If you need to amend a valid data permit, you can apply for an amendment permit. The amendment application must be submitted to the authority that granted the original data permit.
Before applying for a amendment permit, please read the Permits page.
What to remember before sending an application
Select the correct application type
There are different types of applications for different information needs
- Data permit application, when you need data on individuals
- Data request, when you need statistical data
- Amendment application, when you are applying for an amendment to a valid data permit
Describe and limit data
Define the data to be applied for at the variable level and remember the principle of minimisation for other information. Utilise the Data Resources Catalogue (aineistokatalogi.fi) and controller’s advisory services
- Where from and how do I extract the target group? Is the definition specific enough?
- Are control subjects/relatives extracted? How will they be defined?
- From which registers will the data be extracted?
- What variables will be included in the extraction?
Other data to be combined
- Have you made sure that the other data is described on the application?
- Are the permits for other data valid or is the permit process pending?
Determine the competent authority
We grant permits for the secondary use of social and health data when the application applies to
- Data from several public social and health sector controllers covered by the Finnish Secondary Use Act
- Data from a single public controller that has transferred the right to issue permits to Findata (see the list)
- Data from one or more private social welfare and health care service organisers
- Data saved in the Kanta Services
- Data in Findata’s ready-made dataset
General information on amendment applications
Apply for an amendment to your data permit from Findata if Findata granted the original permit or if the data controller has transferred its permitting authority to Findata.
If you applied for the original permits directly from the data controllers, apply for the amendment separately from each data controller that granted the permit.
An amendment permit can be granted provided that the data sources and the study population remain unchanged.
Amendment applications and their attachments are confidential. When necessary, we will forward critical data as well as the applicant’s name and contact details to the controller.
The decisions and permits granted by an authority are primarily public. On our website, we will publish the following information on projects that have received favourable data permit amendment decisions:
- date of decision
- permit validity period
- permit holder (organisation)
- project name (if known)
- issuer of the original permits
- amendment type
This public data can be shared from the website also to other communication channels.
See the page Issued permits.
How to speed up the processing of your amendment application
Processing time for your application depends on several factors, including the clarity of your application, our current processing load, and response times from data controllers. To expedite the process:
- Complete the application carefully ensuring all sections are filled out thoroughly and accurately.
- Attach all previous permit decisions to your application.
- Attach to your application all previous non-disclosure agreements (NDA). Each person handling the material to be added must have their own NDA.
- Use Findata’s advisory service for additional support and clarification.
For more information, visit the Data page or check the Data Resources Catalogue (aineistokatalogi.fi).
What can you apply for with an amendment application?
A data permit amendment application can be used to:
- Extend the period of validity
- Change the data processors
- Add data (such as variables)
- Extend the period from which data is extracted
- Change the controller of data disclosed with a data permit
- Change the data processing environment
- Expand the processing of data outside the EU/EEA as opposed to the granted permit
- Combining data with a prior permit to data with a Findata permit
You must apply for a new data permit if:
- the data sources (for example, registers) included in the dataset change
- the study population (target group) changes
- you need data for a longer time period and the original permit was granted by an authority other than Findata or a data controller that has transferred its permit authority to Findata
- you applied for the original permit(s) directly from the data controller(s)
- you are applying to change the secure processing environment to one that is not compliant with the Secondary Use Act
- you are applying to change the data to be extracted under a data permit that covers recurring data extractions.
An amendment cannot be applied for permits that are no longer valid.
Secure processing environment
Data may only be analysed in audited secure processing environments that comply with the requirements of the Secondary Use Act and Findata’s regulation. If you wish to process the data in an environment other than a secure processing environment compliant with the Secondary Use Act, you must apply for a new data permit.
The same secure processing environment requirements apply to amendment permits as to new data permits. The following amendments are exceptions and do not require compliance with the secure processing environment requirements:
- changing the persons authorised to process the data
- changing the data controller of the data disclosed under the data permit
- combining previously authorised data with a dataset authorised by Findata.
Regulation on secure processing environments
Findata has issued a regulation specifying the information security requirements for secure processing environments used for secondary use of social and health data.
These requirements apply to all purposes covered by the Act on the Secondary Use of Health and Social Data, including:
- Scientific research
- Statistics
- Teaching (only for preparing teaching materials, not actual teaching)
- Planning and investigation tasks of public authorities
Since 1 May 2022, compliance with these requirements has been mandatory for any data processed outside Findata’s Kapseli environment. In addition, the processing environment must be assessed by a data security assessment body that must issue a certificate on the assessment.
