Permits

We issue permits for the secondary use of social and health data, combine data that is subject to a permit securely and pre-process the data ensuring the privacy of citizens.

What data use can permits be issued for?

A permit can be issued for the purposes laid down in law, which are listed below. Data on individuals will be sent to a secure operating environment for analysis, while statistical data can be sent to the applicant.

According to the Act on the Secondary Use of Health and Social Data (Secondary Use Act), data can be used without a separate permit also for knowledge management and steering and supervision of social and health care by authorities.

As a rule, the Secondary Use Act applies to register-based studies. A register-based study utilizes register data usually collected for other purposes or national registers. The Secondary Use Act does not apply to clinical trials reported to the Finnish Medicines Agency (Fimea) or to medical trials under the Medical Research Act.

What data does Findata grant permits for?

We grant permits for data from social and health sector controllers. More information on these controllers is available on the Data page.

However, we cannot issue permits for data from all controllers covered by the Secondary Use Act. Details on these data restrictions can be found in the Secondary Use Act (PDF file, 5.4 mb).

Data descriptions and additional information

According to the Secondary Use Act, data controllers provide advisory services for their own data. They are the best source for detailed information on their data variables. For more information, contact the specific data controller.

You can arrange with the controller to implement data extraction in a specific manner. In your application to us, specify the contact person with whom you made this arrangement.

Descriptions of some of the data within the scope of the Secondary Use Act can be found in the National Data Resources Catalogue (aineistokatalogi.fi).

When do I submit an application to Findata?

Submit your permit application to Findata if you want to apply for:

• Data from several public social and health sector controllers covered by the Secondary Use Act.
• Data from a single public controller that has transferred the right to issue permits to Findata (see the list of such controllers).
• Data from one or more private social welfare and health care service organisers.
• Customer data saved in the Kanta Services.

Statistical and aggregated data subject to a data request can only be accessed via Findata.

Public sector social and health controllers are divided into two groups under the Secondary Use Act, each with different competences. The following section explains these groups and their roles.

The Secondary Use Act does not cover clinical trials reported to Fimea, so these are outside Findata’s scope. Definitions for interventional clinical trial and noninterventional study are available in Fimea Regulation 8/2019. Fimea can advise if a study is considered a clinical trial.

• Fimea Regulation 8/2019 (PDF file, 139 kB)
• Fimea’s webpage (fimea.fi)

Unsure about who the competent authority is? Click here to use the application assistant

Logging into the e-service

All applications to Findata are sent in our e-service with an online form. Log into the service at asiointi.findata.fi using Suomi.fi e-Identification or Haka log in.

Please use the same identification method each time you log in to view your submitted applications and decisions.

• If you encounter any problems, contact Findata’s advisory service: info@findata.fi
• For more information on logging in see the Login page

Selecting and completing an application form

Choose the appropriate form based on your needs:

• Data permit application: Use this form when you need data on individuals. Analysis of this data will occur only in audited, secure processing environments.
• Data request: Use this form when you need statistical data. The statistical data will be sent to you directly.
• Amendment application: Use this form to request changes to an existing data permit.

Complete the application form carefully. Incomplete applications will be returned with a request for additional information.

For detailed instructions on completing each form, refer to the following pages:

• Data permits
• Data requests
• Amendment permits

If you’re unsure what information to enter into a field on the form, seek help well in advance from within your organization or contact our advisory service.

How to expedite the processing of application

The processing time for applications depends on several factors: the accuracy of the data extraction description, the current backlog at Findata, and the response times of data controllers. By following our guidelines, you can help ensure that your application is processed as quickly and efficiently as possible.

How to speed up the processing of your application:

1. Verify Findata’s authority:
   • Ensure Findata is the competent authority to issue a permit for the data you need.
   • Use the application assistant to help determine this.
   • Note that the Digital and Population Data Services Agency, the Finnish Centre for Pensions, and Statistics Finland handle their own data and permit decisions. If you need information from these controllers, contact them directly.
2. Consult Findata’s help desk:
   • If unsure about where to send your application, contact Findata’s help desk service at info@findata.fi before submitting it.
3. Contact data controllers directly:
   • If you need more information about the data or variables, contact the relevant data controllers. Data controllers provide advisory services for their data and can guide you on data extraction methods. You can also make an agreement on the implementation of data extraction in a certain manner with the controller.
   • In your application, mention the contact person with whom you have discussed the data extraction.
4. Use the Data Catalogue:
   • You can refer to the Data Resources Catalogue (aineistokatalogi.fi) for additional information.
5. Describe your information needs accurately:
   • Clearly define the information needed and specify the register-specific data extractions in your application.
   • If the extraction involves multiple steps, describe the order of extraction using the extraction description form (download Word file, 51.2 kb).
   • Ensure that the data extractions and the data you request are essential and justified.
6. Apply the GDPR minimisation principle:
   • Only request data that is essential for your purposes. The principle of minimisation as defined in the GDPR will be applied, meaning that only necessary data will be disclosed.
7. Complete the application carefully:
   • Pay attention to entering basic data such as the applicant’s details, the data controller, invoicing details, and any other data to be combined.

