Services and instructions

A data permit is a fixed-term authorisation granted by a public authority to use individual-level personal data for a specific purpose, for example, for research, compiling statistics or carrying out official duties.

Once a data permit is granted, the dataset is delivered to the processor in a pseudonymised format. This means that identifying information has been replaced with codes, so individuals cannot be directly identified. The data may only be processed in a secure processing environment with no direct internet access.

Data permits are particularly important in registry-based research, where data originally collected in social and healthcare client or patient registers is used for secondary purposes.

Read more:

• Data permits
• Conditions of data permit

Findata is the social and health data permit authority in Finland. It was established in 2019, and its operations are based on the Act on the Secondary Use of Health and Social Data, commonly known as the Secondary Use Act.

We grant data permits for the secondary use of health and social data when the data is needed from multiple public data controllers, from the private sector, from Findata’s ready-made datasets, or from the Kanta Services. We compile and preprocess the datasets with strict attention to protecting individuals’ privacy.

Findata also maintains the secure Kapseli® processing environment, where individual-level data is processed safely.

• Findata as an organisation
• Act on the Secondary Use of Health and Social Data (PDF file, 5.4 mb).

When we grant a data permit, we provide pseudonymised individual-level data. This means that, for example, names and personal identity numbers are replaced with codes, so the data cannot be directly linked to individuals. We only release identifiable data for particularly justified and necessary reasons.

Pseudonymised data is still personal data. It may only be processed in a secure environment with no direct internet access. The data permit holder or data processor commits to conditions that prohibit attempts to identify individuals from pseudonymised data.

The data processor must produce published results in an anonymous form, from which individual persons or their characteristics cannot be identified. Findata ensures that the results meet the anonymity requirements set out in the Secondary Use Act.

If the permit concerns statistical-level data (data request), we provide anonymous data that describes population groups rather than individuals. Statistical data cannot be traced back to or used to identify individuals.

Read more:

• Permits
• Conditions of data permit

The secondary use of social and health data is only permitted for purposes defined by law, such as:

• Education
• Scientific research
• Statistics
• Planning and reporting duty of an authority
• Development and innovation activities
• Knowledge management
• Steering and supervision of social and health care by authorities

Different types of data are available for different purposes:

• Individual-level, pseudonymised data is available for research, statistics, planning and reporting tasks of public authorities, and education.
• Anonymous, aggregated statistical data is available not only for the above-mentioned purposes, but also for development and innovation activities, knowledge management, and the steering and supervision of social and healthcare services.

In addition, wellbeing services counties and other service providers may use the data recorded in their own registers without a separate permit for purposes such as planning and evaluating their operations.

All data permit and data request decisions made by Findata are public. You can view them here: Issued permits

Findata grants permits for the use of register-based data collected from various sources. This refers to information stored in registers maintained by public authorities, private service providers or other data processors.

Information about every Finnish resident is collected in different social and healthcare registers. In Finland, this data can be used for secondary purposes – for example, research aimed at improving public health and wellbeing.

We grant permits when data is needed from several public data controllers, private operators, Findata’s ready-made datasets or from the Kanta Services. Some data controllers have authorised Findata to issue permits on their behalf.

All permits comply with the data minimisation principle under the EU General Data Protection Regulation (GDPR): a permit can only be granted for data that is clearly and justifiably necessary for the stated purpose.

Before any data is released, it is pseudonymised. This means that directly identifying information – such as names or personal identity codes – is removed or replaced with a unique code, so that individuals cannot be directly identified.

Read more: Data

The law does not specifically restrict who can apply for a permit to use social and health data. However, Findata does not grant permits to just anyone or for any purpose. A permit can only be issued for the purposes defined in the Act on the Secondary Use of Health and Social Data and for projects that meet the legal criteria for approval.

Each permit application is assessed individually. Before a permit is granted, the application undergoes a careful review. Under the EU General Data Protection Regulation (GDPR) and the data minimisation principle, a permit can only be granted for the use of data that is essential for the execution of the project.

Data permits are official administrative decisions. The decision process has two stages: the application handler acts as the presenter, and the Director of Findata or their deputy makes the final decision. The proposed decision does not always lead directly to a permit being granted: sometimes the application is returned for further preparation or requires modifications.

