Data permits

A data permit is a fixed-term permit from an authority to an individual for the processing of confidential materials that contain personal data.

Please read the Permits web page before applying for a data permit. The page includes useful information to take into consideration before applying, while applying and after applying.

Data permit applications and their attachments are confidential. We will forward all the necessary information for the extraction of data and the formation of a target group, as well as information on the applicant and their contact details to the controller.

The decisions and permits granted by an authority are primarily public. On our website, we will publish the following information on projects that have received favourable data permit decisions:

• date of decision
• permit validity period
• permit holder (organisation)
• project name
• a brief description of the intended use for the data.
• purpose of use pursuant to the Act on Secondary Use

This public data can be shared from the website also to other communication channels.

After a data permit has been issued, the data is extracted by different controllers and sent in a secure manner to Findata. We pro-process, pseudonymise and, where necessary, combine and anonymise the data.

In practice, all direct identifiers are removed from the information and a pseudo ID is produced, which will allow different people to be identified from one another and information on each individual can be combined from various pieces of data.

If you need data on individuals from just one public sector controller, contact the controller directly. Contact information is available e.g. on the Data page.

Processing of data permit applications

We review all data permit applications within a week of their arrival and divide them into two groups: applications that can be processed and applications that require supplementation.

Applications that can be processed have been filled in with the information necessary for processing. These applications go directly to waiting for processing. We will send the applicant an email within 10 business days of submitting the application, if the application is eligible for processing.

Applications that require supplementation are left waiting for personal guidance, where our expert will contact the applicant and send a detailed supplement request and instructions.

Applicants can utilise the instructions and criteria listed below when completing their data permit application, or they can personally review an application they have already sent before we may contact them.

If you want to supplement the application you have send, send us an email to  info@findata.fi, and ask us to return the application. Enter Return of application in the subject line as well as your application’s record number (e.g. Return of application THL/XXXX/14.0X.00/202X).

To submit a data permit application, log into our e-service at: asiointi.findata.fi using either Suomi.fi e-Identification or Haka login. For more information on logging in see the Logging into services page.

Please always log in using the same identification methods, so that you can see the applications you have sent and the decisions that have been given.

Data permit applications can be submitted in Finnish, Swedish or English

1. Applicant information

• Applicant refers to the person or organisation named on the data permit application, who the data permit will be issued to.
• Contact person refers to the person who is acting as the applicant’s contact person in matters related to the application and will respond to all questions regarding the application.
• In the application, describe the link between the contact person and applicant. This can be based for example on an employment or public-service employment contract. The contact person’s details can be forwarded to the controller during the processing of an application, if extraction requires more additional information.

More information:

2. Invoicing details

• Invoicing details for Finnish payers:
  • E-invoicing is the primary invoicing method for Finnish payers. In your application, state the connection between the invoiced party and the project. Inconsistencies between the applicant and the invoiced party (e.g. the payer is not the applicant) can be clarified where necessary in the Additional information section.
  • If necessary ask for more information from your organisation’s financial department. You can also search for e-invoice addresses on the TIEKE Finnish Information Society Development Centre website: https://verkkolaskuosoite.fi/. A list of e-invoicing addresses is maintained by Finnish e-invoice operators.
  • A VAT number is formed from a business ID e.g. 1234567-8. Add the two letter country code FI to its beginning and remove the hyphen from the ID e.g. FI12345678.
• Invoicing details for foreign payers:
  • If the payer is not Finnish the payer should have a Peppol-address for the e-invoicing.
  • If the payer doesn’t have a Peppol-address, the invoice is sent by mail.

3. Purpose of data use

• The application should provide an overall picture that corresponds with the stated data use, which is pursuant to the Act on the Secondary Use of Health and Social Data.
• The requested information content should match the purpose of processing personal data.
• A thesis must be at least the final assignment for a Bachelor’s degree. The reduced decision price for theses only applies to individual theses. If the thesis is produced as part of a larger project or a project results in a number of theses, this is not the thesis work referred to in the Findata application and should be marked down as a research project.

