GAWEL
INSIGHT // 73 Cross-Border

Nordic Health Data for Real-World Evidence: What Findata Grants a US Biotech, and What the EHDS Changes

· · 22 min read ·
Health data & privacy
Abstract: Nordic population registries supply the real-world evidence European regulators use, and Finland's Findata admits foreign sponsors to them under a permit whose terms most US data agreements never contemplate. The analysis runs in a certified environment in the EU, only anonymized results leave, and a login from the United States by the sponsor's own staff is a data transfer. Denmark, Sweden and Norway each add conditions of their own, and the EHDS will rewrite the door for third-country applicants from 2029.
Plain Language Summary

This article examines how a company outside Europe obtains access to the national health registries of Finland, Denmark, Sweden and Norway for research on medicines, and why the terms differ from buying a dataset in the United States. Finland's permit authority, Findata, admits foreign applicants but keeps the data inside a secure computing environment in Europe and treats access from outside the EU by anyone other than an employee of an EU-based permit holder as an international data transfer under the GDPR. The other three countries restrict access to domestic institutions or identifiers. The EU's European Health Data Space, which applies to secondary use from 2029, will place the three EU systems under common rules, and Norway's once the Regulation is taken into the EEA Agreement, and it sets its own conditions for applicants from third countries. The article describes where these regimes overlap, where they conflict with US regulatory expectations, and what remained undecided in August 2026.

Table of Contents
  1. The Registry Advantage Is a Legal Position, Not a Dataset
  2. Inside the Findata Permit: Purposes, Clocks and a Room the Data Never Leave
  3. When Logging In from Boston Is a Transfer
  4. Three Neighbors, Three Doors: Denmark, Sweden and Norway
  5. What the EHDS Changes, and What It Leaves to National Law
  6. Strategic Considerations

A US sponsor that wants real-world data buys it. Claims and electronic-health-record data are licensed under a data use agreement, delivered into the sponsor's own environment, analyzed by its own statisticians and, when the analysis supports a marketing application, handed to the FDA at patient level. The Nordic registries that European regulators themselves rely on do not work that way. When the EMA's safety committee concluded on 6 June 2025 that an optic-nerve condition is a very rare side effect of semaglutide, the signal had come from Danish register-based studies drawing on Danish and Norwegian health registries.1PRAC, 6 June 2025 (semaglutide and NAION); Lægemiddelstyrelsen on the two Danish register-based studies, using Danish and Norwegian registries, behind the signal. Nobody licensed those data. The researchers were admitted to them, under a permit, for a term, in a room the data cannot leave. Finland has run the most developed version of that room since 2020 and rewrote its statute with effect from 1 May 2026. The European Health Data Space (EHDS) will overlay the three EU systems from 2029 and, once incorporated into the EEA Agreement, Norway's. For a US biotech the question is not whether the data exist. It is on what terms a foreign company is admitted, whose employees may open the door, and what may be carried out of the room.

1. The Registry Advantage Is a Legal Position, Not a Dataset

The demand side has hardened on both sides of the Atlantic, in a direction that assumes possession. The FDA's August 2023 guidance on real-world data states that sponsors must ensure they are able to submit patient-level data for any real-world data analyzed as part of a clinical study included in a marketing application, where 21 CFR 314.50 and 601.2 require it, and that where such data are owned and controlled by other entities the sponsor should have agreements in place to ensure that patient-level data can be provided to the FDA and source data made available for inspection.2FDA, RWD/RWE guidance (August 2023), section III.B.3; 21 CFR 314.50 and 601.2. In Europe the EMA's reflection paper on real-world data in non-interventional studies, final since April 2025, and ICH M14, in effect since 18 March 2026, set the methodological floor.3EMA reflection paper EMA/99865/2025 (3 April 2025); ICH M14, effective in the EU 18 March 2026. On 21 May 2026 the CHMP adopted a concept paper for a reflection paper on external controls, recording that proposals to use them have increased while restating that randomized controlled trials remain the gold standard.4CHMP concept paper on external controls, EMA/125200/2026 (21 May 2026). The EU's joint clinical assessments, running for oncology and advanced-therapy products since 12 January 2025, add comparator demands of their own (Insight 47). Each of these frameworks asks the sponsor to produce, document and defend an analysis of data under its control. None was written for data the sponsor is not allowed to hold.

The supply side is where the Nordic countries stand apart. A personal identity number issued at birth links every hospital episode, prescription, cancer diagnosis and death across a national population over decades, and the registers that hold those records are public authorities' registers kept under statutory secrecy, not products. The EMA's own evidence network shows how far they are drawn on. The data partners onboarded to DARWIN EU by 16 June 2026 include the Danish health data registries, a consortium of Finnish data holders, the Cancer Registry of Norway, a Norwegian linked-registry node and a Swedish node run by the medicines agency.5EMA, DARWIN EU data partners onboarded, years I to IV (16 June 2026). Those partners were onboarded as institutions with their own lawful access. A commercial sponsor must instead be admitted, and admission is an administrative decision under public law that differs in each of the four countries.