Read more: Conditions of data permit

The secondary use of health and social data is governed by several laws that safeguard data protection and define the conditions under which the data may be processed.

The EU General Data Protection Regulation (GDPR) establishes the general principles for processing personal data across the EU. It is complemented by national legislation, such as the Act on the Secondary Use of Health and Social Data (the “Secondary Use Act”), which specifically regulates the secondary use of health and social data in Finland.

The Secondary Use Act centralises the issuance of data permits to Findata and defines in detail the permitted purposes for data use as well as the requirements for data security and oversight.

In the coming years, the European Health Data Space (EHDS) regulation will harmonise the use of health data and permit procedures for secondary use across the EU. EHDS will strengthen individuals’ rights to their data and promote the secure and efficient cross-border use of health data. The provisions concerning secondary use will apply starting in March 2029.

Other key laws include:

• Data Protection Act (Tietosuojalaki)
• Act on the Processing of Client Data in Healthcare and Social Welfare
• Medical Research Act
• Clinical Trials on Medicinal Products for Human Use Act
• Act on the Medical Use of Human Organs, Tissues and Cells
• Biobank Act

Read more:

• Legislation
• European Health Data Space (EHDS)
• Act on the Secondary Use of Health and Social Data (PDF file, 5.4 mb).

The secondary use of health and social data means using already collected client and patient data for purposes other than their original use, such as research, statistics, and service development.

When researchers, authorities and service providers are able to use reliable and comprehensive register data, it generates information that support decision-making and improve the quality of services. This leads to several concrete benefits for citizens:

• Better services and more effective care
  • Data can be used to develop health and social services that better meet people’s needs.
• More effective medicines and health technology
  • Extensive registry data supports medical research and the development of new treatments. It also enables the creation of health-promoting applications and supportive technologies.
• Safer and more agile tools for supervision
  • Data can be used to monitor, for example, adverse effects of medicines and to improve oversight in healthcare.
• Smoother service processes
  • Data enables the development of service systems that are more efficient and customer-oriented.
• Promoting public health and reducing wellbeing gaps
  • Research-based information supports legislation and policymaking, helping to promote health and reduce inequality.

The secondary use of health and social data is strictly regulated. Citizens’ privacy is protected through measures such as pseudonymisation and secure processing environments.

See what types of projects Findata has granted permits for: Issued permits

The Act on the Secondary Use of Health and Social Data (also known as the Secondary Use Act) strengthens the protection of personal data by clearly defining how and under what conditions health and social data can be used for purposes other than their original use, such as research and statistics.

Prior to the implementation of the Secondary Use Act in 2019, the processing of data involved several risks:

• Permit applications were not centralised
  • Permits were granted by individual data controllers, the Ministry of Social Affairs and Health, or the Finnish Institute for Health and Welfare (THL). Practices varied, and there was no consistent process.
• Data could be transferred on physical storage devices
  • Datasets were sometimes delivered directly to permit holders via USB sticks or CDs. This made it impossible to ensure data security or monitor how the data was used.
• There was no way to monitor data usage afterwards
  • There was no way to track whether datasets had been deleted after the permit expired.

The Act has enhanced data protection in several key ways:

1. Centralised permit process at Findata
   • Under the Act, all data permits are issued by Findata, the Finnish Health and Social Data Permit Authority. This has improved both data security and the protection of personal data.
   • Centralised data combining ensures safer processing and enables more effective oversight.
2. Pseudonymisation of datasets
   • Datasets issued under the Act are pseudonymised, meaning direct identifiers are removed before the data is delivered to the permit holder.
   • Pseudonymisation prevents the direct identification of individuals.
3. Secure processing environment
   • Data may only be analysed in a secure processing environment that has no direct internet access. These environments offer strong safeguards:
     • Only users named in the permit may access the data
     • Users log in using two-factor authentication
     • External data cannot be uploaded to the environment
     • Data cannot be exported without Findata’s review
     • Access to the data is terminated once the data permit is no longer valid
4. Enhanced oversight
   • Findata’s operations are overseen by the Parliamentary Ombudsman and the Data Protection Ombudsman
   • Findata may request a statement from the Data Protection Ombudsman before granting a permit
   • Findata submits an annual report to the Data Protection Ombudsman on the processing of social and health data and related logs
   • The National Supervisory Authority for Welfare and Health (Valvira) monitors the security of the processing environments

Several authorities supervise Findata’s operation to ensure that the granting of data permits and the processing of data are carried out in accordance with the law.