Lisätietoja:

4. Defining the extraction criteria for the target group

• In the application, describe the formation of the target group as clearly as possible and limit the target group according to the purpose of the work.
• Pay attention in particular to from which registers and with which criteria the target group will be extracted. For example, a specified are can refer to a place of residence, place of birth, the town or city in which they work or to the town or city where they use services.
• Data extraction will be implemented in accordance with the extraction description given in the application. Errors in target and control group criteria in the description will have a substantial impact on the usability of the data.
• If a target group has been formed, specify in your application which data permit was used to form the target group, and whether this data permit is still valid.

5. Definition of conditions for the extraction of controls

• Describe the extraction of controls clearly. List the registers from which data will be extracted, as well as the criteria on the basis of which controls will be identified.
• State how many controls will be extracted per research subject, and describe the similarity criteria in as much detail as possible.
• If relatives are extracted for the target group describe the extraction of relatives clearly. The application must include the registers from which the extraction is implemented, as well as the criteria on the basis of which relatives are identified. Where necessary, specify the relation between the persons (e.g. biological vs. adoptive parents).
• Please do not attach data to this application. Once a data permit has been issued, we will provide instructions on how the data can be sent securely. Also see the Submission of data to Findata page for instructions.

6. Information to be extracted

• Ensure that Findata is the competent authority to issue a permit for the data you are applying for. Go to the end of the page for the permit competence assistant, where you can check the matter: Go to assistant
• In order to issue a permit, we need a detailed register-specific list of variables on all the data that will be extracted. If the extraction includes several steps, also describe the order of extraction. We cannot process your application before a variable-specific description has been submitted for each of the registers listed in the application.
  • Download the table template as a Word file, complete and attach to your application. The extraction description form is available for download at: findata.fi/extraction-description-form
• See e.g. the Data Catalogue for information on the variables contained in registers (https://aineistokatalogi.fi/). Contact controllers directly if you need more information about the data or variables or help with drawing up an extraction description.
• When drawing up an extraction description, it should be ensured that
  • the extracted registers are named in a manner that can be understood
  • the data to be extracted is described at the variable level
  • the time limits for the data are unambiguous and sensible with regard to the plan (note the update timetables for registers) 
  • there is a technical name listed for all variables contained in the data to be extracted from THL registers. and
  • in the case of extractions implemented in several stages there is a description on the order in which the requested data is extracted.
• In the case of extractions implemented in several stages, we cannot guarantee that the information will be ready and disclosed within 60 banking days from the date of the decision, as each controller has 30 banking days to submit the information.

7. Other data to be combined

• List information on all data that is to be combined to data for which Findata issues permits.
• Please note that the other data permits must be issued to the same project and must be valid at the time data is processed.
• If the target group was selected with a permit that was issued previously, list this permit in addition to the permits for other data.
• If you wish to combine data later on to data for which Findata has provided a permit, send an amendment application for the data to be combined.
• If  applying to have data accessed with an individual’s consent to be combined with data that Findata has issued a permit for, the research subject’s notification and consent models must be attached to the application.
• In the application provide the following information the data for which other actors have issued permits:
  • Permit record number, issuer, date of decision.
  • If the permit process is pending, the party to whom the application was submitted and the permit process start date.
  • A brief description of the information content of other data.
  • Do not attach permits for other data to the application. The application processor will ask for these separately of necessary.

8. Data processing

• In accordance with the Act on Secondary Use of Data, individual-level data is processed primarily in pseudonymised form in a data secure operating environment. Findata’s Kapseli operating environment is the primary option.
• Another operating environment can be used on a discretionary basis only for a weighty and well-justified reason. Please note that starting 1 May 2022, other operating environments must be audited in accordance with regulations provided by Findata.
• As a rule, we will provide you access to the combined data as soon as possible. Please specify a date if you would like access to the data on a specific day.
• A data permit is issued for a fixed period in accordance with the period when the data will be used. The anonymised results must be extracted from the access environment during the set period of use. Where needed, the period of use may be extended by applying for the data permit to be amended. The data must be destroyed immediately after the data permit period comes to an end.
• We will remove the data from Kapseli when the data permit period comes to an end, unless otherwise agreed on. Findata will retain the pseudonymisation key and the terms and conditions of extraction and documentation used to generate the data so that the data can be reproduced as and when it is needed. Please retain the record number of the original data permit.
• Please note that the processing of personal data abroad is counted as a transfer of personal data even if the data is in a remote access environment. Read more about transferring personal data and the legal bases for this on the website of the Data Protection Ombudsman’s office: https://tietosuoja.fi/. If necessary contact your organisation’s data protection officer.

