Research Data Guide: Register Data

Research data vary considerably, and therefore the solutions used to manage them also differ. Data management is a form of creative problem-solving and an essential component of responsible and ethical research. The aim of data management is not to apply a single model to all research projects. Rather, guidance and support services are intended to help researchers identify solutions that are appropriate for their data, research design, and research environment. 

Well-designed data management supports the reliability, transparency, reproducibility, and potential reuse of research. Data management encompasses the entire lifecycle of research data, from research planning through data collection or acquisition, processing, analysis, documentation, and storage, to the sharing, archiving, or deletion of data after the completion of the research project. 

Research data may vary, for example, with respect to how they are generated, their data protection and information security requirements, contractual obligations, technical solutions, and opportunities for future reuse. This data-specific guide examines key data management issues from the perspective of register data.

Not all research data can or should be made available for reuse. Data sharing may be restricted, for example, by the protection of personal data, copyright, contractual obligations, or research ethics considerations. Even when the data themselves cannot be published, metadata, documentation, analytical methods, or software code used in the research can often be made available to other researchers. This supports research transparency, the evaluation of research findings, and the broader goals of open science. 

The purpose of this guide is to help researchers identify the key data management issues associated with their particular type of research data and to find practical solutions for different stages of the research process. The guide complements the organisation's general guidance on research data management, data protection, information security, and open science. 

This guide concerns individual-level register data collected by public authorities for administrative and planning purposes and not originally collected for research use. These data are maintained by register authorities, the most important of which are  and the public register authorities operating under the Act on the Secondary Use of Health and Social Data, listed on .

In practice, Statistics Finland is the principal provider of register data for most researchers. Through , researchers can access a wide range of register datasets, including precompiled research data packages (ready-made datasets), which can also include data from other register authorities.

Findata is the data permit authority through which researchers can apply for access to health and social care register data falling under the Secondary Use Act (see the UH guide  in Flamma and information about the Secondary Use Act on the ). Register data outside the scope of the Act must be requested separately from the relevant register authority, such as Statistics Finland, the Finnish National Agency for Education, the Digital and Population Data Services Agency, the Finnish Defence Forces, or the Legal Register Centre. In addition, Statistics Finland provides access to certain datasets maintained by other authorities, such as Finnish Customs, Traficom, and the Finnish Matriculation Examination Board.

Individual-level register data may be used on their own or linked with other data sources, such as geospatial and environmental data, survey data (see the section "Linking Register Data with Survey Data" below), clinical data, or genetic data. The linkage of individual-level data across registers and other data sources is possible through the Finnish personal identity code, which uniquely identifies persons residing or previously residing in Finland and enables longitudinal follow-up over time.

Managing register data requires careful planning together with adequate time and financial resources. Particular attention must also be paid to information security and data protection throughout the research process. Individual-level register datasets often contain personal data through which individuals may be identified. Major register authorities, such as Statistics Finland and Findata, do not release individual-level data directly to researchers. Instead, they provide access to pseudonymised datasets through secure remote-access environments (Statistics Finland's Fiona and Findata's Kapseli). In these situations, many aspects of data management are the responsibility of the register authority, while researchers are responsible for the appropriate use of the data by complying with the information security and data protection requirements of the remote-access systems.

The processing of personal data and sensitive data must be planned carefully. When personal or sensitive data are involved, researchers should assess the risks associated with data processing, in other words, the potential harm that disclosure of the data could cause to individuals or communities. A useful tool for risk assessment is a Data Protection Impact Assessment (DPIA) (see ). When planning data processing, it is particularly important to identify points at which risks may arise, such as the possibility of data leakage. In addition, appropriate training of personnel handling the data and the use of secure storage solutions should be considered (see the ). Special risks are also associated with linking datasets. For example, combining register data with survey datasets may create new disclosure risks and legal issues. It is therefore advisable to allocate sufficient time for legal assessment as well. In practice, the linkage of datasets is usually carried out by Findata or Statistics Finland.