• Data Protection Ombudsman
  • Supervises the processing of personal data and ensures that Findata complies with data protection legislation.
  • Receives an annual report from Findata on the processing of social and health data and the related log data.
  • May issue statements at Findata’s request before a data permit is granted.
• Parliamentary Ombudsman
  • Oversees the lawfulness of Findata’s activities.
• Valvira (The National Supervisory Authority for Welfare and Health)
  • Supervises the secure operating environments where data granted by Findata are processed.

In addition, Findata’s operation is guided and developed by a steering group appointed by the Ministry of Social Affairs and Health (STM). The group includes representatives from STM and various data controllers.

When you object to the secondary use of your data through Findata:

• Your request is recorded in the case management system maintained by the Finnish Institute for Health and Welfare (THL).
• Your data will be removed from datasets received by Findata based on your personal identity code. Therefore, we must retain and process your personal identity code to implement the request.

The European Health Data Space (EHDS) is a regulation of the European Union that establishes a common framework for the use and exchange of health data in EU countries. The aim of the regulation is to strengthen citizens’ rights to their own electronic health data and to enable the secure cross-border secondary use of health data.

The EHDS regulation is similar to the current Finnish Secondary Use Act, but it also introduces changes. The regulation includes partly different purposes of use, some of which are reserved only for public or EU entities. In addition, new operating models will be introduced for processing data requests and permit applications.

The regulation entered into force in March 2025 and will be implemented gradually over the coming years. The parts concerning secondary use will begin to apply in March 2029.

Findata’s legal basis for processing personal data are:

• Article 6, (1)(e) of the EU’s General Data Protection Regulation: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• Article 4(1)(2) of the Data Protection Act: processing of data that is provided for by the law or that is directly attributable to the controller for the task prescribed by the law

We also process data belonging to special categories of personal data, formerly known as sensitive data. Such data includes, for example, a person’s health data.

The grounds for processing this kind of personal data are:

• Article 9(2)(g) of the EU General Data Protection Regulation: processing is necessary for the performance of a task carried out in the public interest or the exercise of public authority
• Section 6(1)(2) of the Data Protection Act: processing is necessary and proportionate for the performance of a task carried out in the public interest by a public authority

See more information on how we process personal data

Anonymisation means the transformation of personal data into a form that irreversibly prevents the identification of an individual person. This may mean, for example, removing direct identifiers and simplifying the data to a general level so that personal data cannot be reconstituted in any way.

Pseudonymisation refers to the transformation of personal data, for example into a coded form. In this case, names and personal identifiers can be removed and replaced by another unique identifier, i.e. a code. Often a code key is kept to restore direct personal data to the data. Pseudonymised data are still personal data.

Findata grants most permits to projects based in Finland. However, under the EU General Data Protection Regulation (GDPR), personal data must be able to move freely within the EU. This means that the permit holder may also be located in another EU or EEA country. Even in such cases, the data must be processed in an audited and secure environment, with access granted only to the individuals specified in the permit.

According to the Secondary Use Act, the secure processing environment must not be located outside the EU or EEA. Therefore, Findata does not, as a rule, transfer personal data outside the EU/EEA or to international organisations.

If data is to be transferred to or processed in countries outside the EEA (so-called third countries) a legal basis is required under Chapter V of the GDPR. It is important to note that processing personal data from outside the EEA is considered a data transfer, even if the data remains in a secure remote access environment.

Read more:

• Transfer of personal data outside the EU/EEA
• Regulation on secure processing environments
  

Findata does not sell data. As the data permit authority, we grant fixed-term permits for the secondary use of social and health data only when the conditions set out in the Act on the Secondary Use of Health and Social Data are met.

Each permit is granted for a specific purpose, and it defines which individuals are allowed to process the pseudonymised dataset. Those who process the data must produce analysis results in anonymous form, so that no individual’s information or characteristics can be identified.

