Amendment permits

An amendment application allows the applicant to apply for changes to previous, currently valid permits. Please note that for the amendment permit we need all previous permits for which an amendment or change is applied for or on which the previous permits are based.

Please read the Permits web page before applying for a data amendment permit. The page includes useful information to take into consideration before applying, while applying and after applying.

General information on amendment applications

See what you can apply to amend with an amendment application. Read more

What can you apply for with an amendment application?

This page contains information on when an amendment application is adequate and when you will new a new data permit application. Read more

Logging into e-services

This page contains information on how to log in and select an application form. Read more

Instructions for completing an amendment application

See what is asked in the application. Read more

Information on costs

See the current pricelist for amendment decisions Read more

Application assistant

Ensure the correct address for the amendment application. Read more

What to remember before sending an application

Select the correct application type

There are different types of applications for different information needs

Data permit application, when you need data on individuals
Data request, when you need statistical data
Amendment application, when you are applying for an amendment to a valid data permit

Describe and limit data

Define the data to be applied for at the variable level and remember the principle of minimisation for other information. Utilise the Data Catalogue (https://aineistokatalogi.fi/) and controller’s advisory services

Where from and how do I extract the target group? Is the definition specific enough?
Are control subjects/relatives extracted? How will they be defined?
From which registers will the data be extracted?
What variables will be included in the extraction?

Other data to be combined

Have you made sure that the other data is described on the application?
Are the permits for other data valid or is the permit process pending?

Determine the competent authority

Findata is responsible for the application and the permit decision whenever data are combined from data controllers covered by the Act on secondary use of health and social data. The assessment of the competent authority must therefore consider all the data related to the application.

Check from the application assistant which authority the application should be sent to: Application assistant

General information on amendment applications

A data permit amendment application is sent to Findata whenever data are combined from data controllers covered by the Act on secondary use of health and social data, or if the controller has transferred its power to grant permits to Findata. A data amendment permit may be granted when the data sources and the group of research subjects remain unchanged.

Amendment applications and their attachments are confidential. When necessary, we will forward critical data as well as the applicant’s name and contact details to the controller.

The decisions and permits granted by an authority are primarily public. On our website, we will publish the following information on projects that have received favourable data permit amendment decisions:

date of decision
permit validity period
permit holder (organisation)
project name (if known)
issuer of the original permits
amendment type

This public data can be shared from the website also to other communication channels.

What can you apply for with an amendment application?

A data permit amendment application can be used to:

Extend the period of validity
Change the data processors
Extend the period from which data is extracted (only if the previous permit has been granted by Findata, or by the controller that has subsequently transferred its authority to grant permits to Findata)
Change the controller of data disclosed with a data permit
Change the permit holder
Change the data processing environment from Findata’s remote access environment to another audited access environment
Expand the processing of data outside the EU/EEA as opposed to the granted permit
Add variables to the extraction of material when data extraction has already been completed (the target group, possible controls and relatives, and the registers from which the extractions are carried out remain the same)
Add data other than that referred to in the Act on the Secondary Use of Health and Social Data, as opposed to the permit granted by Findata

As a rule, the data will always be disclosed to Findata’s secure operating environment Kapseli . However, the Act makes it possible to disclose information to other secure operating environments, if necessary. Read more below in the section: Findata’s regulation sets information security requirements for environments.

The following changes do not require the security requirements for operating environment

Changing the data processors
Changing the controller of data disclosed with a data permit
Changing the permit holder
Add data other than that referred to in the Act on the Secondary Use of Health and Social Data, as opposed to the permit granted by Findata

In other respects, amendment permits are subject to the same security requirements as new data permits. Read more on the page: Regulation on secure operating environments

In the following instance, an amendment permit will not be granted

You must apply for a new data permit if:

The information sources for the data and the group studied change
The number of monitoring years is increased for a data permit issued by a party other than Findata

Logging into e-services

To submit an amendment permit application, log into our e-service at: asiointi.findata.fi using either Suomi.fi e-Identification or Haka login. For more information on logging in see the Logging into services page.