Allow sufficient time for the application process and consider costs. In research based on register data, adequate time and financial resources are essential. Researchers should obtain information about the schedules, acquisition costs, and access costs of register datasets already during the planning stage. In particular, the application processes for large datasets are often lengthy and may take more than a year. Costs and processing times depend on the scope and complexity of the data and on the number of register authorities involved. Costs typically arise from data access permits, data preparation, and ongoing use of remote-access systems, with fees depending on the number of users and the computing resources required. Major register authorities publish estimates of costs and processing times on their websites (see the estimates by Statistics Finland for their  and , and the estimates by Findata for their  and ). Researchers should also check whether their home organisation or faculty provides funding for register data access costs.

Research collaboration may save resources. Because access processes are lengthy and data are often costly, research using register data should, where possible, be conducted within existing research projects. It may be possible to add new researchers to datasets already available under an existing permit, and datasets can often be updated or expanded. However, applying for additional permits, expanding datasets, and extending permit periods may also increase project costs.

Information about collaboration opportunities and existing datasets can often be obtained from researchers within the same organisation or research field.

Legislation governing register data. Individual-level register data may be used on their own or linked with other data sources, such as survey data. Data consisting solely of register data and datasets linked with other sources are subject to partly different legal requirements and principles (see for example the UH guide on ). Official statistical data at the aggregate level, such as counts and averages derived from public authority records, are also governed by separate legislation (, only available in Finnish or Swedish).

Research based solely on register data does not generally require informing data subjects. In the case of register data, it cannot normally be assumed that individuals included in the register can be contacted with reasonable effort, particularly where the data cover the entire Finnish population. The situation changes if register data are linked with other data sources. For example, linking register data with survey data requires informing participants and obtaining their consent.

Register data are often sensitive. Data available under a permit are typically provided at the individual level and are therefore considered sensitive. Researchers must familiarise themselves with and commit to the information security requirements imposed by the register authority before access is granted. Although the data are processed in remote-access systems, responsibility for the proper handling of the data remains with the researcher. Responsible data management includes compliance with all applicable rules of the remote-access system. Identifying individuals on the basis of personal characteristics contained in the data is not permitted.

The data controller is responsible for responsible data management. In register-based research, either the researcher or the organisation conducting the research may act as the data controller. The data controller is responsible for decisions regarding data processing, ensuring the security and appropriateness of personal data processing, and ensuring that data are either archived appropriately or deleted securely once the research has been completed. When a researcher is employed by the organisation conducting the research, that organization acts as the data controller. An independent researcher or research group can act as the data controller themselves. (See for example Statistics Finland’s instruction .)  

In practice, data controllership depends on how the data are used. For data processed within remote-access environments such as Statistics Finland's Fiona environment or Findata's Kapseli environment, the data controller is typically the authority providing access to the data, while the researcher or research organisation is responsible for its own research activities and compliance with applicable data protection requirements. The responsibilities of the data controller become particularly important when researchers compile or link datasets themselves or process data outside remote-access environments.

Research based on register data requires consideration of both ethical review and research permits. Whether these are required depends on the research design, the datasets used, and the methods of data processing. Research based solely on register data does not usually require prior ethical review. According to the Finnish National Board on Research Integrity, ethical review is generally not required for research based on public records, registers, administrative documents, or archival materials (see  by the Finnish National Board on Research Integrity TENK, 2019). However, the need for ethical review must always be assessed on a case-by-case basis. The situation may change when register data are supplemented with other data sources, such as surveys or interviews, or when the research concerns particularly sensitive topics or very small target populations, where the risk of identification increases. In such cases, ethical review may be required.

Researchers are responsible for determining whether ethical review is required before commencing the study. This assessment should be carried out in accordance with the procedures of their home institution. Researchers should also note that the use of register data generally requires separate permits from the relevant register authorities, such as Statistics Finland or Findata, and may additionally require permissions from the research organisation itself.

has been compiled by the University of Helsinki. Researchers should note that review and permit processes can be lengthy, and applications should therefore be submitted well in advance.

