Data permits and data requests

Permission to use Kela’s register data is applied for on an electronic form. All applications must include the following documents:

• data permit application
• an updated research plan
• specification document for the data request
• privacy statement (either an internal statement of the applicant organisation or the form linked here)
• publication plan
• confidentiality agreement signed by all who will have access to the data
• invoicing details.

A statement by a research ethics committee should be provided where appropriate.

Send the application and the enclosed documents to Kela electronically to the address kirjaamo@kela.fi. Name and number the documents clearly so that the application can be processed speedily.

Check that the application includes the following information:

• the principal research institute and investigator as well as other persons who will have access to the data
• where the study is to be carried out, how the confidentiality of the information is ensured and how the information is to be destroyed
• schedule of the research
• sources of financing for the research and any ties or conflicts of interest of the research team
• the type of information requested from Kela and the period for which it is requested
• the purpose for which the information is to be used
• other information used in the research.

A confidentiality agreement must be signed by the principal investigator and by researchers who handle encoded or pseudonymised data. The data is considered to constitute a register of personal data as long as it remains possible to recognise individuals from the data either directly or indirectly or as long as the code key for the data is retained.

If the purpose is to use register data available from Kela in combination with information gathered directly from the subjects (by means of interviews or surveys), either the consent form signed by the subjects or the information notice must state clearly what types of data (e.g., data on purchases of prescription medicines) obtained from Kela will be combined with such information. A model consent form and information notice must be enclosed with the application. The consent form must conform to the General Data Protection Regulation (GDPR). Plan the research project carefully in advance so that you can request consent that covers the whole research project.

Change in the research group

Permission must be obtained from Kela to add a new investigator to the research team. State information on the researcher’s ties and conflicts of interest in the application. Please provide the following documents with your application:

• copies of any prior permits obtained
• a confidentiality agreement
• an up-to-date privacy statement.

Expansion of the data file

It is possible to apply for an expansion of the data file in order to add contents or topics not covered by the original permit. The application must describe the new data to be added. Please provide the following documents with your application:

• copies of any prior permits obtained
• an updated research plan
• an up-to-date privacy statement
• a specification document
• invoicing details.

Validity and renewal of the permit

Research permits granted by Kela are valid for a specified period of time (up to 5 years from the date of the letter of permit). For purposes of extending a permit, please submit an application accompanied by at least the following documents:

• copies of any prior permits obtained
• details of the individual stages and publications of the research project and an estimate on the fulfilment of the terms and conditions of the permit and on the completion of the remaining part of the study
• a list of participating investigators and persons who process confidential research materials
• an up-to-date privacy statement
• invoicing details.

The time required to review the research permit application depends on the clarity and accuracy of the information and statements submitted. The process can be expedited by ensuring that all application documents are completed carefully and are accompanied by all necessary supporting documents. Applications should be submitted well in advance of the start of the research.

Applicants are notified of the outcome of the review as soon as possible and in any event within three months of the date on which the full application was received by Kela.

Having to contact the applicant for further information will delay the processing of the application. An exact specification of the data is also necessary in order for Kela to be able to provide a cost estimate for the information retrieval.

Fee schedule for research data permits:

• New permit or permit covering a large dataset: €1,000
• As above except if related to a thesis: €150
• Extension of permit or addition of new members to the research team: €300.

The prices are exclusive of and exempt from VAT.

The fees charged for permit decisions and information retrieval are based on the Act on Criteria for Charges Payable to the State (150/1992).

Following a favourable decision, Kela will retrieve the requested data. The retrieval schedule depends on the number and extent of currently pending requests. After retrieval, Kela keeps the data related to the study on file for one year, unless otherwise separately agreed on with the applicant.

During the processing of the permit, Kela provides the applicant with a cost estimate for the work required to retrieve the requested data. The price for the retrieval is €121 per hour (VAT 0%).

Kela is responsible for ensuring that the data comply with the specification document drawn up on the basis of the data request. Kela corrects errors in the data without charge, if the requester reports the error in writing within 3 months of gaining access to the data. Kela assumes no responsibility for any errors in the source data. Kela assumes no responsibility for errors or delays caused by the requester’s failure to discharge agreed responsibilities.

Kela has the right to outsource tasks specified in the request to third parties. Kela assumes responsibility for all such tasks as if they were sourced internally. Kela will not release data if doing so would infringe upon confidentiality provisions governing such data or would be otherwise unlawful.

Kela assumes no responsibility for errors, delays or indirect damage caused by a force majeure event. Kela’s liability for damages does not extend beyond the agreed price for the service that resulted in the damage. The limitation of liability does not apply in case of any damage caused by Kela due to wilful or gross negligence.

Please read the following relevant Acts that govern the secondary use of personal data in healthcare and social services (links open in new window):

• Act on the Secondary Use of Health and Social Data (552/2019)
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR)
• Data Protection Act (1050/2018)
• Act on the Openness of Government Activities (621/1999)

• Findata (findata.fi)
• Office of the Data Protection Ombudsman (tietosuoja.fi)