Findata is responsible for ensuring the anonymity of results, in accordance with the Secondary Use Act. This applies to all datasets covered by a permit.

When the permit expires, the permit holder’s access to the data is revoked and the dataset is destroyed.

Read more: Conditions of data permit

Everyone has the right to their personal data, including the right to object to the processing of their data. Once you submit an objection request, Findata will no longer disclose your data for secondary use.

• The objection is valid indefinitely from the date it is processed.
• The objection is not retroactive: your data will not be removed from data resources that have already been disclosed to permit holders before the objection was submitted.
• You can submit the objection request via Findata’s e-service, by post or by visiting the Finnish Institute for Health and Welfare (THL) in person.

Instructions on how to exercise your rights: Your data rights

Please note that an objection submitted to Findata does not prevent other data controllers listed in the Act on the Secondary Use of Health and Social Data from disclosing your data for secondary purposes.

There is currently no centralised system in Finland that would allow you to object to the secondary use of your data in a way that would be binding on all controllers. Therefore, objections must be submitted separately to each controller.

• Read more: What data do my rights cover?
• Information on data controllers and the contents of their registers: Data
• Guidance from the Office of the Data Protection Ombudsman on how to object to the use of your data: If you do not want your data processed (tietosuoja.fi)

Primary use means the purpose for which the data was originally saved in the customer register and/or patient register.

The primary purpose may be, for example,

• examination, treatment and rehabilitation of the patient,
• the service received by a social welfare customer,
• or the processing of benefits by the Social Insurance Institution of Finland (Kela).

Secondary use means the use of the same data for purposes other than the primary use.

Legitimate secondary purposes of use include

• scientific research,
• statistics,
• development and innovation activities,
• education,
• knowledge management,
• steering and supervision by authorities and
• the planning and reporting duty of an authority.

Different purposes of use are subject to different regulations. Only aggregated statistics from which individuals cannot be identified may be obtained for development and innovation activities.

1. Applicant contacts the controllers before submitting the application
   • Contact controllers directly for additional information on data or variables.
   • Request cost estimates and feasibility details from controllers.
   • Use the extraction description form (Word document, 56 KB)
   • If you are applying for a statistical data with a data request, describe the statistics generation in the Tabulation plan (Excel file, 19,2 kB)
   • If you arrange special data extraction agreements with the controller, include this in the Additional Information section of your application.
     • For example, if a clinician from the research team will perform the extraction free of charge, include details in the Additional Information section about who agreed to this and under what conditions.
2. Applicant submits the application to Findata
   • Submit your application or any requested additional information via our e-service (asiointi.findata.fi)
   • If only additional information is required, clarifications may be submitted by email on a case-by-case basis.
3. Findata reviews the application and invites the applicant to a remote meeting for personal consultation
   • We review data permit approximately within a week of receipt.
   • We invite the applicant to a remote Teams meeting to discuss the content of the application and to ask clarifying questions.
   • The applicant provides more information or clarification if needed.
4. Findata sends requests for cost estimates to data controllers
   • Findata sends requests for additional information and maximum cost estimates to the controllers, who provide the data.
   • Controllers have 15 working days to respond.
   • We will forward any additional questions from controllers to the applicant.
5. Findata sends the cost estimates of the controllers’ extraction and Findata’s data processing to the applicant for approval
   • Once we have received the cost estimates from the data controllers, we assess the working time required for processing the data and estimate the maximum total cost.
   • We provide the cost estimates for the applicant to review and accept.
   • Note that you cannot change the extraction conditions after approval. Any modifications to the extracted data will require a new application.
6. Findata issues a decision
   • Data permits are for a fixed period.
   • If you need to store the data for purposes such as research verification, or if you plan to renew your permit or require regular updates, include these needs in your application.