 If you need to supplement a submitted application, email us at info@findata.fi. In the subject line, write “Return of application” followed by your application’s diary number (e.g., “Return of application THL/XXXX/14.0X.00/202X”).

Transfer of personal data outside the EU/EEA

Processing personal data abroad, including in a remote access environment, is considered a transfer of personal data.

Under the EU’s General Data Protection Regulation (GDPR), data can be transferred within the European Economic Area (EEA) under the same conditions as within Finland. The EEA includes EU Member States, Norway, Liechtenstein, and Iceland.

For data transfers or processing outside the EEA, in so-called third countries, there must be a legal basis as outlined in Chapter V of the GDPR. The acceptable legal bases for such transfers are listed below. It is sufficient to meet just one of these bases.

For information on transferring data to the United Kingdom following Brexit, visit the Data Protection Ombudsman’s website (tietosuoja.fi).

Permit fees and other costs

Fees are charged for decisions on data permit applications, data requests, and amendment applications, including the related data processing.

The costs consist of the following, depending on your application:

• Decision fee: Charged according to the pricelist.
• Hourly fee: For data processing carried out at Findata.
• Data controller costs: Costs for the extraction and delivery of data, based on each controller’s provisions.
• Kapseli fee: Costs of secure processing environment Kapseli, where individual-level data is forwarded for analysis

During the application process, we will request a maximum cost estimate from the controller for data extraction and provide a maximum cost estimate for Findata’s data processing. These estimates will be forwarded to the applicant before the permit decision is made. The final price is confirmed after the data is disclosed. A separate processing fee applies to expired and negative decisions.

For more details, visit the Pricing page.

How does an application’s processing proceed?

The processing of applications involves five stages, which may be preceded by the applicant independently contacting a controller. The process is outlined in detail below the graph.

0. Contact controllers before submitting the application
   • Contact controllers directly for additional information on data or variables.
   • Request cost estimates and feasibility details from controllers.
   • Arrange any special data extraction agreements with the controller and include this in the Additional Information section of your application. For example, if a clinician from the research team will perform the extraction free of charge, include details in the Additional Information section about who agreed to this and under what conditions.
1. Submit the application
   • Submit your application or any requested additional information via our e-service (asiointi.findata.fi). Email may be used for additional information if applicable.
2. Findata reviews the application and its appendices
   • Data permit applications are reviewed within a week of receipt. Applications are divided into those that can be processed immediately and those that need further information.
   • Incomplete applications will be returned for more information or clarification.
3. Cost estimation:
   • Findata sends requests for additional information and confirmation of cost estimates to the controllers from whom data is being requested in your application. Controllers have 15 working days to respond. We will forward any additional questions from controllers to you.
   • Findata determines its cost estimate for data processing.
4. Approve the maximum cost estimates:
   • Review the final extraction description and maximum cost estimate.
   • Approve both to proceed with the permit.
   • Note that you cannot change the extraction conditions after approval. Any modifications to the extracted data will require a new application.
5. Findata issues a decision:
   • A data permit or data request decision will be issued.
   • Data permits are for a fixed period. If you need to save data for purposes such as research verification, or if you plan to renew your permit or require regular updates, include these needs in your application.

How will the compilation of the applied for data proceed?

Once a data permit is issued or a decision on a data request is made, the data compilation process involves five stages. The process is outlined in detail below the graph.

