Updated 29.04.2024

Amendment permits

An amendment application allows the applicant to apply for changes to previous, currently valid permits. Please note that for the amendment permit we need all previous permits for which an amendment or change is applied for or on which the previous permits are based.

Please read the Permits web page before applying for a data amendment permit. The page includes useful information to take into consideration before applying, while applying and after applying.

General information on amendment applications

See what you can apply to amend with an amendment application. Read more General information on amendment applications

What can you apply for with an amendment application?

This page contains information on when an amendment application is adequate and when you will new a new data permit application. Read more What can you apply for with an amendment application?

Logging into e-services

This page contains information on how to log in and select an application form. Read more Logging into e-services

Instructions for completing an amendment application

See what is asked in the application. Read more Instructions for completing an amendment application

Information on costs

See the current pricelist for amendment decisions Read more Information on costs

Application assistant

Ensure the correct address for the amendment application. Read more Application assistant

What to remember before sending an application

Select the correct application type

There are different types of applications for different information needs

  • Data permit application, when you need data on individuals
  • Data request, when you need statistical data
  • Amendment application, when you are applying for an amendment to a valid data permit
Describe and limit data

Define the data to be applied for at the variable level and remember the principle of minimisation for other information. Utilise the Data Catalogue (aineistokatalogi.fi) and controller’s advisory services

  • Where from and how do I extract the target group? Is the definition specific enough?
  • Are control subjects/relatives extracted? How will they be defined?
  • From which registers will the data be extracted?
  • What variables will be included in the extraction? 

Other data to be combined

  • Have you made sure that the other data is described on the application?
  • Are the permits for other data valid or is the permit process pending?
Determine the competent authority

Findata is responsible for the application and the permit decision whenever data are combined from data controllers covered by the Act on secondary use of health and social data. The assessment of the competent authority must therefore consider all the data related to the application.

Check from the application assistant which authority the application should be sent to.

General information on amendment applications

A data permit amendment application is sent to Findata whenever data are combined from data controllers covered by the Act on secondary use of health and social data, or if the controller has transferred its power to grant permits to Findata. A data amendment permit may be granted when the data sources and the group of research subjects remain unchanged.

Amendment applications and their attachments are confidential. When necessary, we will forward critical data as well as the applicant’s name and contact details to the controller.

The decisions and permits granted by an authority are primarily public. On our website, we will publish the following information on projects that have received favourable data permit amendment decisions:

  • date of decision
  • permit validity period
  • permit holder (organisation)
  • project name (if known)
  • issuer of the original permits
  • amendment type

This public data can be shared from the website also to other communication channels.

What can you apply for with an amendment application?

A data permit amendment application can be used to:

  • Extend the period of validity
  • Change the data processors
  • Extend the period from which data is extracted (only if the previous permit has been granted by Findata, or by the controller that has subsequently transferred its authority to grant permits to Findata)
  • Change the controller of data disclosed with a data permit
  • Change the data processing environment
  • Expand the processing of data outside the EU/EEA as opposed to the granted permit
  • Add variables to the extraction of material when data extraction has already been completed (the target group, possible controls and relatives, and the registers from which the extractions are carried out remain the same)
  • Combining data that some other authority has issued a permit for with data covered in Findata’s permit

As a rule, the data will always be disclosed to Findata’s secure operating environment Kapseli. However, the Act makes it possible to disclose information to other secure operating environments, if necessary. Read more below in the section: Findata’s regulation sets information security requirements for environments.

The following changes do not require the security requirements for operating environment

  • Changing the data processors
  • Changing the controller of data disclosed with a data permit
  • Combining data that some other authority has issued a permit for with data covered in Findata’s permit

In other respects, amendment permits are subject to the same security requirements as new data permits. Read more on the page: Regulation on secure operating environments

In the following instance, an amendment permit will not be granted

You must apply for a new data permit if:

  • The information sources for the data and the group studied change
  • The number of monitoring years is increased for a data permit issued by a party other than Findata

Logging into e-services

To submit an amendment permit application, log into our e-service at: asiointi.findata.fi using either Suomi.fi e-Identification or Haka login. For more information on logging in see the Logging into services page.

