On August 14, 2026, Findata, Finland's Social and Health Data Permit Authority, issued its formal statement on the draft government proposal (hallituksen esitys) that would supplement national legislation implementing the secondary-use rules of the European Health Data Space (EHDS) Regulation (EU) 2025/327. Findata backs its proposed designation as Finland's coordinating Health Data Access Body (HDAB) and national contact point, a centralized permit system, and the inclusion of social welfare client data within scope, while urging that citizens' opt-out rights be managed through MyKanta rather than the permit system.
The EHDS Regulation (EU) 2025/327 enters general applicability on 26 March 2027. Finland's Ministry of Social Affairs and Health (STM, sosiaali- ja terveysministeriö) opened consultation on the draft bill on 25 June 2026 with a 31 July 2026 comment deadline, and intends to submit the hallituksen esitys to Parliament in autumn 2026. The proposal supplements the existing Act on the Secondary Use of Health and Social Data, under which Findata already operates.
What does the draft proposal change for secondary use of health data?
The draft would entrench Findata as the single coordinating Health Data Access Body and national contact point for the EHDS in Finland, formalizing the role it has built through the Secondary Use Act and European cooperation. Findata supports three core solutions in the proposal: bringing social welfare client data within the EHDS scope, introducing a centralized application and permit management system, and aligning dataset descriptions, information security requirements and fee regulation with the current Act on the Secondary Use of Health and Social Data.
The centralized permit system is the most operational shift for applicants. Rather than navigating fragmented data requests across authorities, organizations seeking secondary use of Finnish health and social data would route through one permit management process, with dataset descriptions and fees harmonized with the regime Findata already administers.
Who must act, and by when?
Any organization seeking secondary use of Finnish health data must prepare for the new centralized permit regime under Findata as HDAB. The affected audience spans pharmaceutical R&D, medtech and health-tech companies, contract research organizations (CROs), and academic research institutions that rely on Finnish register data for research, innovation and public sector steering.
The binding external deadline is 26 March 2027, when the EHDS Regulation becomes generally applicable. The national track is tighter in practice: with the consultation closed and Findata's statement filed, the government intends to table the hallituksen esitys in Parliament in autumn 2026, after which the committee stage and presidential confirmation (vahvistaminen) follow before entry into force.
Where does Findata want changes before the bill is finalized?
Findata flags two areas for further development. First, it argues that management and verification of citizens' opt-out rights should be centralized within the MyKanta citizen service, not handled through the permit management system. Second, Findata does not support derogations from the opt-out right, signalling that any exceptions carved out for specific data uses should be resisted during the committee stage.
Acting Director Mervi Siltanen also ties successful implementation to resourcing: "Through implementing the Secondary Use Act and participating in European cooperation, we have developed the expertise and networks needed to take on this coordinating role. However, successful implementation of the EHDS requires adequate human, financial and technical resources." For applicants, that resourcing question bears directly on permit turnaround times once the regime goes live.
| Milestone | Date | What it means for applicants |
|---|---|---|
| STM consultation opens | 25 June 2026 | Draft government proposal published for stakeholder comment |
| Consultation deadline | 31 July 2026 | Window for statements on the draft bill closes |
| Findata statement issued | 14 August 2026 | HDAB confirms support, flags opt-out changes |
| Government bill to Parliament | Autumn 2026 (intended) | Committee stage and presidential confirmation follow |
| EHDS Regulation applies | 26 March 2027 | Centralized permit regime under Findata must be operational |
Take advantage of this real-time watch
What to do next
Confirm whether your organization's Finnish research or data activities fall under secondary use of health or social data, and map them against the proposed centralized permit route. Track the autumn 2026 hallituksen esitys for changes to opt-out handling, the scope of social welfare data, and the fee structure, since Findata's requested amendments on MyKanta opt-out and derogations are not yet reflected in the draft. Brief your data governance, legal and R&D teams ahead of the 26 March 2027 applicability date, and engage Findata early on permit readiness. Continuous, per-jurisdiction regulatory monitoring surfaces this kind of national implementation move the moment it publishes.