7. Findata sends data extraction requests to controllers who extract the data
   • Each controller has 30 working days to submit the requested data to Findata.
   • The extraction may involve multiple steps, such as:
     • Extraction of the target group
     • Extraction of controls
     • Extraction of additional data
   • Each step can take up to 30 working days, potentially totaling up to 90 working days.
8. Findata pre-processes the extracted data
   • We will review, combine, and pseudonymise the data or generate statistics according to the data request.
9. Findata delivers the data to the permit holder
   • The processed data will be provided to a secure processing environment, typically in CSV format.
   • Findata’s secure processing environment, Kapseli, is the primary option. Data may be disclosed to other environments if necessary.
   • The target time for delivering the data is 60 working days.
     • This timeframe may be extended if the target group is not provided immediately, if extraction is conducted in multiple stages, if there are delays from controllers, or if the data is particularly complex.
10. Permit holder reviews the data
    • You have three months to review the data and notify Findata of any discrepancies or comments.
    • Thoroughly check the data, as errors can lead to additional work.
      • For example, errors that occur during extraction can accumulate, such as if the target group is formed incorrectly, requiring additional extractions from other controllers.
    • If you find omissions or errors, email Findata at data@findata.fi with detailed descriptions of how your data differs from the extraction description.
11. Findata deletes the data from its own processing systems once the retention period has expired.
    • We remove the datasets from our systems four months after delivery.
    • We retain the code keys for pseudonymised data to allow reproduction if needed.
    • Data permits are for a fixed period.
      • If you need to save data for purposes like research verification, plan to renew the permit, or require regular updates, include these needs in your application.

Submit your data permit or amendment permit application to Findata if you want to apply for:

• Data from several public social and health sector controllers covered by the Secondary Use Act.
• Data from a single public controller that has transferred the right to issue permits to Findata (see the list).
• Data from one or more private social welfare and health care service organisers.
• Customer data saved in the Kanta Services.
• Findata’s ready-made dataset.

If you need statistical aggregated data, send data request to Findata.

Unsure where to send your application? Use Application Assistant!

A data controller is a person or organisation that decides on the processing of personal data. They are responsible for ensuring that data processing is carried out securely and appropriately, and that the data is either destroyed or archived properly once the research is completed.

If the researcher is employed by the organisation conducting the research, that organisation acts as the data controller. However, an independent researcher or research group can act as the data controller themselves.

If multiple organisations jointly decide on the processing of personal data, they act as joint data controllers. In such cases, it is important to clearly agree on the responsibilities of each party.

Data provided under the Secondary Use Act can be combined with other information, such as data collected by an individual themselves or data obtained with a separate permit. As a rule, the combining of data must be carried out by Findata or a statistics authority.

Read more: Combining other data with data applied from Findata

Data controllers deliver the extracted datasets to Findata via secure Tunnel and Supertunnel transfer services.

Instructions for data controllers on delivering extracted datasets: Data transfers

You can apply for data from Findata for your thesis if you are working on a thesis for at least a higher university degree. In your application, please specify your educational institution, the degree being pursued, the thesis author, and the thesis supervisor.

The licence fees for theses are reduced. The reduced thesis licence fee applies when producing a single thesis. If the project produces multiple theses or other outputs unrelated to the thesis, the normal or extended licence fee will apply.

1. Consider necessity: Determine if textual data is essential for conducting your research.
   • The need for unstructured data must always be justified. Often, similar information can be extracted in a structured format.
   • We mask direct identifiers in textual data, which affects the usability of the data.
   • Processing textual data takes time and significantly increases costs.
2. Request insights from the data controller on appropriate keywords.
   • The data controller is best positioned to assess which keywords will yield the most comprehensive results without extraneous information.
   • For example, the keyword pressure will produce all records related to pressure, such as blood pressure, eye pressure, etc. If the research focus is on blood pressure, the extracted textual data will contain a substantial amount of unnecessary information.
3. Specify the length of the text snippet to be extracted on a variable-by-variable basis.
   • The text snippet should be as short as possible.
   • Request the data controller’s view on the length of the text to be extracted.
     • For instance, keyword +/- 50 characters.
4. Ensure the extraction is scoped appropriately.
   • If the extraction can be limited to the information from a specific department or field of treatment instead of the entire healthcare district’s database, the amount of text to be extracted and the processing costs will be significantly lower.

Applications received by Findata are confidential, while Findata’s decisions are public. If a data controller has a statutory right to access information about the application’s contents, Findata may, on a case-by-case basis, provide the data controller with information about the data to be extracted and the formation of the target group.

A data utilisation plan refers to a research plan, project plan, or a similar plan.