The regulation allows for different technical solutions. Secure environments may range from:
- A physically and technically secure space with an isolated analysis device
- Cloud-based solutions, provided they meet the required security standards
Foreign researchers’ processing environments must also comply with these requirements. Compliance can be demonstrated through internationally recognised security certifications, verified by an approved Finnish assessment body.
Read more on the Regulation on processing environments page.
Logging into the e-service
All applications to Findata are sent in our e-service with an online form. Log into the service using Suomi.fi e-Identification or Haka log in.
Please use the same identification method each time you log in to view your submitted applications and decisions. For more information on logging in see the Login page
After logging in
- Go to the Submit application tab.
- Choose Data permit amendment application by clicking Fill in the application.
- Complete the application form following the instructions provided and submit it.
Once an application is submitted, it cannot be edited. If you need to supplement a submitted application, email us at info@findata.fi with your application ID (e.g., 2022/53). We will return the application for you to update.
Amendment permit applications can be submitted in Finnish, Swedish or English
See also
Dates of monthly maintenance outages in 2026
Monthly maintenance on Findata’s services occurs on the Thursday after the second Tuesday of each month, from 8 a.m. to 12 p.m. (EEST), following Microsoft’s Windows update schedule.
- 22 January
- 19 February
- 19 March
- 23 April
- 21 May
- 11 June
- 23 July
- 20 August
- 17 September
- 22 October
- 19 November
- 17 December
How to submit an amendment application
1 Public information about the project
- Project name
- The name of the project granted an amendment permit will be published on Findata’s website. Ensure the project name does not include confidential information.
- A brief description of the project
- Provide a concise description of the study or project and the intended use of the requested data. This description, once the data permit is granted, will be posted on Findata’s website. Avoid including confidential details in this description.
2 Details of the applicant
- The applicant is the person or organization named in the application to whom the data permit will be issued.
- Enter the applicant’s business ID. If the applicant is an individual, enter 123 in the field. For organizations located in an EU/EEA country other than Finland, provide the name of the official register where the organization is registered.
- Specify which organization or individual is the data controller.
- The amendment permit can be applied for by the data controller or by another entity on behalf of the data controller.
- In the case of a joint controllership, select ‘A third party’ and enter all controllers in the additional information field.
Controllership of data being applied for
A controller under the EU General Data Protection Regulation (GDPR) is an organization or individual who is the controller of the data. The controller determines the purposes and means of processing the data generated based on the data permit.
There may be more than one controller and the controllers may be joint controllers, in which case they define the purposes and means of processing the data together. In the case of a joint controllership, select ‘A third party’ and enter all controllers in the additional information field.
3 Details of the contact person
- The contact person is the individual responsible for answering enquiries concerning the application. Their contact details may be shared with the data controller if additional information is needed during processing.
- Describe the contact person’s relationship with the applicant, such as employment or a public service appointment.
4 Invoicing details
- E-invoicing is the primary method of invoicing.
- If the invoiced party is different from the applicant, clarify this in the ‘Additional Information’ section.
- Invoicing details for Finnish payers:
- Use the business ID to form the VAT number. Add the country code “FI” to the beginning and remove any hyphen (e.g., business ID “1234567-8” becomes VAT number “FI12345678”).
- Check verkkolaskuosoite.fi for e-invoice addresses.
- Invoicing details for foreign payers:
- Foreign payers should have a Peppol address for e-invoicing. For more information, visit peppol.org.
- If the payer doesn’t have a Peppol-address, the invoice is sent by mail.
Applicant’s business ID
Enter the applicant’s business ID If the applicant is a private individual, enter 123 into the field. If the applicant organisation is located in a country other than Finland or an EU/EEA member state, provide the name of the official register in which the organisation is registered.
Checklist for applicants
- Ensure that contact information and billing details are filled in correctly and are consistent with the information provided elsewhere in the application.
- If you are applying as an individual rather than an organization, provide additional information in the “Additional Information” field at the end of the form.
5 The permit or permits to which you apply for an amendment
- Fill information about data permits that you want amended. Amendment of a data permit is only possible for valid permits.
- Do not fill information about data permits that are not subject to this application. If you are applying for an addition of data other than that referred to in the Secondary Use Act, list the permits considering this data in the section 7.
- Indicate the issuers of the original data permits. You can indicate several permit issuers.
6 Purpose of data use
- Note that when applying for a change to a data permit, the purpose of use must be the same as in the original permit.
