Updated 02.08.2024

Amendment permits

You can apply for amendments to valid data permits by submitting an amendment application.

Before applying for a amendment permit, please read the Permits page.

General information on amendment applications

See what you can apply to amend with an amendment application. Read more General information on amendment applications

What can you apply for with an amendment application?

This page contains information on when an amendment application is adequate and when you will new a new data permit application. Read more What can you apply for with an amendment application?

Logging into the e-service

How to log in and select an application form. Read more Logging into the e-service

Instructions for completing an amendment application

See what is asked in the application. Read more Instructions for completing an amendment application

Information on costs

See the current pricelist for amendment decisions Read more Information on costs

Application assistant

Ensure the correct address for the amendment application. Read more Application assistant

What to remember before sending an application

Select the correct application type

There are different types of applications for different information needs

  • Data permit application, when you need data on individuals
  • Data request, when you need statistical data
  • Amendment application, when you are applying for an amendment to a valid data permit
Describe and limit data

Define the data to be applied for at the variable level and remember the principle of minimisation for other information. Utilise the Data Resources Catalogue (aineistokatalogi.fi) and controller’s advisory services

  • Where from and how do I extract the target group? Is the definition specific enough?
  • Are control subjects/relatives extracted? How will they be defined?
  • From which registers will the data be extracted?
  • What variables will be included in the extraction? 

Other data to be combined

  • Have you made sure that the other data is described on the application?
  • Are the permits for other data valid or is the permit process pending?
Determine the competent authority

We grant permits for the secondary use of social and health data when the application applies to

  • data maintained by several public social and health sector controllers
  • data maintained by a single public controller, that has transferred the right to issue permits to Findata
  • the register data of one or numerous private social and health service provider, or
  • data saved in the Kanta Services

The assessment of the competent authority must consider all the data related to the application.

Check from the application assistant which authority the application should be sent to.

General information on amendment applications

A data permit amendment application is sent to Findata whenever data are combined from data controllers covered by the Act on secondary use of health and social data, or if the controller has transferred its power to grant permits to Findata. An amendment permit may be granted when the data sources and the group of research subjects remain unchanged.

Amendment applications and their attachments are confidential. When necessary, we will forward critical data as well as the applicant’s name and contact details to the controller.

The decisions and permits granted by an authority are primarily public. On our website, we will publish the following information on projects that have received favourable data permit amendment decisions:

  • date of decision
  • permit validity period
  • permit holder (organisation)
  • project name (if known)
  • issuer of the original permits
  • amendment type

This public data can be shared from the website also to other communication channels.

See the page Issued permits.

How to speed up the processing of your amendment application

Processing time for your application depends on several factors, including the clarity of your application, our current processing load, and response times from data controllers. To expedite the process:

  • Complete the application carefully ensuring all sections are filled out thoroughly and accurately.
  • Attach all previous permit decisions to your application.
  • Attach to your application all previous non-disclosure agreements (NDA). Each person handling the material to be added must have their own NDA.
  • Use Findata’s advisory service for additional support and clarification.

For more information, visit the Data page or check the Data Resources Catalogue (aineistokatalogi.fi).

What can you apply for with an amendment application?

A data permit amendment application can be used to:

  • Extend the period of validity
  • Change the data processors
  • Add data (such as variables)
  • Extend the period from which data is extracted
  • Change the controller of data disclosed with a data permit
  • Change the data processing environment
  • Expand the processing of data outside the EU/EEA as opposed to the granted permit
  • Combining data that some other authority has issued a permit for with the data covered in Findata’s permit

It is not possible to apply for an amendment in all situations. You should apply for a new data permit if:

  • the data sources (registers) or the group of subjects change
  • the number of monitoring years is increased for a data permit issued by a party other than Findata

Processing environment for the data

As a rule, the data will always be disclosed to Findata’s secure operating environment Kapseli. However, the Secondary Use Act makes it possible to disclose information to other secure operating environments, if necessary.

Amendment permits are subject to the same environment requirements as new data permits. Exceptions to this are the following changes, which do not require compliance with the environment requirements:

  • Changing the data processors
  • Changing the controller of data disclosed with a data permit
  • Combining data that some other authority has issued a permit for with data covered in Findata’s permit

Read more on the page: Regulation on secure operating environments

Logging into the e-service

Submit an application in our e-service (asiointi.findata.fi) using either Suomi.fi e-Identification or Haka login. For more information on logging in, visit the Login page.

Please use the same identification method each time you log in to view your submitted applications and decisions.

Amendment permit applications can be submitted in Finnish, Swedish or English

After logging in

  1. Go to the Submit application tab.
  2. Choose Data permit amendment application by clicking Fill in the application.
  3. Complete the application form following the instructions provided and submit it.