Register data are produced and made available for research purposes by register authorities. Researchers do not collect these data themselves. Instead, they specify in their permit applications which register datasets are required for the study. Applications must also include a variable list and a research plan justifying the use of the requested data. Researchers should request a permit period that is sufficiently long to allow for activities such as verification of results and journal review processes before data access expires. Extensions to permits may be requested where necessary.

Separate instructions: (1) Applying for Register Data and (2) Linking Register Data with Survey Data

1. Guide to Applying for Register Data

• Access permits for register data must be requested from the relevant register authority. The Findata website provides good basic guidance on applying for register data, and Statistics Finland also provides guidance on the application process.
• Applying for access requires careful planning because both the datasets and variables must be defined during the application stage. Researchers are advised to contact register authorities well in advance while preparing the application to ensure that the requested information is appropriate for implementing the research plan. Available data:
  
• Individual-level data from different authorities can be linked, for example between Findata and Statistics Finland. (see the instructions by )
• If permission is sought to combine data from multiple register authorities, permission must be requested from each authority, specifying which data will be included in the final dataset, where the data will be stored, and where they will be analysed. 
• Findata releases data only to information security-audited processing environments (see  by Finnish Supervisory Agency). The University of Helsinki does not have such an approved secondary-use operating environment. Consequently, register data research is generally conducted in Findata's Kapseli environment or Statistics Finland's Fiona remote-access environment. These CSC-maintained environments provide access to most major statistical software packages, including R and Stata.  is among the remote-access environments approved under the Secondary Use Act. It is available free of charge to University of Helsinki researchers, but contains only a limited selection of software (LibreOffice, Python, and R), and researchers cannot import their own software or files (such as analysis scripts). All datasets transferred into SD Desktop must be submitted through Findata, for which a separate fee-based application is required.
• Data administered by Statistics Finland, including precompiled datasets, can generally only be accessed through Statistics Finland's own remote-access environment. The only information that Statistics Finland may release to Findata's environment or directly to an organisation consists of cause-of-death data, age, sex, education, occupation, and socioeconomic status. (see Statistics Finland’s instructions for )
• In addition to a data permit, researchers must separately apply for user access to the remote-access environment (Statistics Finland's Fiona or Findata's Kapseli) from the service provider. Remote access is established either from a university workstation or from a virtual desktop environment (VDI). Before submitting a request for remote-access rights, researchers should contact the University of Helsinki's IT Centre ( or ) to obtain current information about the technical contact person required for the application. Once the connection between the University of Helsinki and the remote-access environment has been established, users log in according to the instructions of the service provider, typically using two-factor authentication.
• All users of the data must be named in the permit application. However, additional users may be added later by applying for supplementary access rights. Changes relating to users and extensions to permit validity periods are processed more quickly than new permit applications, but all such changes are subject to fees.
• When applying for a data permit, each user must sign a confidentiality undertaking relating to the data.
• Each remote user must also submit a user-specific and location-specific remote-access agreement. Access may be granted for use from home or from abroad, but the country of use must be specified in the data permit. Country-specific restrictions may apply. If a researcher permanently changes workplace, workstation, or location of work, including during a research visit, separate permission must be obtained. Changes in telephone number must also be reported, as two-factor authentication relies on the registered phone number.
• Data permits are granted for a fixed period, after which access to the datasets ends. However, it is common to extend permits, and applying for an extension is generally a lighter and less expensive process than applying for a new permit.

• Researchers should allocate sufficient time for the permit process. Obtaining access to data takes at least several months, and for customised datasets often more than a year. Register authorities provide estimated processing times on their websites (see queues for , and ). While timelines vary, researchers should be prepared for processes to take longer than initially anticipated.