Click to see more information about different use purposes:
Education
When data is to be used for education, the applied for data will be used to prepare teaching materials for personnel and persons studying to become social welfare and health care personnel who process customer data and social welfare and health care professionals. Please note: Data containing identifiers can only be used in teaching situations if teaching cannot be carried out anonymously due to the exceptional nature of the case, the nature of teaching or a similar reason. The person providing teaching must inform their students of the confidentiality provisions in legislation and the sanctions resulting from their violation.
Planning and reporting duty of an authority
As a rule, only an authority may carry out the planning and reporting duties of an authority. If an authority does not act as the applicant in a data permit application, the authority must be the controller of the data. As a rule, when work is commissioned, the commissioning party will be the processor of personal data.
Scientific research
When data is to be used for scientific research, attach an up-to-date research plan and a research permit from the responsible/target organisation to your application. Also attach an opinion from the Ethics Committee, if the legislation applying to the research and/or the research setup so requires.
Criteria for scientific research (in general):
- an appropriate research plan
- responsible person or group
- results to be published as a scientific publication
- research produces new information.
Statistics
When data is to be used to form statistics, state in the application which party will compile the statistics and for what purpose.
7 Applied data permit amendment(s)
- State which amendment or amendments you are applying for to the valid data permit(s).
- If necessary, indicate the current processing environment of the data. The analysis of the data is only permitted in audited processing environments that meet the requirements of the Secondary Use Act and the Findata’s regulation.
- If you only want to transfer your research data to Kapseli, order Kapseli from Findata’s e-service.
- If your data is transferred to Statistics Finland’s Fiona user environment because the data is combined with data provided by Statistics Finland as a statistical authority, select “Addition of data other than referred by the Secondary Use Act” as the applied data permit amendment. In this case, you do not need to apply for a change “Changing the operating environment of the data to an environment other than Kapseli”.
- If you are applying to transfer your data to Statistics Finland’s Fiona operating environment for other reason and your data is not combined with data provided by Statistics Finland as a statistical authority, select “Changing the operating environment of the data to an environment other than Kapseli”.
Change to the processing environment of personal data
Apply for this amendment when you want to transfer your data to another secure processing environment. The new environment must be listed in the Astori register maintained by the Finnish Supervisory Agency. If you want to move the data to an environment other than a secure processing environment under the Secondary Use Act, you need a new data permit.
Transferring data from one processing environment to another is subject to a fee. The fee consists of a basic fee and an additional fee for each zip folder transferred. The transfer fee is charged in addition to the decision fee for the amendment permit.
If you are moving from Kapseli to another environment, also update your Kapseli order.
Statistics Finland data and the FIONA environment
If the data is moved to the FIONA environment because it will be combined with data disclosed by Statistics Finland in its role as a statistical authority, select the amendment “Combining data with a prior permit to data with a Findata permit”. In this case, you do not need to apply separately for a change to the processing environment.
If the data is moved to FIONA for another reason and is not combined with Statistics Finland data, select the amendment “Change to the processing environment of personal data”.
Extension of the validity of the data permit
Apply for this amendment when you need more time to use or store the data.
Enter the new end date you want for the permit and explain why the validity period needs to be extended.
A data permit is only granted for the period required for the purpose of use. Also consider how long you need to store the data. If you need to keep the data, for example to verify your research, the permit must be valid for the whole storage period.
Anonymised results must be exported from the secure processing environment before the permit expires.
Change to the personal data processors
Apply for this amendment when new people join the project or there are other changes to who processes the data.
In the application, list:
- the people whose right to process the data is to be removed
- the current processors, meaning the people whose previously granted right to process the data will remain valid
- the new people who are applying for the right to process the data
For each person, give their name, organisation and email address.
Adding data (e.g. new variables)
Apply for this amendment when you need more data from the same registers on the same target group than your current permit covers. If the registers or the target group change, you need a new data permit.
Use the extraction description form to indicate which register or registers the new data will be extracted from, and give details of the variables.
Go through the extraction with the data controllers before you submit the application. They can tell you whether the extraction is possible and how much it will cost. You can find information on the variables in the Data Resources Catalogue.
You must approve the extraction description before we can make a decision.
Extension to the period from which data is extracted
Apply for this amendment when you need data covering a longer period than your current permit covers.