Once an application is submitted, it cannot be edited. If you need to supplement a submitted application, email us at info@findata.fi with your application ID (e.g., 2022/53). We will return the application for you to update.

See also

Dates of monthly maintenance outages in 2024
  • 18.1.2024
  • 22.2.2024
  • 21.3.2024
  • 18.4.2024
  • 23.5.2024
  • 20.6.2024
  • 18.7.2024
  • 22.8.2024
  • 19.9.2024
  • 17.10.2024
  • 21.11.2024
  • 19.12.2024

How to submit an amendment application

1 Public information about the project

  • Project name
    • The name of the project granted an amendment permit will be published on Findata’s website. Ensure the project name does not include confidential information.
  • A brief description of the project
    • Provide a concise description of the study or project and the intended use of the requested data. This description, once the data permit is granted, will be posted on Findata’s website. Avoid including confidential details in this description.

2 Details of the applicant

  • The applicant is the person or organization named in the application to whom the data permit will be issued.
  • Enter the applicant’s business ID. If the applicant is an individual, enter 123 in the field. For organizations located in an EU/EEA country other than Finland, provide the name of the official register where the organization is registered.
  • Specify which organization or individual is the data controller.
    • The amendment permit can be applied for by the data controller or by another entity on behalf of the data controller.
    • In the case of a joint controllership, select ‘A third party’ and enter all controllers in the additional information field.
Controllership of data being applied for

A controller under the EU General Data Protection Regulation (GDPR) is an organization or individual who is the controller of the data. The controller determines the purposes and means of processing the data generated based on the data permit.

There may be more than one controller and the controllers may be joint controllers, in which case they define the purposes and means of processing the data together. In the case of a joint controllership, select ‘A third party’ and enter all controllers in the additional information field.

3 Details of the contact person

  • The contact person is the individual responsible for answering enquiries concerning the application. Their contact details may be shared with the data controller if additional information is needed during processing.
  • Describe the contact person’s relationship with the applicant, such as employment or a public service appointment.

4 Invoicing details

  • E-invoicing is the primary method of invoicing.
  • If the invoiced party is different from the applicant, clarify this in the ‘Additional Information’ section.
  • Invoicing details for Finnish payers:
    • Use the business ID to form the VAT number. Add the country code “FI” to the beginning and remove any hyphen (e.g., business ID “1234567-8” becomes VAT number “FI12345678”).
    • Check verkkolaskuosoite.fi for e-invoice addresses.
  • Invoicing details for foreign payers:
    • Foreign payers should have a Peppol address for e-invoicing. For more information, visit peppol.org.
    • If the payer doesn’t have a Peppol-address, the invoice is sent by mail.
Applicant’s business ID

Enter the applicant’s business ID If the applicant is a private individual, enter 123 into the field. If the applicant organisation is located in a country other than Finland or an EU/EEA member state, provide the name of the official register in which the organisation is registered.

Checklist for applicants

  • Ensure that contact information and billing details are filled in correctly and are consistent with the information provided elsewhere in the application.
  • If you are applying as an individual rather than an organization, provide additional information in the “Additional Information” field at the end of the form.

5 The permit or permits to which you apply for an amendment

  • Fill information about data permits that you want amended. Amendment of a data permit is only possible for valid permits.
  • Do not fill information about data permits that are not subject to this application. If you are applying for an addition of data other than that referred to in the Secondary Use Act, list the permits considering this data in the section 7.
  • Indicate the issuers of the original data permits. You can indicate several permit issuers.

6 Purpose of data use

  • Note that when applying for a change to a data permit, the purpose of use must be the same as in the original permit.

Click to see more information about different use purposes:

Education

When data is to be used for education, the applied for data will be used to prepare teaching materials for personnel and persons studying to become social welfare and health care personnel who process customer data and social welfare and health care professionals. Please note: Data containing identifiers can only be used in teaching situations if teaching cannot be carried out anonymously due to the exceptional nature of the case, the nature of teaching or a similar reason.  The person providing teaching must inform their students of the confidentiality provisions in legislation and the sanctions resulting from their violation.

Planning and reporting duty of an authority

As a rule, only an authority may carry out the planning and reporting duties of an authority. If an authority does not act as the applicant in a data permit application, the authority must be the controller of the data. As a rule, when work is commissioned, the commissioning party will be the processor of personal data.

Scientific research

When data is to be used for scientific research, attach an up-to-date research plan and a research permit from the responsible/target organisation to your application. Also attach an opinion from the Ethics Committee, if the legislation applying to the research and/or the research setup so requires.

