Amendment permits

You can apply for amendments to valid data permits by submitting an amendment application.

Before applying for a amendment permit, please read the Permits page.

General information on amendment applications

See what you can apply to amend with an amendment application. Read more

What can you apply for with an amendment application?

This page contains information on when an amendment application is adequate and when you will new a new data permit application. Read more

Logging into the e-service

How to log in and select an application form. Read more

Instructions for completing an amendment application

See what is asked in the application. Read more

Information on costs

See the current pricelist for amendment decisions Read more

Application assistant

Ensure the correct address for the amendment application. Read more

What to remember before sending an application

Select the correct application type

There are different types of applications for different information needs

Data permit application, when you need data on individuals
Data request, when you need statistical data
Amendment application, when you are applying for an amendment to a valid data permit

Describe and limit data

Define the data to be applied for at the variable level and remember the principle of minimisation for other information. Utilise the Data Resources Catalogue (aineistokatalogi.fi) and controller’s advisory services

Where from and how do I extract the target group? Is the definition specific enough?
Are control subjects/relatives extracted? How will they be defined?
From which registers will the data be extracted?
What variables will be included in the extraction?

Other data to be combined

Have you made sure that the other data is described on the application?
Are the permits for other data valid or is the permit process pending?

Determine the competent authority

We grant permits for the secondary use of social and health data when the application applies to

data maintained by several public social and health sector controllers
data maintained by a single public controller, that has transferred the right to issue permits to Findata
the register data of one or numerous private social and health service provider, or
data saved in the Kanta Services

The assessment of the competent authority must consider all the data related to the application.

Check from the application assistant which authority the application should be sent to.

General information on amendment applications

A data permit amendment application is sent to Findata whenever data are combined from data controllers covered by the Act on secondary use of health and social data, or if the controller has transferred its power to grant permits to Findata. An amendment permit may be granted when the data sources and the group of research subjects remain unchanged.

Amendment applications and their attachments are confidential. When necessary, we will forward critical data as well as the applicant’s name and contact details to the controller.

The decisions and permits granted by an authority are primarily public. On our website, we will publish the following information on projects that have received favourable data permit amendment decisions:

date of decision
permit validity period
permit holder (organisation)
project name (if known)
issuer of the original permits
amendment type

This public data can be shared from the website also to other communication channels.

See the page Issued permits.

How to speed up the processing of your amendment application

Processing time for your application depends on several factors, including the clarity of your application, our current processing load, and response times from data controllers. To expedite the process:

Complete the application carefully ensuring all sections are filled out thoroughly and accurately.
Attach all previous permit decisions to your application.
Attach to your application all previous non-disclosure agreements (NDA). Each person handling the material to be added must have their own NDA.
Use Findata’s advisory service for additional support and clarification.

For more information, visit the Data page or check the Data Resources Catalogue (aineistokatalogi.fi).

What can you apply for with an amendment application?

A data permit amendment application can be used to:

Extend the period of validity
Change the data processors
Add data (such as variables)
Extend the period from which data is extracted
Change the controller of data disclosed with a data permit
Change the data processing environment
Expand the processing of data outside the EU/EEA as opposed to the granted permit
Combining data that some other authority has issued a permit for with the data covered in Findata’s permit

It is not possible to apply for an amendment in all situations. You should apply for a new data permit if:

the data sources (registers) or the group of subjects change
the number of monitoring years is increased for a data permit issued by a party other than Findata

Processing environment for the data

As a rule, the data will always be disclosed to Findata’s secure operating environment Kapseli . However, the Secondary Use Act makes it possible to disclose information to other secure operating environments, if necessary.

Amendment permits are subject to the same environment requirements as new data permits. Exceptions to this are the following changes, which do not require compliance with the environment requirements:

Changing the data processors
Changing the controller of data disclosed with a data permit
Combining data that some other authority has issued a permit for with data covered in Findata’s permit

Read more on the page: Regulation on secure operating environments

Logging into the e-service

Submit an application in our e-service (asiointi.findata.fi) using either Suomi.fi e-Identification or Haka login. For more information on logging in, visit the Login page.

Please use the same identification method each time you log in to view your submitted applications and decisions.

Amendment permit applications can be submitted in Finnish, Swedish or English

After logging in

Go to the Submit application tab.
Choose Data permit amendment application by clicking Fill in the application.
Complete the application form following the instructions provided and submit it.

Once an application is submitted, it cannot be edited. If you need to supplement a submitted application, email us at info@findata.fi with your application ID (e.g., 2022/53). We will return the application for you to update.

How to submit an amendment application

1 Public information about the project

Project name
- The name of the project granted an amendment permit will be published on Findata’s website. Ensure the project name does not include confidential information.
A brief description of the project
- Provide a concise description of the study or project and the intended use of the requested data. This description, once the data permit is granted, will be posted on Findata’s website. Avoid including confidential details in this description.