Please always log in using the same identification methods, so that you can see the applications you have sent and the decisions that have been given.

Amendment permit applications can be submitted in Finnish, Swedish or English

After logging in

Go to the Data Catalogue tab
Go to “Apply for new access rights” and select “Data permit amendment application” by clicking on “Add to basket” on the right and continue by clicking on “Apply”
Complete the application form utilising the instructions given below and send it to us. Unfortunately, after an application has been sent, it can no longer be edited. If you want to supplement an application that has already been sent, send us an email to info@findata.fi and tell us your application’s ID (e.g. 2022/53). We will return the application so you can supplement it.

Instructions for completing an amendment application

1 Public information about the project

Project name
- The permits granted by an authority are primarily public. We publish the following information on our web page for the projects that have been granted an amendment of a data permit: date of the permit, permit holder (organisation), authority/authorities that have granted the original data permit(s); type of the amendment.
A brief description of the project
- Please provide a short description of the study or project and the use of the requested data. The short description of the purpose of data use of a project that has been granted a data permit is published on Findata’s web page. Write the description so that it does not contain any confidential information.

2 Details of the applicant

Permit applicant refers to the person or organization named in the data permit application to whom the amendment of the data permit applied for will be issued. Enter the contact person’s information in the “Details of the contact person” section.
Enter the applicant’s business ID. If the applicant is an individual, enter 123 in the field. If the applicant organization is located in an EU/EEA country other than Finland, please name the official register in which the organization is registered.

3 Details of the contact person

Contact person refers to the person who responds to enquiries concerning the application. The contact person’s details can be forwarded to the controller during the processing of an application if amendment of the a data permit requires extraction and additional information is needed for the extraction.
Describe the relationship between the contact person and the applicant in the application. The relationship can be based on, for example, an employment or a public service appointment.

4 Invoicing details

E-invoice is always the primary method of invoicing. If the invoiced party is different from the applicant, indicate the connection of the invoiced party to the project in the application.
Invoicing details for Finnish payers:
- E-invoicing is the primary invoicing method for Finnish payers. In your application, state the connection between the invoiced party and the project. Inconsistencies between the applicant and the invoiced party (e.g. the payer is not the applicant) can be clarified where necessary in the Additional information section.
- If necessary ask for more information from your organisation’s financial department. You can also search for e-invoice addresses on the TIEKE Finnish Information Society Development Centre website: https://verkkolaskuosoite.fi/. A list of e-invoicing addresses is maintained by Finnish e-invoice operators.
- A VAT number is formed from a business ID e.g. 1234567-8. Add the two letter country code FI to its beginning and remove the hyphen from the ID e.g. FI12345678.
Invoicing details for foreign payers:
- If the payer is not Finnish the payer should have a Peppol-address for the e-invoicing.
- If the payer doesn’t have a Peppol-address, the invoice is sent by mail.

Applicant’s business ID

Enter the applicant’s business ID If the applicant is a private individual, enter 123 into the field. If the applicant organisation is located in a country other than Finland or an EU/EEA member state, please provide the name of the official register in which the organisation is registered.

Pay attention to the following

The contact information and billing information have been filled in appropriately and are consistent with the information provided elsewhere in the application.
In most cases, the applicant is an organization. If you are applying for a permit as an individual, you can provide additional information in the additional information field at the end of the form.

5 The permit or permits to which you apply for an amendment

Please fill information about data permits that would be amended. Amendment of a data permit is only possible for valid permits.
Please do not fill information about data permits that are not subjects to this application. If you are applying for an addition of data other than that referred to in the Act on the Secondary Use of Health and Social Data, please list the permits considering this data in the section 7.
Indicate the issuers of the original data permits. You can indicate several permit issuers.

6 Purpose of data use

Please note that when applying for a change to a data permit, the purpose of use must be the same as in the original permit.