6. Data controllers extract the data
   • We will send data requests to the controllers to start the extraction process.
   • Each controller has 30 working days to submit the requested data to Findata.
   • The extraction may involve multiple steps, such as:
     • Extraction of the target group
     • Extraction of controls
     • Extraction of additional data
   • Each step can take up to 30 working days, potentially totaling up to 90 working days.
7. Findata pre-processes the extracted data
   • We will check, combine, and pseudonymize the data or generate statistics according to the data request.
8. Findata delivers the data to the permit holder
   • The processed data will be provided in a secure processing environment, typically in CSV format.
   • Findata’s secure processing environment, Kapseli, is the primary option. Data may be disclosed to other environments if necessary.
   • The target time for delivering the data is 60 working days. This timeframe may be extended if the target group is not provided immediately, if extraction is conducted in multiple stages, if there are delays from controllers, or if the data is particularly complex.
9. Review the data
   • You have three months to review the data and notify Findata of any discrepancies or comments.
   • Thoroughly check the data, as errors can lead to additional work.
     • Errors that occur during extraction can accumulate, such as if the target group is formed incorrectly, requiring additional extractions from other controllers.
   • If you find omissions or errors, email Findata at data@findata.fi with detailed descriptions of how your data differs from the extraction description.
10. Findata’s data retention and disposal
    • Data will be removed from our systems four months after delivery, but code keys for pseudonymised data will be retained to allow reproduction if needed.
    • Note: Data permits are for a fixed period. If you need to save data for purposes like research verification, plan to renew the permit, or require regular updates, include these needs in your application.

Where can the data be analysed?

Data analysis depends on the type of permit you have:

Data request | Aggregated statistical data

• This data is sent to the customer and can be analysed freely according to the data utilisation plan.
• Statistical data is primarily sent via the Nextcloud transfer service. If you need Nextcloud credentials, order them from our e-service.

Data permit and amendment permit | Data on individuals

• Induvidual-level data can only be analyzed in a secure environment.
• Primarily, the data will be disclosed to Findata’s secure processing environment, Kapseli.
• The Secondary Use Act allows for disclosure to other secure processing environments if necessary.
• Data from controllers other than Findata will also be disclosed in a secure environment.

Note: Amendment permits are considered data permits, so the same security requirements apply.

Clinically significant findings

Under Section 55 of the Secondary Use Act, if a data recipient identifies a clinically significant finding from the data granted by Findata that could prevent a health-related risk or improve treatment quality, they can contact Findata.

Process:

1. The data recipient notifies Findata of the finding.
2. Findata determines who the finding concerns and forwards the information to a specialist at the Finnish Institute for Health and Welfare (THL).
3. THL’s specialists assess the significance of the finding and potential benefits of action.
4. If the benefit is deemed significant and important for patient treatment, THL informs the relevant wellbeing services county.
5. An employee from the wellbeing services county will then contact the patient.

Right to object:

• Individuals can object to being contacted based on Section 55.
• Objections can be made at any public health care unit or online via My Kanta.
• Contact prohibitions cannot be set up through Findata, Kela, or THL.

Verifying the anonymity of results

The processor of personal data must produce results in an anonymous format that does not reveal any individual data or characteristics. Findata ensures anonymity in accordance with the Secondary Use Act for all data authorised under the Act. This process is provided at no additional cost.

For detailed criteria on ensuring anonymity and examples of common types of analysis, please refer to the page on Producing anonymous results.

Publishing results

Publication refers to making information publicly available, which includes presenting results outside your immediate working group. This can be in the form of a scientific journal, thesis, textbook, manual, conference presentation, abstract, report, survey, or internet publication.

Report published research results to Findata

Use the form below to report articles and publications that have made use of data authorised by Findata. One of the criteria for the issuing of a data permit for the purpose of scientific research is that the results are published as scientific publications. The form can also be used to report publications of data authorised for other uses.

If you have many publications to report, you can send the information as an Excel file to info@findata.fi. In this case, you do not need to fill in the form below.

Reference Guide

If Findata has granted a data permit or made a data request decision for your project, cite Findata in publications as follows: “Sosiaali- ja terveysalan tietolupaviranomainen Findata” or “Finnish Social and Health Data Permit Authority Findata.”

• Follow the writing guidelines of the scientific publication series.
• We recommend that references to Findata be made in accordance with its statutory duties. In data permits, these duties include, for example, pseudonymization and ensuring the anonymity of results, and in data requests, the duties include data integration, aggregation, and anonymization.
• Findata can be referenced in the text, tables, figures, permit lists, acknowledgments, and reference lists.
• Whenever possible, include the diary number(s) of the data permit or data request in the references.

Example of table citation

Data	Source
Research data	Finnish Social and Health Data Permit Authority Findata, data permit THL/XXXX/14.XX.00/20XX

Check the correct address for the application