You can apply for this extension if:
- the original permit was granted by Findata
- the original permit was granted by a data controller that has transferred its permit authority to Findata, or
- Findata has extended the validity of a data permit granted by another authority, which makes Findata’s decision the most recent decision in the matter.
In other cases, you need a new data permit.
List the registers the extension applies to, and give details of the variables using the extraction description form. Go through the extraction with the data controllers before you submit the application. You must approve the extraction description before we can make a decision.
Change the controller of data disclosed with a data permit
Apply for this amendment when the controller of the data disclosed under the data permit changes.
In the application, give the data controller named in the previous data permit decision and the new data controller.
Attach a written confirmation from both parties that the previous and the new data controller have agreed on the change.
Combining data with a prior permit to data with a Findata permit
Apply for this amendment when you want to combine data authorised by another data controller with the data under your valid Findata data permit.
In the amendment permit application, provide:
- a description of the datasets to be combined
- preliminary information on the datasets, in the table provided in the application
- the legal basis for using any data that falls outside the scope of the Secondary Use Act
Do not attach the datasets to the application. After the decision, you will receive instructions on how to deliver the data securely.
Expanding the processing of personal data outside the EU or EEA
Apply for this amendment when the data will be processed from outside the EU or EEA.
Processing personal data from abroad is, as a rule, considered a transfer of personal data, even if the data is in a remote access environment. The transfer must have a legal basis under the General Data Protection Regulation.
Learn about the legal bases for transfers:
8 Additional information and attachments
- In this section, you can specify previous sections of the application, for example with regard to invoicing.
- If you have spoken about your application with a Findata employee in advance, give the person’s name.
- Please do not attach data to this application
9 Confirmation of information
- Confirm the information provided on the application form.
- A fee will be charged for the permit decision in accordance with the fee decree in force at the time.
- Before we make a decision on the application, you as the applicant must agree to the extraction description, if a change to the extraction is requested.
Information on costs
We will charge a decision fee for amendment permits according to the attached pricelist. In addition to the decision fee, we will, where necessary, charge an hourly fee for data processing carried out at Findata.
You’ll find more information about costs on our Pricing page.
Amendment permits pricing
| Price category | Criteria | Price |
|---|---|---|
| Minor amendment | The application seeks one or more of the following amendments or changes: – Extension of the validity of the data permit – Change to the personal data processors – Change to the controller of data disclosed under a data permit – Change to the processing environment of personal data, from Findata’s Kapseli to another service provider’s processing environment | €230.00 |
| Other amendment | The application seeks one or more of the following amendments or changes: – Extension to the period from which data is extracted – Expanding the processing of personal data outside the EU or EEA – Adding data (e.g. new variables) – Combining data with a prior permit to data with a Findata permit | €700.00 |
Findata’s hourly based fees
| Price category | Criteria | Price |
|---|---|---|
| Data processing and transferring | Hourly fee for data combining, pre-processing, pseudonymisation and/or anonymisation and transferring. Minimum one hour. | €151.00/hour |
| Data transferring via Tunneli | The price is based on the number of zip folders to be transferred: Base fee: 2 hours × €151.00 = €302.00 Additional fee: 0.5 hours (€75.50) per zip folder Example: If there are three zip folders to be transferred, the total cost is: €302.00 + (3 × €75.50) = €528.50 Each zip folder can be a maximum of 4 GB in size. If the total data to be transferred exceeds 40 GB, please contact us in advance at data@findata.fi so we can arrange the best approach for transferring your data. NB! This pricing model is applied instead of hourly pricing when data is transferred with a Findata amendment permit between secure processing environments, or in transfers that do not involve a Findata permit or a Kapseli subscription. | €302.00 + €75.50 per zip folder |
| Data transferring via Supertunneli | Joining and using the Supertunneli API is free of charge for the sending and receiving organisations. The permit holder pays the transfer costs. The price is based on the number of zip folders to be transferred: Base fee: 2 hours × €151.00 = €302.00 Additional fee: 0.5 hours (€75.50) per zip folder Each zip folder can be a maximum of 1 terabyte (1 TB) in size. If the data to be transferred exceeds 1 TB, please contact us in advance at data@findata.fi so we can arrange the best approach for transferring your data. NB! This pricing model is applied instead of hourly pricing when data is transferred with a Findata amendment permit between secure processing environments, or in transfers that do not involve a Findata permit or a Kapseli subscription. | €302.00 + €75.50 per zip folder |
Ensure the correct address for the application
Please note that if you have applied the original data permits directly from data controllers, you must apply the amendments from those controllers as well.