   

2.  Guide to Linking Register Data with Survey Data

• Permission to link survey data with register data must be obtained from both an  and the relevant register authorities. Applications must specify all intended linkages.
• Consent for the linkage of register data must be requested from survey respondents. Participants must be informed about which register data will be linked to their responses. This information can be provided, for example, through a concise explanation in the questionnaire together with a link to a more detailed description on the project website, such as a privacy notice explaining the planned linkages and the purposes for which the data will be used.
• The participant information and consent materials must also be submitted to the register authority and to the university's ethics committee. Researchers should allocate adequate time for this process, as review procedures may be lengthy and revisions to the consent materials may be required.
• For Statistics Finland and Findata datasets, the linkage between register data and survey data is performed by the relevant register authority within its own remote-access environment. Survey datasets containing personal identity codes are transferred to the authority, which is responsible for pseudonymising them. Register data can then be linked to the survey data using pseudonymised identifiers. Pseudonymised data still allow individuals to be distinguished from others and linked across datasets. Consequently, they remain personal data and must be processed in accordance with .

Storage and processing of register data in remote-access environments. Register data cannot be transferred outside the remote-access environment provided by the register authority. In addition to holding a valid permit, users must comply with the conditions governing the use of the environment. Access must take place through an approved technical environment, such as an institutional network connection. Researchers must ensure that the computer, network connection, and workspace used for accessing the system meet the relevant information security requirements. Statistics Finland's remote-access environment is subject to country-specific restrictions and is often not accessible from outside the European Union. The Fiona and Kapseli environments are provided by CSC – IT Center for Science. The available software differs between systems, and in some cases researchers may request that their own analytical tools or scripts be installed.

All project researchers who have received access rights to a dataset are able to access the entire dataset within the remote-access environment. This should be considered carefully during project planning because the processing of personal data should follow the principle of data minimisation. If internal restrictions on access are required, the project may need to be divided into smaller components, which may increase costs due to project-specific annual fees. Within a project, users also have access to each other's working directories.

Register data accessed through remote-access systems are not released outside the environment, although analytical outputs may be. Researchers may export aggregated analytical outputs, such as cross-tabulations, group means, regression coefficients, and similar results from the remote-access environment. Outputs must undergo disclosure review before they are released to the researcher (read more about the review process: ).

Be aware of the limited processing capacity of remote-access environments. Register datasets are often very large, containing millions of observations and hundreds of variables. Computationally intensive analyses and even the storage of analytical datasets may quickly reach the limits of the remote-access environment. For example, fees in Statistics Finland's environment vary according to the performance level of the computing resources used. Researchers should therefore recognise the challenges associated with limited computing capacity and agree within the research group on practices relating to the deletion of intermediate analytical datasets and other temporary files.

Allocate substantial time to data preparation and data linkage. Register datasets based on administrative records often constitute raw data that are better suited to administrative purposes and information systems than to research. Transforming raw administrative data into research data is a time-consuming process requiring numerous decisions. This may involve defining the study population and observation period, linking information from multiple sources, and operationalising research concepts using available variables. Researchers frequently need to investigate how data have been generated, the availability and quality of register variables, and changes in data collection practices over time. Such information often needs to be obtained directly from register authorities. Collaboration with other register researchers is therefore often valuable, as many researchers face similar challenges and can share practical advice and solutions.

Describe the datasets used in research publications. Publications based on register data typically describe the analytical dataset rather than the raw data. To support reproducibility and open science, good practice is to report which registers or precompiled data modules were used in constructing the analytical dataset and what analytical methods were used during data preparation. Documenting data sources at the register and variable level is also recommended. The contents of precompiled datasets change over time, and without detailed documentation it may be difficult for reviewers or future researchers to determine which version of a dataset was used at the time the study was conducted.

There is a distinction between data stored in remote-access environments and data released directly to researchers. Statistics Finland and Findata datasets are stored within CSC-operated remote-access environments and cannot be transferred outside them.

