Background, solutions and data protection

Kela strives to act as a pioneer in customer-oriented services and to secure its position as a prominent actor in the social security service network in the future, too. This goal is put into practice with the aid of a strategic development programme called Eepos.

Through Eepos, Kela will reform its benefit administration and customer services and the related operating methods and systems in stages to ensure that they meet the requirements of the digital first movement. Work on the reforms is projected to continue until the 2030s.

The goal of Kela’s reforms is to deepen our customer-oriented approach and to ensure a better customer experience across all our services. For our customers, this means more streamlined services that can be accessed with less effort and faster processing times for benefit applications.

Once completed, the strategic development programme will improve Kela’s operations in many ways:

• Information will flow better and be easier to access. Technical solutions implemented at Kela will enable better data mobility, and that, in turn, will improve the efficiency of public services within the bounds of the relevant legislation.
• Kela’s core functions can be executed securely in a world of fewer economic resources and qualified employees. New solutions will streamline and automate the work done at Kela. Our ability to detect benefit fraud will be improved.
• Kela can better meet the requirements of an increasingly digitalised operating environment and enhanced productivity. The innovative systems that Eepos will deliver will create efficiencies and savings at the stage when the old systems can be replaced.
• Kela will be able to implement social security more effectively in all circumstances and situations in the coming decades. Kela’s ability to offer new services will be significantly improved. With new benefit administration systems that permit adaptation to evolving needs, Kela will be in a position to implement legislative amendments more quickly than before.

In order to ensure the success of our extensive and complex reform, we decided to use a tendering process to acquire an off-the-shelf solution with turnkey implementation from a supplier with experience and proven success in the implementation of similar reforms in the field of social security.

The reform Kela plans to implement is exceptional in both its nature and scope. Kela’s field of operation is unique in Finland. There is limited availability on the Finnish market for off-the-shelf solutions and expertise in this field. However, there are several international solutions available.

Kela has signed a contract with a foreign partner organisation. A significant number of the experts retained by our partner organisation come from other countries, but Finnish experts may also be appointed to the project. We are confident this will happen to some extent.

Going forward, Kela will develop and improve its systems and services in cooperation with its chosen partner organisations. During this collaboration, our focus will be on our core competence, which is our in-depth knowledge of Finnish social security and legislation and their implementation. Meanwhile, our partner organisations will contribute their expertise and technologies.

Kela attempted to implement a large-scale reform in the previous decade, but it was ultimately unsuccessful. In the early 2020s, we carried out a technology pilot as part of the implementation of the family leave reform, attempting once more to implement a reform primarily with the aid of in-house development work.

During the pilot, we learned that it would have taken us approximately 15–30 years to independently develop the reform Kela required at that point and that the costs involved would have been many times higher than those of the recent procurement. International case studies also supported our conclusions. The new overall system Kela requires is immense in scale. The reason for this is the large number of different benefits and the volume of customer data we process as well as the number of different functions their processing requires.

We must maintain extremely strict data security due to the nature of our operations. The technologies we have chosen will enable us to implement cost-effective solutions that meet future needs. In order for our new platform to meet the requirements imposed by our operations, some adjustments will have to be made in any case and some functions must be tailored to Kela’s needs. The agreement we have signed with our partner organisation also enables us to supplement the procurement with new technical solutions.

In 2023, Kela conducted a market survey to gather information on the potential for using off-the-shelf software. During the market survey, Kela conducted a significant number of market dialogues to gain a better understanding of reference organisations’ experiences of similar reforms both in Finland and abroad.

After the extensive market survey had been completed, Kela’s Board decided in December 2023 to initiate the procurement process required by the implementation of the Eepos development programme. This meant procuring the platforms and partner organisations needed to modernise Kela’s processes for benefit administration, digital services, customer relations management and the transfer of data.

The procurement process was initiated in January 2024. The procurement was arranged as a competitive dialogue.

In April 2025, Kela selected PricewaterhouseCoopers Business Services SRL (using Salesforce technology) to implement the large-scale reform of its benefit administration systems and services.

Before deciding on the procurement, Kela conducted thorough research into large Finnish public and private sector projects, projects implemented by corresponding public authorities in other countries and experiences in project implementation.

In the end, we decided to procure an end-to-end solution. Creating such a challenging solution and implementing it into use requires expertise that is not part of Kela’s core competence. Doing it alone would have entailed the risk of significantly higher costs and possibly even failure to complete the project.

If Kela had procured the new solution piece by piece, Kela would have had to manage the integration of the separate elements of the solution into a complete whole. We have already established previously that it is not possible to integrate separate elements into our existing architecture in a controlled manner, and this has, in fact, been identified as a key factor behind our previous failed attempts to reform our systems. Moreover, implementing our system reform one part at a time would have, in practice, meant building upon our existing architecture while also establishing completely independent functions for different kinds of benefits.

Procuring a system piece by piece can also take more time, which may result in parts of the procured technology becoming obsolete before implementation has been completed.

We have taken responsibility and ethics into account during the implementation of the procurement process for our Eepos programme. This includes, in particular, compliance with legislation, obligations related to terms of employment, financial responsibility and ethical business conduct as well as environmental and social responsibility.

We assessed compliance with responsible practices among the companies included in the tendering process immediately at the stage when we began to determine whether they meet the requirements that apply to all Kela partner organisations.

One of the criteria we enforced during the procurement phase was that the chosen partner organisation must comply with Kela’s ethical guidelines. We regularly monitor compliance with these guidelines. We implemented the procurement in accordance with the Act on Public Procurement and Concession Contracts and applicable procurement directives, which in themselves require the procuring entity to conduct an assessment of the reliability of the companies participating in the process.

The implementation of social security plays a critical role in the provision of public services. The need to ensure the availability and continuity of social security was taken into account in the requirements we set for the procurement.   

The requirements cover various emergency conditions that may affect different technologies and their availability. The chosen service provider has undertaken to develop and produce solutions that enable Kela to carry out its core functions even during significant disturbances in the status quo.

If Kela, Finnish public administration entities, industry operators or the EU were to be prohibited from using solutions produced in other countries, it would mean that no service based on information technology or telecommunications (network or mobile connection) would work because they make use of the same technologies.

Kela will integrate contingency plans for different emergency conditions into the system to ensure that Kela can provide at least the minimum level of social security services to citizens in all circumstances.

The requirements Kela imposed during the procurement process and the solutions it has chosen comply with the cloud service policies established by the Finnish government and with legislation on the processing of personal data in cloud services. Kela has in fact imposed stricter requirements in some cases in order to ensure the data protection of Kela’s customers. Kela also requires for cloud services to be produced within the European Union and for the customers’ personal data to be processed in compliance with the GDPR and other strict data security requirements.

Kela further requires encryption of all data exported to the cloud in such a way that third parties cannot access the data. No personal data, even indirect, may be transferred outside the EU without Kela’s consent. Kela has established strict requirements to ensure the secure processing of our customers’ data. Breaches of data protection provisions will result in significant contractual penalties.

Kela engages in systematic DPIA measures to develop and secure the management of data protection and the implementation of the audit trail at Kela. Kela also engages in close cooperation with the Finnish Data Protection Ombudsman.

With the use of cloud services, Kela gains access to significant new and constantly evolving services that will help us secure customer data and guard against cyber threats to Kela’s operations. The fight against cyber threats would be too expensive without the use of cloud services. As such, cloud services are in themselves an important investment in security.