Criteria for scientific research (in general):

  • an appropriate research plan
  • responsible person or group
  • results to be published as a scientific publication
  • research produces new information.
Statistics

When data is to be used to form statistics, state in the application which party will compile the statistics and for what purpose.

7 Applied data permit amendment(s)

  • State which amendment or amendments you are applying for to the valid data permit(s).
  • If necessary, indicate the current processing environment of the data. The analysis of the data is only permitted in audited processing environments that meet the requirements of the Secondary Use Act and the Findata’s regulation.
    • If you only want to transfer your research data to Kapseli, order Kapseli from Findata’s e-service.
    • If your data is transferred to Statistics Finland’s Fiona user environment because the data is combined with data provided by Statistics Finland as a statistical authority, select “Addition of data other than referred by the Secondary Use Act” as the applied data permit amendment. In this case, you do not need to apply for a change “Changing the operating environment of the data to an environment other than Kapseli”.
    • If you are applying to transfer your data to Statistics Finland’s Fiona operating environment for other reason and your data is not combined with data provided by Statistics Finland as a statistical authority, select “Changing the operating environment of the data to an environment other than Kapseli”.
Extension of the validity of the data permit
  • The data permit is granted for a fixed term, which will not exceed the period of time required for the purpose of use. The anonymised results must be extracted from the secure operating environment during the set period of use.
  • Indicate when will the need to use the data end including both active use and possible storage time.
  • Describe grounds for extension shortly.
Change to the personal data processors
  • List the new people to whom you want to add the right to process data.
    • Enter only the first name, last name and organisation of the processors (e.g. Alan Smithee, University of Helsinki).
    • Use a semicolon (;) to separate individuals from each other (e.g. Person 1, Organisation; Person 2, Organisation; etc.)
  • List the persons whose right to process the data is to be removed.
  • List the persons who have been granted permission to process the data in previous data permits and whose permission is valid. These persons are not required to submit a non-disclosure agreement.
Adding data (e.g. new variables)
  • An amendment for a data permit can only be applied if the data sources (e.g. registers) and the target group remain unchanged.
  • Indicate in the table from which register or registers new data (e.g. variables) will be extracted.
  • Define new variables using the extraction description form (download Word-file, 51,2 kb)
    • Download and fill in the form according to the instructions. Contact the controllers directly and go through the extraction description with the controllers before submitting the application.
    • Attach the completed extraction description forms in Word file format. The extraction description form is required in Word file format, as Findata or the controllers may have to make changes to it.
    • Information on different registers and the data contents of the registers (variable names, descriptions of variables, time period extracted from the register, etc.) is available in the Data Resources Catalogue (aineistokatalogi.fi).
Extension to the period from which data is extracted
  • The extension to the period from which data is extracted can only be applied by the amendment of the data permit if the original permit has been granted by Findata, or by the controller that has subsequently transferred its authority to grant permits to Findata.
  • List the registers for which you want to extend the the period from which data is extracted.
  • Define variables using the extraction description form (download Word-file, 51,2 kb).
    • Download and fill in the form according to the instructions. Contact the controllers directly and go through the extraction description with the controllers before submitting the application.
    • Attach the completed extraction description forms in Word file format. The extraction description form is required in Word file format, as Findata or the controllers may have to make changes to it.
    • Information on different registers and the data contents of the registers (variable names, descriptions of variables, time period extracted from the register, etc.) is available in the Data Resources Catalogue (aineistokatalogi.fi).
Change the controller of data disclosed with a data permit
  • Indicate who or which party is the controller mentioned in the previous data permit decision.
  • Indicate who or what party is the new controller of the data.
  • Attach to the application a confirmation signed by both parties that the change of the data controller has been agreed upon between the previous controller and the new data controller.
Addition of data other than referred by the Secondary Use Act
  • The addition of other data than referred in the Secondary Act can only be applied by the amendment of the data permit if the original permit has been granted by Findata.
  • Freely describe the data to be combined and tell where the data comes from (data controller, survey material etc.), the format of the files and for which target group the data is extracted.
  • Fill in preliminary information about data to be combined.
    • In case the data set includes data in more than one format (pdf, Excel, csv etc.), add all different formats on their own rows.
    • Deliver the tables (which Findata needs to pseudonymize) in csv or SAS-format.
    • Size of the files: If the data is in table format, provide an estimate of the number of rows and columns.
    • Special notes: Explain which variables or sections include direct or indirect identifiers. Examples: an address variable; a text variable including names; or the names of the figure or pdf-files include personal identification code.
  • Indicate, what is the (legal) basis for the use of data that is not covered by the Act on the Secondary Use of Health and Social Data.
  • Note! Do not attach data to this application. Findata will provide instructions on how to deliver the data securely.
Expanding the processing of personal data outside the EU and EEA
  • The processing of personal data abroad is counted as transfer of personal data even if the data is in a remote operating environment. Read more about transferring personal data and the legal bases for this on the Office of the Data Protection Ombudsman’s website (tietosuoja.fi).
  • Indicate in which countries is the data currently being processed.
  • As data is being transferred outside the EU/EEA, specify the legal basis, in accordance with the General Data Protection Regulation (GDPR), that is needed for the transfer of data.
  • Indicate, to which country outside the EU/EEA would you like to expand the data processing to.