9. Data utilisation plan

• Provide the names of the data processors and their organisations. These individuals are granted access to the data. If you wish to change the processors or add additional processes later on, send Findata an application to amend the data permit. A fee will be charged for an amendment application.
• State the legal basis for the processing of the personal data received from Findata. Read more about on the terms for processing e.g. on the website of the Data Protection Ombudsman’s office: https://tietosuoja.fi/.
• Please note in the question concerning special personal data that nearly all data under Findata’s permit competence are special personal data. The processing of special personal data requires a legal basis in accordance with the EU’s GDPR.

10. Additional information and attachments

• You can give more details in this section on all the application’s previous sections, such as invoicing.
• If you have spoken about your application with a Findata employee in advance, please give the person’s name.
• If you have spoken about your application or about extraction with a contact persons of controllers in advance, please enter the names of these persons here. For example, if you have agreed that extraction will be implemented in a certain way, give the name of the person with whom you agreed on the matter.
• Add possible attachments.
• Please do not attach data to this application

Before we make a decision on an application, you as the applicant must approve the maximum cost estimate for the extraction and pre-processing of data.

See also:

After a data permit has been issued, the customer’s data is extracted by different controllers and sent in a secure manner to Findata.

At Findata, these data compiled from controllers are then pre-processed and, if necessary combined and anonymised.  In practice, all direct identifiers are removed from the information and a pseudo ID is produced, which will allow different people to be identified from one another and information on each individual can be combined from various pieces of data.

The combination of data only applied the combination on the basis of a personal identity code and is only implemented when combination does not require such things as the harmonisation of classifications.

After the data has been processed, the data is transferred to a secure operating environment where the customer can access and process it.

See also:

We will charge a decision fee for data permits according to the attached pricelist. In addition to the decision fee, we will charge an hourly fee for data processing carried out at Findata.

The total price will also be affected by the costs incurred by data controllers for the extraction and delivery of data, based on each controller’s own provisions.

The data will forwarded for analysis first and foremost to Findata’s Kapseli environment, which is also subject to a fee. For more information please see the page Kapseli.

For more information on charges see the page Pricelist.

Also see the page Average cost estimates (in Finnish)

Data permit pricing

Price category	Criteria	Price
Data permit for a thesis	A data permit related to a thesis for an applicant who is domiciled in Finland or another EU or EEA country. If the project produces several theses or other outputs not related to the thesis, this is a normal or extensive information permit.	250,00 EUR VAT +0%
Normal data permit	The application concerns the data of 1 to 15 data controllers and the applicant is established in an EU or EEA country. If the sampling description is modified at the initiative of the applicant in the middle of the application processing process after receiving the cost estimates, this is an extensive data permit, cf. below.	1 000,00 EUR VAT+0 %
Extensive data permit	When one or more of the following is met: – The application concerns the data of more than 15 data controllers – The sampling description is modified at the initiative of the applicant after receiving the cost estimates, ie more than one round of cost estimates is required from one or more controllers – The applicant is established outside the EU or EEA.	3 000,00 EUR VAT +0 %

Findata’s hourly based fees

Price category	Criteria	Price
Data processing	Hourly fee for data combining, pre-processing, pseudonymisation and anonymisation.	115,00 EUR/hour VAT +0 %
Costs of processing a lapsed application	If the application for a data permit or data request is canceled or not completed after the start of the processing, we will charge a proportion of the workload.	72,00 EUR/hour VAT +0 %