The plan must specify:

• the purpose of using the data as stated in the permit application,
• the data controller and processors,
• the legal basis for processing, and
• essential aspects related to data protection and information security covering the entire data lifecycle (storage, disposal, or archiving of data).

The essential elements of the data utilisation plan are addressed in Findata’s application forms.

Common criteria for scientific research include, for example:

• the research is based on an appropriate research plan,
• the research has a responsible person or a responsible group,
• the research participates in scientific discourse, meaning the results are intended to be published according to scientific principles, for example in scientific journals or as a thesis,
• the research produces new knowledge or promotes public health or wellbeing,
• the research has a research permit granted by the relevant organisation, if such a permit is required,
• medical research has a favourable statement from an ethics committee.

An appropriate scientific research plan typically includes, for example:

• background information,
• definition of the information needs the research aims to address,
• setting goals and research questions,
• description of the required data and methods, and
• consideration of ethical perspectives.

Processing time for your application depends on several factors, including the clarity of your application, our current processing load, and response times from data controllers. To expedite the process:

• Complete the application carefully ensuring all sections are filled out thoroughly and accurately.
• Attach all previous permit decisions to your application.
• Attach to your application all previous non-disclosure agreements (NDA). Each person handling the material to be added must have their own NDA.
• Use Findata’s advisory service for additional support and clarification.

For more information, visit the Data page or check the Data Resources Catalogue (aineistokatalogi.fi).

The European Health Data Space (EHDS) is a regulation of the European Union that establishes a common framework for the use and exchange of health data in EU countries. The aim of the regulation is to strengthen citizens’ rights to their own electronic health data and to enable the secure cross-border secondary use of health data.

The EHDS regulation is similar to the current Finnish Secondary Use Act, but it also introduces changes. The regulation includes partly different purposes of use, some of which are reserved only for public or EU entities. In addition, new operating models will be introduced for processing data requests and permit applications.

The regulation entered into force in March 2025 and will be implemented gradually over the coming years. The parts concerning secondary use will begin to apply in March 2029.

Personal data are pieces of information that can be used to identify an individual either directly or indirectly.

Examples of personal data that allow direct identification include:

• name,
• personal identity code,
• email address based on the person’s name, and
• biometric identifiers such as fingerprints, facial images, voice, and iris patterns.

Examples of personal data that allow indirect or partial identification include:

• gender,
• age,
• education, and
• nationality.

Indirect or partial identifiers can also be combined to identify a person. Therefore, removing or replacing direct personal identifiers does not necessarily mean that the data no longer contains personal data.

Special categories (or sensitive) personal data include, for example:

• ethnic origin,
• sexual orientation or behaviour,
• health data,
• biometric data, and
• genetic data.

Highly protected personal data include, for example:

• psychiatric data,
• social welfare data, and
• data related to sexually transmitted diseases and medical genetics.

For instructions on how data controllers can submit extracted data, see the Data transfers to Findata -page.

Anonymisation means the transformation of personal data into a form that irreversibly prevents the identification of an individual person. This may mean, for example, removing direct identifiers and simplifying the data to a general level so that personal data cannot be reconstituted in any way.

Pseudonymisation refers to the transformation of personal data, for example into a coded form. In this case, names and personal identifiers can be removed and replaced by another unique identifier, i.e. a code. Often a code key is kept to restore direct personal data to the data. Pseudonymised data are still personal data.

Yes, you can, if this is okay with the controller. The controller has the right to determine independently the manner in which it carries out the extraction, and it has the right to use an external processor to carry out the data extraction.

If such processors are used, the EU General Data Protection Regulation (GDPR) requires that a data protection agreement (DPA) covering the processing of personal data is signed with them. The controller is ultimately responsible for ensuring that the personal data is processed in a legal manner. The processor, meanwhile, is responsible for ensuring that it complies with the terms of the DPA and the instructions of the controller.

The collected data must be delivered to Findata securely via the transfer service Tunneli, after which we combine and pre-process them.

Unfortunately, you cannot yourself modify an application after it has sent.

If you want to supplement an application that has already been sent, send us an email to info@findata.fi and tell us your application’s ID (e.g. 2022/53). We will return the application so you can supplement it.