Click to see more information about different use purposes:

Education

When data is to be used for education, the applied for data will be used to prepare teaching materials for personnel and persons studying to become social welfare and health care personnel who process customer data and social welfare and health care professionals. Please note: Data containing identifiers can only be used in teaching situations if teaching cannot be carried out anonymously due to the exceptional nature of the case, the nature of teaching or a similar reason. The person providing teaching must inform their students of the confidentiality provisions in legislation and the sanctions resulting from their violation.

Planning and reporting duties of an authority

As a rule, only an authority may carry out the planning and reporting duties of an authority. If an authority does not act as the applicant in a data permit application, the authority must be the controller of the data. As a rule, when work is commissioned, the commissioning party will be the processor of personal data.

Scientific research

When data is to be used for scientific research, attach an up-to-date research plan and a research permit from the responsible/target organisation to your application. Also attach an opinion from the Ethics Committee, if the legislation applying to the research and/or the research setup so requires.

Criteria for scientific research (in general):

an appropriate research plan
responsible person or group
results to be published as a scientific publication
research produces new information.

Statistics

When data is to be used to form statistics, state in the application which party will compile the statistics and for what purpose.

7 Applied data permit amendment(s)

State which amendment or amendments you are applying for to the valid data permit or permits.
If necessary, indicate the current operating environment of the data. From 1 May 2022 onward, the analysis of the data is only permitted in audited operating environments that meet the requirements of the Act on the Secondary Use of Health and Social Data and the Findata’s regulation.
If you only want to transfer your research data to Kapseli, please order Kapseli from Findata’s e-service.
If your data is transferred to Statistics Finland’s Fiona user environment because the data is combined with data provided by Statistics Finland as a statistical authority, select “Addition of data other than referred by the Secondary Use Act” as the applied data permit amendment. In this case, you do not need to apply for a change “Changing the operating environment of the data to an environment other than Kapseli”.
If you are applying to transfer your data to Statistics Finland’s Fiona operating environment for other reason and your data is not combined with data provided by Statistics Finland as a statistical authority, select “Changing the operating environment of the data to an environment other than Kapseli”.

Download the confidentiality commitment form from the links below:

Findata confidentiality commitment form in Finnish
(Word file, 35 kt)
Findata confidentiality commitment form in English
(Word file, 40 kt)

Extension of the validity of the data permit

The data permit is granted for a fixed term, which will not exceed the period of time required for the purpose of use. The anonymised results must be extracted from the secure operating environment during the set period of use.
Please indicate when will the need to use the data end including both active use and possible storage time.
Describe grounds for extension shortly.

Change to the personal data processors

List the new people to whom you want to add the right to process data.
- Enter only the first name, last name and organisation of the processors (e.g. Alan Smithee, University of X).
- Use a semicolon (;) to separate individuals from each other (e.g. Persno 1, Organisation; Person 2, Organisation; etc.)
Attach non-disclosure agreements to the application from new persons who will be processing the data.
Download the confidentiality agreement form from the link below:
- Findata confidentiality agreement form in Finnish
  (Word file, 35 kt)
- Findata confidentiality agreement form in English
  (Word file, 40 kt)
List the persons whose right to process the data is to be removed.
List the persons who have been granted permission to process the data in previous data permits. These persons are not required to submit a non-disclosure agreement.

Adding data (e.g. new variables)

An amendment for a data permit can only be applied if the data sources (e.g. registers) and the target group remain unchanged.
Indicate in the table from which register or registers new data (e.g. variables) will be extracted.
Define new variables using the extraction description form: findata.fi/extraction-description-form.
- Download and fill in the form according to the instructions. Contact the controllers directly and go through the extraction description with the controllers before submitting the application.
- Please attach the completed extraction description forms in Word file format. The extraction description form is required in Word file format, as Findata or the controllers may have to make changes to it.
- Information on different registers and the data contents of the registers (variable names, descriptions of variables, time period extracted from the register, etc.) is available in the Data Resources Catalogue: https://aineistokatalogi.fi/.