2 Details of the applicant

The applicant is the person or organization named in the application to whom the data permit will be issued.
Enter the applicant’s business ID. If the applicant is an individual, enter 123 in the field. For organizations located in an EU/EEA country other than Finland, provide the name of the official register where the organization is registered.
Specify which organization or individual is the data controller.
- The amendment permit can be applied for by the data controller or by another entity on behalf of the data controller.
- In the case of a joint controllership, select ‘A third party’ and enter all controllers in the additional information field.

Controllership of data being applied for

A controller under the EU General Data Protection Regulation (GDPR) is an organization or individual who is the controller of the data. The controller determines the purposes and means of processing the data generated based on the data permit.

There may be more than one controller and the controllers may be joint controllers, in which case they define the purposes and means of processing the data together. In the case of a joint controllership, select ‘A third party’ and enter all controllers in the additional information field.

3 Details of the contact person

The contact person is the individual responsible for answering enquiries concerning the application. Their contact details may be shared with the data controller if additional information is needed during processing.
Describe the contact person’s relationship with the applicant, such as employment or a public service appointment.

4 Invoicing details

E-invoicing is the primary method of invoicing.
If the invoiced party is different from the applicant, clarify this in the ‘Additional Information’ section.
Invoicing details for Finnish payers:
- Use the business ID to form the VAT number. Add the country code “FI” to the beginning and remove any hyphen (e.g., business ID “1234567-8” becomes VAT number “FI12345678”).
- Check verkkolaskuosoite.fi for e-invoice addresses.
Invoicing details for foreign payers:
- Foreign payers should have a Peppol address for e-invoicing. For more information, visit peppol.org.
- If the payer doesn’t have a Peppol-address, the invoice is sent by mail.

Applicant’s business ID

Enter the applicant’s business ID If the applicant is a private individual, enter 123 into the field. If the applicant organisation is located in a country other than Finland or an EU/EEA member state, provide the name of the official register in which the organisation is registered.

Checklist for applicants

Ensure that contact information and billing details are filled in correctly and are consistent with the information provided elsewhere in the application.
If you are applying as an individual rather than an organization, provide additional information in the “Additional Information” field at the end of the form.

5 The permit or permits to which you apply for an amendment

Fill information about data permits that you want amended. Amendment of a data permit is only possible for valid permits.
Do not fill information about data permits that are not subject to this application. If you are applying for an addition of data other than that referred to in the Secondary Use Act, list the permits considering this data in the section 7.
Indicate the issuers of the original data permits. You can indicate several permit issuers.

6 Purpose of data use

Note that when applying for a change to a data permit, the purpose of use must be the same as in the original permit.

Click to see more information about different use purposes:

Education

When data is to be used for education, the applied for data will be used to prepare teaching materials for personnel and persons studying to become social welfare and health care personnel who process customer data and social welfare and health care professionals. Please note: Data containing identifiers can only be used in teaching situations if teaching cannot be carried out anonymously due to the exceptional nature of the case, the nature of teaching or a similar reason. The person providing teaching must inform their students of the confidentiality provisions in legislation and the sanctions resulting from their violation.

Planning and reporting duty of an authority

As a rule, only an authority may carry out the planning and reporting duties of an authority. If an authority does not act as the applicant in a data permit application, the authority must be the controller of the data. As a rule, when work is commissioned, the commissioning party will be the processor of personal data.

Scientific research

When data is to be used for scientific research, attach an up-to-date research plan and a research permit from the responsible/target organisation to your application. Also attach an opinion from the Ethics Committee, if the legislation applying to the research and/or the research setup so requires.

Criteria for scientific research (in general):

an appropriate research plan
responsible person or group
results to be published as a scientific publication
research produces new information.

Statistics

When data is to be used to form statistics, state in the application which party will compile the statistics and for what purpose.

7 Applied data permit amendment(s)

State which amendment or amendments you are applying for to the valid data permit(s).
If necessary, indicate the current processing environment of the data. The analysis of the data is only permitted in audited processing environments that meet the requirements of the Secondary Use Act and the Findata’s regulation.
- If you only want to transfer your research data to Kapseli, order Kapseli from Findata’s e-service.
- If your data is transferred to Statistics Finland’s Fiona user environment because the data is combined with data provided by Statistics Finland as a statistical authority, select “Addition of data other than referred by the Secondary Use Act” as the applied data permit amendment. In this case, you do not need to apply for a change “Changing the operating environment of the data to an environment other than Kapseli”.
- If you are applying to transfer your data to Statistics Finland’s Fiona operating environment for other reason and your data is not combined with data provided by Statistics Finland as a statistical authority, select “Changing the operating environment of the data to an environment other than Kapseli”.