The processing time for applications depends on several factors: the accuracy of the data extraction description, the current backlog at Findata, and the response times of data controllers.

By following the following guidelines, you can help ensure that your application is processed as quickly and efficiently as possible.

1. Verify Findata’s authority:
   • Ensure Findata is the competent authority to issue a permit for the data you need.
   • Use the application assistant to help determine this.
   • Note that the Digital and Population Data Services Agency, the Finnish Centre for Pensions, and Statistics Finland handle their own data and permit decisions. If you need information from these controllers, contact them directly.
2. Consult Findata’s help desk:
   • If unsure about where to send your application, contact Findata’s help desk service at info@findata.fi before submitting it.
3. Contact data controllers directly:
   • If you need more information about the data or variables, contact the relevant data controllers. Data controllers provide advisory services for their data and can guide you on data extraction methods. You can also make an agreement on the implementation of data extraction in a certain manner with the controller.
   • In your application, mention the contact person with whom you have discussed the data extraction.
   • See information and contact details for controllers: Links to data controllers’ websites and data descriptions
4. Use the Data Resources Catalogue:
   • You can refer to the Data Resources Catalogue (aineistokatalogi.fi) for additional information.
5. Describe your information needs accurately:
   • Clearly define the information needed and specify the register-specific data extractions in your application.
   • If the extraction involves multiple steps, describe the order of extraction using the extraction description form (download Word file, 51.2 kb).
   • If you are applying for a statistical data with a data request, describe the statistics generation in the Tabulation plan (Excel file, 19,2 kB)
   • Ensure that the data extractions and the data you request are essential and justified.
6. Apply the GDPR minimisation principle:
   • Only request data that is essential for your purposes. The principle of minimisation as defined in the GDPR will be applied, meaning that only necessary data will be disclosed.
7. Complete the application carefully:
   • Pay attention to entering basic data such as the applicant’s details, the data controller, invoicing details, and any other data to be combined.

Before logging in, make sure your username has been registered and is ready to use.

If you’re unsure, contact your Findata contact person or the Kapseli helpdesk: kapseli@findata.fi.

How to log in to Kapseli

1. Install and activate the Duo Mobile app (duo.com)
   • Download Duo Mobile (by Duo Security Inc.) from your phone’s app store.
   • If you’ve already installed and activated the app, skip to step 2.
   • After ordering Kapseli, you will receive an activation message at the phone number you provided.
   • Open the message and click the link to activate Duo Mobile.
2. Log in to Kapseli
   • Go to kapseli.findata.fi using your computer’s browser.
   • Select the identification method you chose when registering.
   • Choose your processing environment. (If you only have one, the system moves on automatically.)
3. Complete two-factor authentication
   • A login notification will appear in Duo Mobile on your phone.
   • Tap Approve in the app to continue.
4. You are now logged in to the Kapseli environment.

If you get an error message, e.g. “400 bad request header field too long”, try the following:

• Make sure you are using your organisation’s network (VPN).
• Try to log in to Kapseli with another browser. Supported browsers are Chrome and Firefox. Please note that the Virtu-service does not work in Firefox.
• Try logging in to Kapseli in incognito mode or delete cookies from your browser.

The problem may also occur because you are trying to log in from a different IP address than the one you have provided to Findata.

The IP address you have provided may be a private one, or it may be a single address from a wider network range of the organisation, in which case it may vary within the range. In these cases, please check with your organisation’s support to find out what your correct IP address is. It can be a single public IP address or the IP address of an entire network domain. Deliver your correct IP address to the Kapseli helpdesk so that the firewall can be opened.

Verify your IP address here (apps.csc.fi)

If these steps do not help, please contact the Kapseli helpdesk and explain the steps you have taken in your message.

Kapseli Helpdesk: kapseli@findata.fi

There are two ways to stop using the remote desktop.

• Sign out is located behind the human figure at the bottom left. You should use this option when you have finished processing the data. When you exit from Sign out, you release the resources on the remote workstation.
• Disconnect is located behind the Power button. Use this option if you need to leave analyses  running when you leave the workstation. The resources will then remain reserved.

After both options, you will see the options Reconnect and Logout. Select Logout when stopping the use of the system. Close your browser unless you want to log back in.