Please always log in using the same identification methods, so that you can see the applications you have sent and the decisions that have been given.

Amendment permit applications can be submitted in Finnish, Swedish or English

After logging in

  1. Go to the Data Catalogue tab
  2. Go to “Apply for new access rights” and select “Data permit amendment application” by clicking on “Add to basket” on the right and continue by clicking on “Apply
  3. Complete the application form utilising the instructions given below and send it to us. Unfortunately, after an application has been sent, it can no longer be edited. If you want to supplement an application that has already been sent, send us an email to info@findata.fi and tell us your application’s ID (e.g. 2022/53). We will return the application so you can supplement it.

See also

Dates of monthly maintenance outages in 2024
  • 18.1.2024
  • 22.2.2024
  • 21.3.2024
  • 18.4.2024
  • 23.5.2024
  • 20.6.2024
  • 18.7.2024
  • 22.8.2024
  • 19.9.2024
  • 17.10.2024
  • 21.11.2024
  • 19.12.2024

Instructions for completing an amendment application

1 Public information about the project

  • Project name
    • The permits granted by an authority are primarily public. We publish the following information on our web page for the projects that have been granted an amendment of a data permit: date of the permit, permit holder (organisation), authority/authorities that have granted the original data permit(s); type of the amendment.
  • A brief description of the project
    • Provide a short description of the study or project and the use of the requested data. The short description of the purpose of data use of a project that has been granted a data permit is published on Findata’s web page. Write the description so that it does not contain any confidential information.

2 Details of the applicant

  • Permit applicant refers to the data controller i.e., the organization or person named in the data permit application to whom the amendment of the data permit applied for will be issued. Enter the contact person’s information in the “Details of the contact person” section.
  • State which organization or individual is the controller of the data to be formed based on the data permit.
    • A controller under the EU General Data Protection Regulation (GDPR) is an organization or individual who is the controller of the data. The controller determines the purposes and means of processing the data generated based on the data permit. The controller can be either the applicant or someone else.
    • If the applicant acts as a processor of personal data on behalf of a third party (controller), the applicant and the controller must enter into a written agreement on the processing of personal data required by the General Data Protection Regulation.
    • There may be more than one controller and the controllers may be joint controllers, in which case they define the purposes and means of processing the data together. In the case of a joint controllership, select ‘A third party’ and enter all controllers in the additional information field.
  • Enter the applicant’s business ID. If the applicant is an individual, enter 123 in the field. If the applicant organization is located in an EU/EEA country other than Finland, name the official register in which the organization is registered.

3 Details of the contact person

  • Contact person refers to the person who responds to enquiries concerning the application. The contact person’s details can be forwarded to the controller during the processing of an application if amendment of the a data permit requires extraction and additional information is needed for the extraction.
  • Describe the relationship between the contact person and the applicant in the application. The relationship can be based on, for example, an employment or a public service appointment.

4 Invoicing details

  • E-invoice is always the primary method of invoicing. If the invoiced party is different from the applicant, indicate the connection of the invoiced party to the project in the application.
  • Invoicing details for Finnish payers:
    • E-invoicing is the primary invoicing method for Finnish payers. In your application, state the connection between the invoiced party and the project. Inconsistencies between the applicant and the invoiced party (e.g. the payer is not the applicant) can be clarified where necessary in the Additional information section.
    • If necessary ask for more information from your organisation’s financial department. You can also search for e-invoice addresses on the TIEKE Finnish Information Society Development Centre website (verkkolaskuosoite.fi). A list of e-invoicing addresses is maintained by Finnish e-invoice operators.
    • A VAT number is formed from a business ID e.g. 1234567-8. Add the two letter country code FI to its beginning and remove the hyphen from the ID e.g. FI12345678.
  • Invoicing details for foreign payers:
    • If the payer is not Finnish the payer should have a Peppol-address for the e-invoicing. Read more about Peppol (peppol.org).
    • If the payer doesn’t have a Peppol-address, the invoice is sent by mail.
Applicant’s business ID

Enter the applicant’s business ID If the applicant is a private individual, enter 123 into the field. If the applicant organisation is located in a country other than Finland or an EU/EEA member state, provide the name of the official register in which the organisation is registered.