8 Additional information and attachments

  • In this section, you can specify previous sections of the application, for example with regard to invoicing.
  • If you have spoken about your application with a Findata employee in advance, give the person’s name.
  • Please do not attach data to this application

9 Confirmation of information

  • Confirm the information provided on the application form.
  • A fee will be charged for the permit decision in accordance with the fee decree in force at the time.
  • Before we make a decision on the application, you as the applicant must agree to a maximum cost estimate for the costs of extracting and pre-processing the data if a change to the extraction or processing environment is requested.

Information on costs

We will charge a decision fee for amendment permits according to the attached pricelist. In addition to the decision fee, we will, where necessary, charge an hourly fee for data processing carried out at Findata.

You’ll find more information about costs on our Pricing page.

Amendment permits pricing

Price categoryCriteriaPrice
Minor amendment or changeThe application seeks the following amendments or changes:
– extension of the permit
– modification of the persons authorized to process the data
– a change in the controller of the material released with the data
– changing the data processing environment from Findata’s Kapseli remote access system to another service provider’s secure processing environment.

300,00 EUR
Other amendment or changeThe application seeks one or more of the following changes or amendments:
– the extension of the monitoring years to the authorization granted by Findata, provided that the persons to be examined and the data to be extracted remain the same
– extension of the processing of the data by way of derogation from an authorization granted outside the EU or EEA countries
– adding variables to the data collection after the extraction has already taken place
– the addition of data under other legislation in derogation from the authorization granted.
600,00 EUR
No VAT is charged on permit decisions.

Findata’s hourly based fees

Price categoryCriteriaPrice
Data processingHourly fee for data combining, pre-processing, pseudonymisation and anonymisation. Minimum one hour.147,00 EUR/hour
Costs of processing a lapsed applicationIf the application for a data permit or data request is canceled or not completed after the start of the processing, we will charge a proportion of the workload.88,00 EUR/hour
Hourly payments are services under public law, which are not subject to VAT.

Ensure the correct address for the application

Select the controllers from which the data will be retrieved

Apply permit from the controller in question. The exception is those controllers who have delegated permit jurisdiction to Findata.

Please note that Findata is responsible for data permit and amendment applications whenever the data of data controllers covered by the Act on secondary use is combined. When evaluating the competent authority, all data related to the application under the Act must be taken into account.

Apply permit (s) from the controllers in question.

Findata is responsible for data permits of the Finnish Center for Pensions (ETK) and the Finnish Digital Agency (DVV) and / or Statistics Finland if the data are combined with

  • data of other public organizations under the Act on Secondary Use of Health and Social Data (For Statistics Finland, at least two other organizations are needed, for DVV and ETK, one is sufficient)
  • data stored on Kanta services or
  • to the register data of a private social or health care service provider.

Apply permit from Findata.

Findata is responsible for processing and making decisions concerning data permit and amendment applications, when the application applies to:

  • data from numerous public social and health sector controllers
  • register data from one or numerous private social welfare and health care service organisers, or
  • customer data saved in the Kanta Services.

Apply permit from Findata.

The Regional Administrative Agencies (AVI) have delegated the jurisdiction to Findata.

Apply permit from Findata.

National Supervisory Authority for Welfare and Health Valvira have delegated the jurisdiction to Findata.

Apply for a data permit

Finnish Institute for Health and Welfare (THL) has delegated the jurisdiction to Findata. As far as THL is concerned, the delegation of jurisdiction does not apply to its

  • internal permit management
  • the transfer of samples and data transferred to THL Biobank.

Permit is applied from Statistics Finland and the respective data controller. Exceptions are the registrars who have delegated the jurisdiction to Findata.

We are responsible for data permits for data subject to the Secondary Act of Statistics Finland when they are combined

  • to the information of at least two public organizations covered by secondary laws
  • to data stored in Kanta services or
  • to the register data of a private social or healthcare service organizer.

Apply permit from Findata.

Findata is responsible for processing and making decisions concerning data permit and amendment applications, when the application applies to:

  • data from numerous public social and health sector controllers
  • register data from one or numerous private social welfare and health care service organisers, or
  • customer data saved in the Kanta Services.

Please select at least one data controller or group.