we have published new and updated guidance and forms on our website.
This article compiles all key updated guidance and new materials that entered into force on 1 May 2026 under the reform of the Finnish Act on the Secondary Use of Health and Social Data (Secondary Use Act).
Combining data in the decentralised model and ordering data processing
In addition to Findata’s centralised service, applicants may now apply for permits separately from each data controller.
In these cases, the data controllers agree among themselves on who is responsible for compiling the dataset. Findata may also compile the datasets, in which case the applicant must order data processing from Findata.
Applying for an anonymised dataset and another secure processing environment
The amendment to the Act enables Findata, for a special reason, to grant a data permit under which an anonymised dataset may be disclosed outside a secure processing environment.
In addition, going forward, Findata may, for a special reason, grant a data permit under which a dataset may be disclosed to a secure processing environment other than one compliant with the Act.
- Disclosure of anonymised data outside a secure processing environment
- Instructions for applying for another secure processing environment
New page: Exporting results from the processing environment
As part of the amendment, we have introduced a new risk-based procedure to ensure the anonymity of results.
When results are exported from environments other than Findata’s Kapseli processing environment or Statistics Finland’s FIONA environment, the anonymity of the results must be assessed using a risk assessment form, and a notification must be submitted to Findata.
Regulation concerning decisions
We have published a new regulation on the information contents of data permit and data request decisions, as well as template documents to support compliance with the regulation. The regulation applies to all data controllers that grant data permits for their datasets under the Secondary Use Act.
The documents are available only in Finnish.
- Regulation on the information contents and data structures of data permit decisions and data request decisions (PDF file, 216 kB)
- Template for a data permit decision (Word file, 50 kB)
- Template for a data request decision (Word file, 45 kB)
Regulations concerning the anonymisation of results, data permit applications and data utilisation plans, as well as data request applications, will be published later this year.
Findata’s centralised permit service remains unchanged
Although the reform of the Secondary Use Act changes permit procedures and dataset compilation, permits for the secondary use of social and health data can still be applied for centrally through Findata.
Findata will continue to act as the permit authority when a project requires data from several public data controllers, data from the Kanta Services, data from the private sector, or datasets from organisations that have transferred permit authority to Findata.
We will continue updating our website throughout May.
Amendments to the Secondary Use Act concerning clinical research
The Secondary Use Act is not applied to clinical research when the research is based on consent and conducted under the following acts:
- Act on Clinical Drug Trials
- Medical Research Act
- Act on Medical Devices
However, the Secondary Use Act is applied if register data are combined with a clinical study for individuals who have not given consent. In practice, this most often concerns the use of register data on relatives and control subjects.