Extension of the validity of the data permit

The data permit is granted for a fixed term, which will not exceed the period of time required for the purpose of use. The anonymised results must be extracted from the secure operating environment during the set period of use.
Indicate when will the need to use the data end including both active use and possible storage time.
Describe grounds for extension shortly.

Change to the personal data processors

List the new people to whom you want to add the right to process data.
- Enter only the first name, last name and organisation of the processors (e.g. Alan Smithee, University of Helsinki).
- Use a semicolon (;) to separate individuals from each other (e.g. Person 1, Organisation; Person 2, Organisation; etc.)
List the persons whose right to process the data is to be removed.
List the persons who have been granted permission to process the data in previous data permits and whose permission is valid. These persons are not required to submit a non-disclosure agreement.

Adding data (e.g. new variables)

An amendment for a data permit can only be applied if the data sources (e.g. registers) and the target group remain unchanged.
Indicate in the table from which register or registers new data (e.g. variables) will be extracted.
Define new variables using the extraction description form (download Word-file, 51,2 kb).
- Download and fill in the form according to the instructions. Contact the controllers directly and go through the extraction description with the controllers before submitting the application.
- Attach the completed extraction description forms in Word file format. The extraction description form is required in Word file format, as Findata or the controllers may have to make changes to it.
- Information on different registers and the data contents of the registers (variable names, descriptions of variables, time period extracted from the register, etc.) is available in the Data Resources Catalogue (aineistokatalogi.fi).

Extension to the period from which data is extracted

The extension to the period from which data is extracted can only be applied by the amendment of the data permit if the original permit has been granted by Findata, or by the controller that has subsequently transferred its authority to grant permits to Findata.
List the registers for which you want to extend the the period from which data is extracted.
Define variables using the extraction description form (download Word-file, 51,2 kb).
- Download and fill in the form according to the instructions. Contact the controllers directly and go through the extraction description with the controllers before submitting the application.
- Attach the completed extraction description forms in Word file format. The extraction description form is required in Word file format, as Findata or the controllers may have to make changes to it.
- Information on different registers and the data contents of the registers (variable names, descriptions of variables, time period extracted from the register, etc.) is available in the Data Resources Catalogue (aineistokatalogi.fi).

Change the controller of data disclosed with a data permit

Indicate who or which party is the controller mentioned in the previous data permit decision.
Indicate who or what party is the new controller of the data.
Attach to the application a confirmation signed by both parties that the change of the data controller has been agreed upon between the previous controller and the new data controller.

Addition of data other than referred by the Secondary Use Act

The addition of other data than referred in the Secondary Act can only be applied by the amendment of the data permit if the original permit has been granted by Findata.
Freely describe the data to be combined and tell where the data comes from (data controller, survey material etc.), the format of the files and for which target group the data is extracted.
Fill in preliminary information about data to be combined.
- In case the data set includes data in more than one format (pdf, Excel, csv etc.), add all different formats on their own rows.
- Deliver the tables (which Findata needs to pseudonymize) in csv or SAS-format.
- Size of the files: If the data is in table format, provide an estimate of the number of rows and columns.
- Special notes: Explain which variables or sections include direct or indirect identifiers. Examples: an address variable; a text variable including names; or the names of the figure or pdf-files include personal identification code.
Indicate, what is the (legal) basis for the use of data that is not covered by the Act on the Secondary Use of Health and Social Data.
Note! Do not attach data to this application. Findata will provide instructions on how to deliver the data securely.

Expanding the processing of personal data outside the EU and EEA

The processing of personal data abroad is counted as transfer of personal data even if the data is in a remote operating environment. Read more about transferring personal data and the legal bases for this on the Office of the Data Protection Ombudsman’s website (tietosuoja.fi).
Indicate in which countries is the data currently being processed.
As data is being transferred outside the EU/EEA, specify the legal basis, in accordance with the General Data Protection Regulation (GDPR), that is needed for the transfer of data.
Indicate, to which country outside the EU/EEA would you like to expand the data processing to.

8 Additional information and attachments

In this section, you can specify previous sections of the application, for example with regard to invoicing.
If you have spoken about your application with a Findata employee in advance, give the person’s name.
Please do not attach data to this application

9 Confirmation of information

Confirm the information provided on the application form.
A fee will be charged for the permit decision in accordance with the fee decree in force at the time.
Before we make a decision on the application, you as the applicant must agree to a maximum cost estimate for the costs of extracting and pre-processing the data if a change to the extraction or processing environment is requested.

Information on costs

We will charge a decision fee for amendment permits according to the attached pricelist. In addition to the decision fee, we will, where necessary, charge an hourly fee for data processing carried out at Findata.

You’ll find more information about costs on our Pricing page.