Datasets released directly to researchers or research organisations must be stored in a secure environment. At the University of Helsinki, suitable options include the Umpio environment for high-risk data as well as other institutional storage services selected according to the risk level of the dataset. Researchers must determine how the data will be transferred from the data controller and how secure transfer and storage will be organised.

Researchers are encouraged to make use of university-provided storage services during the project. Data may be stored in a personal home directory (for individual researchers) or a shared project directory (for research groups) when the datasets are pseudonymised and classified as low or moderate risk. University of Helsinki home directories (Z drive) and group directories (P drive) are backed up regularly and available across operating systems. Pseudonymisation keys must always be stored separately from the research data and in encrypted form.

Datasets containing high-risk identifiable personal data must be stored in secure processing environments such as . When selecting a storage solution, researchers should follow University of Helsinki Data Support guidance and consult additional Helpdesk instructions relating to sensitive data where necessary (see for example , also the ).

Researchers should document for themselves and for the research group where data are stored so that all data under their responsibility can be located, managed, and deleted appropriately when required.

The sharing, archiving, and deletion of research data must comply with the agreements made during the research project, the information provided to participants, and any legal and ethical obligations governing the data. Although register data generally cannot be shared with other users, documentation, metadata, methodological descriptions, and analytical code can often be published to support research transparency and reproducibility.

The University of Helsinki Databank, Data archive, and Data catalogue services are available to researchers for the preservation, publication, and sharing of research data, datasets, and metadata after the active phase of research or once a research project has been completed (see the University of Helsinki , , and ). The suitability of these services depends on the nature of the data, access rights, and data protection requirements.

The preservation of register data stored in remote-access environments is the responsibility of the register authority. When the permit expires, the researcher's access to the data ends. Preservation or deletion of datasets held within the authority's remote-access environment is therefore not the responsibility of the researcher. Researchers are, however, responsible for retaining analytical code and released outputs required for documentation and reproducibility.

The final stage of the register data lifecycle also includes the preservation and publication of research results. Results are based on statistical analyses and do not contain individual-level data. They are usually published as part of research articles. Unpublished descriptive results may also need to be retained for documentation purposes. When publishing results, researchers must follow research ethics principles. In particular, care should be taken to avoid reporting information relating to very small groups if this could allow indirect identification or contribute to the stigmatisation of population groups or geographical areas.

Analytical code used in register-data research should be preserved and published. The scripts used in processing register data remain with the researcher, and journals may require them to be published alongside the research article. Analytical code consists of text files that make it possible to return to and reproduce the analysis when necessary. Publishing analytical code supports research reproducibility and may therefore be regarded as good scientific practice. For publication purposes, code should be deposited in  and linked to . Zenodo assigns a persistent identifier and provides reliable long-term access for both the researcher and future users. MIT and GNU licences are commonly used for software and algorithms (see “What is the suitable license for software and data?” in ).

Describing analytical code supports reuse. Scripts should be documented in sufficient detail. Some form of general documentation is always necessary, although a line-by-line explanation is not necessarily required. Researchers conducting similar statistical analyses will often be able to understand substantial portions of the code without exhaustive line-by-line documentation.

Researchers are responsible for deleting datasets that have been released directly to them. Data selected for deletion must be deleted securely. Not all research data can or should be retained after a project has ended. If data are deleted, they must be removed in a manner that prevents subsequent recovery. The organisation's information security guidelines should be followed with particular care when disposing of data containing personal information or other types of sensitive data (see the guidelines by ). Physical storage media, such as external hard drives, USB drives, and optical discs, should also be disposed of securely. Researchers may seek assistance from their organisation's IT services or information security specialists where necessary (see ). Local IT support () may also be requested to carry out the deletion if the researcher is uncertain about the correct procedure or if the data are highly sensitive. 

The data management handbooks are designed as living resources that are continuously updated to meet the evolving practices of the field and the needs of researchers.

You can give feedback on the Register Data guide, such as additional information, comments, or corrections, via this .