Pay attention to the following

  • The contact information and billing information have been filled in appropriately and are consistent with the information provided elsewhere in the application.
  • In most cases, the applicant is an organization. If you are applying for a permit as an individual, you can provide additional information in the additional information field at the end of the form.

5 The permit or permits to which you apply for an amendment

  • Fill information about data permits that would be amended. Amendment of a data permit is only possible for valid permits.
  • Do not fill information about data permits that are not subjects to this application. If you are applying for an addition of data other than that referred to in the Act on the Secondary Use of Health and Social Data, list the permits considering this data in the section 7.
  • Indicate the issuers of the original data permits. You can indicate several permit issuers.

6 Purpose of data use

  • Note that when applying for a change to a data permit, the purpose of use must be the same as in the original permit.

Click to see more information about different use purposes:

Education

When data is to be used for education, the applied for data will be used to prepare teaching materials for personnel and persons studying to become social welfare and health care personnel who process customer data and social welfare and health care professionals. Please note: Data containing identifiers can only be used in teaching situations if teaching cannot be carried out anonymously due to the exceptional nature of the case, the nature of teaching or a similar reason.  The person providing teaching must inform their students of the confidentiality provisions in legislation and the sanctions resulting from their violation.

Planning and reporting duties of an authority

As a rule, only an authority may carry out the planning and reporting duties of an authority. If an authority does not act as the applicant in a data permit application, the authority must be the controller of the data. As a rule, when work is commissioned, the commissioning party will be the processor of personal data.

Scientific research

When data is to be used for scientific research, attach an up-to-date research plan and a research permit from the responsible/target organisation to your application. Also attach an opinion from the Ethics Committee, if the legislation applying to the research and/or the research setup so requires.

Criteria for scientific research (in general):

  • an appropriate research plan
  • responsible person or group
  • results to be published as a scientific publication
  • research produces new information.
Statistics

When data is to be used to form statistics, state in the application which party will compile the statistics and for what purpose.