Yes, it is possible to install your own software in Kapseli if certain conditions are met.

The software can be either open access or licence-based. If a licence is required, you are responsible for obtaining and providing it. The software must be installable and usable in a closed environment, as Kapseli is not connected to the internet.

Before installation, Findata will assess the software’s information security and compatibility with the Kapseli environment. However, we cannot test the software or guarantee that it will function as intended.

To request an installation, you must:

• Test the software to ensure it works in Kapseli.
• Provide a valid licence (if required)
• Include clear installation instructions
• Ensure the software can be used without internet access
• Supply all necessary information to install and use the software

Installation fees:

• Standard installations: €90.00/hour + VAT 25.5%
• More extensive technical work (e.g. private software): €147.00/hour + VAT 25.5%

Installation costs will be charged even if the software cannot be used in Kapseli as intended.

You can pause your Kapseli processing environment, after which the current machine package will be disabled for the duration of the pause. During the pause, we maintain the processing environment and the materials within, but the users do not have access to it.

The pause service is subject to a fee.

Read more: Kapseli pause service

SPSS, SAS and Stata require a valid software licence to work.

Please send an email to kapseli@findata.fi with the Kapseli ID (e.g. A01) and the software for which the license needs to be updated.

The activation link is valid for 7 days.

If the link has expired, contact the Kapseli Helpdesk to request a new activation link.

Kapseli Helpdesk: kapseli@findata.fi

Contact the Kapseli Helpdesk and request a new activation link.

Kapseli Helpdesk: kapseli@findata.fi

Log out of Kapseli by clicking on the Log out button. Note: Do not disconnect! The Logout button can be found in the bottom left corner of the Windows Start menu. It is located behind the character icon. Once you have logged out of the Kapseli, log back in. This will end the entire session and often helps in situations where temporary files are the cause of a hang or memory loss.

You can check your machine’s resource usage during analyses from the Performance and Users tabs of the Task Manager. This allows you to see if the program is running out of memory and how much each user is consuming resources. You can find Task Manager in the Windows menu.

If these measures do not help, contact the Kapseli Helpdesk and tell them about the measures you have taken in your message.

Kapseli Helpdesk: kapseli@findata.fi

If you have not logged into Kapseli for three months, your DUO Mobile activation period will expire. You will receive a message saying “User not enrolled in Duo”.

In these cases, please contact the Kapseli Help Desk and ask to reopen your DUO connection.

Kapseli Helpdesk: kapseli@findata.fi

Make sure that you have disconnected or logged out of Kapseli after receiving a response from the administrator that repairs or changes have been made. Some changes do not take effect in the middle of a session, so you will need to log back into Kapseli for them to take effect.

If the problem is not resolved after logging back in, please report it to the Kapseli Helpdesk: kapseli@findata.fi.

If your account is locked out, you will receive an error message saying “Your account has been locked out due to excessive authentication failures. Please contact your administrator.”

Account lockout is usually caused by too many login attempts. A locked account will usually unlock within 20 minutes. If your account does not unlock within 20 minutes, please contact the Kapseli Helpdesk: kapseli@findata.fi.

This depends on the controller. The data controllers determine their own collection fees on the basis of their own regulations.

Findata’s prices are based on the decree of the Ministry of Social Affairs and Health on charges for work carried out by the Health and Social Data Permit Authority.

With the exception of Kapseli, the service prices are for actions under public law that are based on cost value (VAT 0 %). The prices for Kapseli’s services are commercially priced paid services with 25,5% VAT.

The data controllers determine their own costs on the basis of their own regulations.

On the page Average costs estimates (in Finnish), you can find the average, range and median calculated from the maximum cost estimates. The data is updated quarterly.

You can find the average, the range and the median calculated from the maximum cost estimates for data extractions in Finnish on the Average Cost Estimates page. We update the data quarterly.

Possibly. Any inconsistencies between the applicant and the invoiced party (e.g. the payer is not the applicant) can be clarified where necessary in the ‘Additional information’ section.

E-invoicing is the primary invoicing method. Paper invoices are only possible in exceptional cases. As a rule, however, the invoice recipient are organisations that only accept e-invoices. If necessary, ask for more information from your organisation’s financial department.