Extension to the period from which data is extracted

The extension to the period from which data is extracted can only be applied by the amendment of the data permit if the original permit has been granted by Findata, or by the controller that has subsequently transferred its authority to grant permits to Findata.
List the registers for which you want to extend the the period from which data is extracted.
Define variables using the extraction description form: findata.fi/extraction-description-form.
- Download and fill in the form according to the instructions. Contact the controllers directly and go through the extraction description with the controllers before submitting the application.
- Please attach the completed extraction description forms in Word file format. The extraction description form is required in Word file format, as Findata or the controllers may have to make changes to it.
- Information on different registers and the data contents of the registers (variable names, descriptions of variables, time period extracted from the register, etc.) is available in the Data Resources Catalogue: https://aineistokatalogi.fi/.

Change the controller of data disclosed with a data permit

Please indicate who or which party is the controller mentioned in the previous data permit decision.
Please indicate who or what party is the new controller of the data.
Attach to the application a confirmation signed by both parties that the change of the data controller has been agreed upon between the previous controller and the new data controller.

Change the permit holder of data disclosed with a data permit

Please indicate, who or which party is the permit holder mentioned in the previous data permit decision.
Please indicate, who or which party is the new permit holder.
Attach to the application a confirmation signed by both parties that the change of the permit holder has been agreed upon between the previous permit holder and the new data permit holder.

Addition of data other than referred by the Secondary Use Act

The addition of other data than referred in the Secondary Act can only be applied by the amendment of the data permit if the original permit has been granted by Findata.
Freely describe the data to be combined and tell where the data comes from (data controller, survey material etc.), the format of the files and for which target group the data is extracted.
Fill in preliminary information about data to be combined.
- In case the data set includes data in more than one format (pdf, Excel, csv etc.), add all different formats on their own rows.
- Please deliver the tables (which Findata needs to pseudonymize) in csv or SAS-format.
- Size of the files: If the data is in table format, provide an estimate of the number of rows and columns.
- Special notes: Please, explain which variables/sections include direct or indirect identifiers. Examples: an address variable; a text variable including names; or the names of the figure/pdf-files include personal identification code.
Please indicate, what is the (legal) basis for the use of data that is not covered by the Act on the Secondary Use of Health and Social Data.
Note! Do not attach data to this application. Findata will provide instructions on how to deliver the data securely.

Expanding the processing of personal data outside the EU and EEA

The processing of personal data abroad is counted as transfer of personal data even if the data is in a remote operating environment. Read more about transferring personal data and the legal bases for this on the Office of the Data Protection Ombudsman’s website: https://tietosuoja.fi/.
Please indicate in which countries is the data currently being processed.
As data is being transferred outside the EU/EEA, please specify the legal basis, in accordance with the General Data Protection Regulation (GDPR), that is needed for the transfer of data.
Please indicate, to which country outside the EU/EEA would you like to expand the data processing to.

8 Additional information and attachments

In this section, you can specify previous sections of the application, for example with regard to invoicing.
If you have spoken about your application with a Findata employee in advance, please give the person’s name.
If you have spoken about your application or about extraction with a contact persons of controllers in advance, please enter the names of these persons here. For example, if you have agreed that extraction will be implemented in a certain way, give the name of the person with whom you agreed on the matter.
Add possible attachments.
Please do not attach data to this application

9 Confirmation of information

Before we make a decision on an application, you as the applicant must approve the maximum cost estimate for the extraction and pre-processing of data.

Application processing times will be affected by the content of the application, the current application processing situation and the controller’s response times.

You can expediate the processing of your application in the following ways.

Complete the application carefully.
Attach all the previous permit decisions to the application.
Attach the completed and signed confidentiality agreements to the application. Every added personal data processor must have their own confidentiality agreement.

Information on costs

We will charge a decision fee for amendment permits according to the attached pricelist. In addition to the decision fee, we will, where necessary, charge an hourly fee for data processing carried out at Findata.

You’ll find more information about costs on our Pricing page.