7 Applied data permit amendment(s)

  • State which amendment or amendments you are applying for to the valid data permit or permits.
  • If necessary, indicate the current operating environment of the data. From 1 May 2022 onward, the analysis of the data is only permitted in audited operating environments that meet the requirements of the Act on the Secondary Use of Health and Social Data and the Findata’s regulation.
  • If you only want to transfer your research data to Kapseli, order Kapseli from Findata’s e-service.
  • If your data is transferred to Statistics Finland’s Fiona user environment because the data is combined with data provided by Statistics Finland as a statistical authority, select “Addition of data other than referred by the Secondary Use Act” as the applied data permit amendment. In this case, you do not need to apply for a change “Changing the operating environment of the data to an environment other than Kapseli”.
  • If you are applying to transfer your data to Statistics Finland’s Fiona operating environment for other reason and your data is not combined with data provided by Statistics Finland as a statistical authority, select “Changing the operating environment of the data to an environment other than Kapseli”.
Extension of the validity of the data permit
  • The data permit is granted for a fixed term, which will not exceed the period of time required for the purpose of use. The anonymised results must be extracted from the secure operating environment during the set period of use.
  • Indicate when will the need to use the data end including both active use and possible storage time.
  • Describe grounds for extension shortly.
Change to the personal data processors
  • List the new people to whom you want to add the right to process data.
    • Enter only the first name, last name and organisation of the processors (e.g. Alan Smithee, University of Helsinki).
    • Use a semicolon (;) to separate individuals from each other (e.g. Person 1, Organisation; Person 2, Organisation; etc.)
  • List the persons whose right to process the data is to be removed.
  • List the persons who have been granted permission to process the data in previous data permits and whose permission is valid. These persons are not required to submit a non-disclosure agreement.
Adding data (e.g. new variables)
  • An amendment for a data permit can only be applied if the data sources (e.g. registers) and the target group remain unchanged.
  • Indicate in the table from which register or registers new data (e.g. variables) will be extracted.
  • Define new variables using the extraction description form (download Word-file, 51,2 kb)
    • Download and fill in the form according to the instructions. Contact the controllers directly and go through the extraction description with the controllers before submitting the application.
    • Attach the completed extraction description forms in Word file format. The extraction description form is required in Word file format, as Findata or the controllers may have to make changes to it.
    • Information on different registers and the data contents of the registers (variable names, descriptions of variables, time period extracted from the register, etc.) is available in the Data Resources Catalogue (aineistokatalogi.fi).
Extension to the period from which data is extracted
  • The extension to the period from which data is extracted can only be applied by the amendment of the data permit if the original permit has been granted by Findata, or by the controller that has subsequently transferred its authority to grant permits to Findata.
  • List the registers for which you want to extend the the period from which data is extracted.
  • Define variables using the extraction description form (download Word-file, 51,2 kb).
    • Download and fill in the form according to the instructions. Contact the controllers directly and go through the extraction description with the controllers before submitting the application.
    • Attach the completed extraction description forms in Word file format. The extraction description form is required in Word file format, as Findata or the controllers may have to make changes to it.
    • Information on different registers and the data contents of the registers (variable names, descriptions of variables, time period extracted from the register, etc.) is available in the Data Resources Catalogue (aineistokatalogi.fi).
Change the controller of data disclosed with a data permit
  • Indicate who or which party is the controller mentioned in the previous data permit decision.
  • Indicate who or what party is the new controller of the data.
  • Attach to the application a confirmation signed by both parties that the change of the data controller has been agreed upon between the previous controller and the new data controller.
Addition of data other than referred by the Secondary Use Act
  • The addition of other data than referred in the Secondary Act can only be applied by the amendment of the data permit if the original permit has been granted by Findata.
  • Freely describe the data to be combined and tell where the data comes from (data controller, survey material etc.), the format of the files and for which target group the data is extracted.
  • Fill in preliminary information about data to be combined.
    • In case the data set includes data in more than one format (pdf, Excel, csv etc.), add all different formats on their own rows.
    • Deliver the tables (which Findata needs to pseudonymize) in csv or SAS-format.
    • Size of the files: If the data is in table format, provide an estimate of the number of rows and columns.
    • Special notes: Explain which variables or sections include direct or indirect identifiers. Examples: an address variable; a text variable including names; or the names of the figure or pdf-files include personal identification code.
  • Indicate, what is the (legal) basis for the use of data that is not covered by the Act on the Secondary Use of Health and Social Data.
  • Note! Do not attach data to this application. Findata will provide instructions on how to deliver the data securely.
Expanding the processing of personal data outside the EU and EEA
  • The processing of personal data abroad is counted as transfer of personal data even if the data is in a remote operating environment. Read more about transferring personal data and the legal bases for this on the Office of the Data Protection Ombudsman’s website (tietosuoja.fi).
  • Indicate in which countries is the data currently being processed.
  • As data is being transferred outside the EU/EEA, specify the legal basis, in accordance with the General Data Protection Regulation (GDPR), that is needed for the transfer of data.
  • Indicate, to which country outside the EU/EEA would you like to expand the data processing to.

8 Additional information and attachments

  • In this section, you can specify previous sections of the application, for example with regard to invoicing.
  • If you have spoken about your application with a Findata employee in advance, give the person’s name.
  • If you have spoken about your application or about extraction with a contact persons of controllers in advance, enter the names of these persons here. For example, if you have agreed that extraction will be implemented in a certain way, give the name of the person with whom you agreed on the matter.
  • Add possible attachments.
  • Please do not attach data to this application

9 Confirmation of information

Before we make a decision on an application, you as the applicant must approve the maximum cost estimate for the extraction and pre-processing of data.

Application processing times will be affected by the content of the application, the current application processing situation and the controller’s response times.

You can expediate the processing of your application in the following ways.

  1. Complete the application carefully.
  2. Attach all the previous permit decisions to the application.
  3. Attach the completed and signed confidentiality agreements to the application. Every added personal data processor must have their own confidentiality agreement.

Information on costs

We will charge a decision fee for amendment permits according to the attached pricelist. In addition to the decision fee, we will, where necessary, charge an hourly fee for data processing carried out at Findata.

You’ll find more information about costs on our Pricing page.

Amendment permits pricing

Price categoryCriteriaPrice
Minor amendment or changeThe application seeks the following amendments or changes:
– extension of the permit
– modification of the persons authorized to process the data
– a change in the controller of the material released with the data
– changing the data processing environment from Findata’s Kapseli remote access system to another service provider’s secure processing environment.

300,00 EUR
Other amendment or changeThe application seeks one or more of the following changes or amendments:
– the extension of the monitoring years to the authorization granted by Findata, provided that the persons to be examined and the data to be extracted remain the same
– extension of the processing of the data by way of derogation from an authorization granted outside the EU or EEA countries
– adding variables to the data collection after the extraction has already taken place
– the addition of data under other legislation in derogation from the authorization granted.
600,00 EUR
No VAT is charged on permit decisions.

Ensure the correct address for the application

Select the controllers from which the data will be retrieved

Apply permit from the controller in question. The exception is those controllers who have delegated permit jurisdiction to Findata.

Please note that Findata is responsible for data permit and amendment applications whenever the data of data controllers covered by the Act on secondary use is combined. When evaluating the competent authority, all data related to the application under the Act must be taken into account.

Apply permit (s) from the controllers in question.

Findata is responsible for data permits of the Finnish Center for Pensions (ETK) and the Finnish Digital Agency (DVV) and / or Statistics Finland if the data are combined with

  • data of other public organizations under the Act on Secondary Use of Health and Social Data (For Statistics Finland, at least two other organizations are needed, for DVV and ETK, one is sufficient)
  • data stored on Kanta services or
  • to the register data of a private social or health care service provider.

Apply permit from Findata.

Findata is responsible for processing and making decisions concerning data permit and amendment applications, when the application applies to:

  • data from numerous public social and health sector controllers
  • register data from one or numerous private social welfare and health care service organisers, or
  • customer data saved in the Kanta Services.

Apply permit from Findata.

The Regional Administrative Agencies (AVI) have delegated the jurisdiction to Findata.

Apply permit from Findata.

National Supervisory Authority for Welfare and Health Valvira have delegated the jurisdiction to Findata.

Apply for a data permit

Finnish Institute for Health and Welfare (THL) has delegated the jurisdiction to Findata. As far as THL is concerned, the delegation of jurisdiction does not apply to its

  • internal permit management
  • the transfer of samples and data transferred to THL Biobank.

Permit is applied from Statistics Finland and the respective data controller. Exceptions are the registrars who have delegated the jurisdiction to Findata.

We are responsible for data permits for data subject to the Secondary Act of Statistics Finland when they are combined

  • to the information of at least two public organizations covered by secondary laws
  • to data stored in Kanta services or
  • to the register data of a private social or healthcare service organizer.

Apply permit from Findata.

Findata is responsible for processing and making decisions concerning data permit and amendment applications, when the application applies to:

  • data from numerous public social and health sector controllers
  • register data from one or numerous private social welfare and health care service organisers, or
  • customer data saved in the Kanta Services.

Please select at least one data controller or group.