The divergence from the US frame is structural. A data use agreement transfers a copy. The sponsor holds a dataset and answers for what it does with it. A Finnish permit transfers nothing, and the EHDS is built the same way. The sponsor is admitted to a secure environment run by a public body, for a stated purpose and a fixed term, and what leaves is output the authority has checked for anonymity. That is a defensible architecture for the individuals whose records are involved. It is also an architecture built to prevent exactly what the FDA's guidance asks a sponsor to guarantee, and neither the FDA nor any Nordic legislator has written the bridge between the two.

2. Inside the Findata Permit: Purposes, Clocks and a Room the Data Never Leave

The Finnish Act on the Secondary Use of Health and Social Data, in force since 1 May 2019, created a permit authority, Findata, as an independent unit within the Finnish Institute for Health and Welfare, THL, under the steering of the Ministry of Social Affairs and Health. Findata's permit and data-request functions have operated since 1 January 2020. The Act lists seven purposes for which register data may be reused, from statistics and scientific research through development and innovation to the planning tasks of authorities, and since 1 January 2026 it has expressly excluded clinical trials and other medical research governed by their own statutes.6Laki sosiaali- ja terveystietojen toissijaisesta käytöstä (552/2019), as amended by 1159/2025; §§ 2, 4, 35, 60. The 2025 amending act, in force since 1 May 2026, rewrote the permit competence, the release mechanics and the output controls without touching the purposes, and the reason it gave for leaving them alone matters for everything that follows.

Purpose determines what a sponsor receives. Section 38 allows a data permit to individual-level data for scientific research and statistics. Section 37 allows development and innovation activities that are not scientific research to receive only aggregated statistical data, produced on a data request, and only where the data utilization plan shows one of three listed aims, from promoting public health to developing the service system. The 2025 reform was asked to open individual-level data to development and innovation and declined, deferring the purposes to the bill implementing the EHDS.7Act 552/2019 (n 6), §§ 37, 38, 43, 45; HE 87/2025 vp on § 37; GDPR. A product-development question therefore receives numbers, and the same question framed as scientific research may receive rows. Whether a registry-based control arm assembled for a regulatory submission is research within section 38 or development within section 37 is a characterization the Act leaves to the authority in each case. The first court decision on the Act shows how little room there is to pre-empt it. In February 2022 the Helsinki Administrative Court upheld Findata's refusal of a general permit for real-world-data research projects, because under the applicant's model the case-by-case assessment would have been left to the applicant itself.8Helsinki Administrative Court, 17 February 2022 (Terveystalo), as reported by Findata.

Nothing in the Act confines applicants to Finland, or to the EU. Section 43 asks whether the purpose stated in the application and the data utilization plan conforms to the GDPR, the Finnish Data Protection Act and the statutes governing the data, and whether it is most appropriately achieved with the data applied for. It says nothing about where the applicant is established. Findata's public register of issued permits accordingly lists, among 2024 and 2025 permit holders, a US contract research organization with a permit valid until December 2027 and a UK pharmaceutical research company with one valid until January 2035.9Findata, register of issued permits (2024 and 2025 entries); permit conditions 1.4. What changes with establishment is the fee. The ministerial fee decree for 2026 sets a permit that takes seven hours or more of processing at EUR 1,600 for an applicant with a place of business in Finland or another EU or EEA country, and EUR 300 for a simpler one, but a flat EUR 3,000 for an applicant established outside the EU and EEA, with EUR 2,600 for a data-request decision. From 1 May 2026 the controllers invoice their extraction costs directly to the permit holder, on top.10Fee decree 1230/2025 as amended by 329/2026; Act 552/2019 (n 6), §§ 49, 50; Findata price list 2026.

The clocks are statutory and, unusually, measured. Section 47 requires a decision within three months of a complete application, extendable by at most three months for weighty reasons. Section 48 gives the controllers 30 working days to deliver the data and Findata 60 working days to deliver the compiled dataset. Findata's report for 2025 records 370 applications, a median processing time for data permits of 49 days and 85 % of decisions within three months, with the private sector's share of applicants down to 18 % from 26 % the year before.11Act 552/2019 (n 6), §§ 47, 48, 52; Findata annual report 2025. Those figures describe the part Findata controls. The same report records the controllers meeting their 30-day deadline in 80 % of cases and Findata its own in 77 %, a second clock, run by other public bodies, that the statute bounds but does not close.

The room is the part a US reader is least prepared for. Section 20 requires that data released under the Act be processed in a secure operating environment, and section 51b releases a permitted dataset only into such an environment unless it has been reduced to aggregated statistics. Findata's own environment, Kapseli, is used remotely through a browser from a static organizational address. Other environments may be used, but Findata's Regulation 1/2022 requires any such environment to be physically located in the EU or EEA and operated by an organization registered there, and the government proposal for the 2025 reform recorded ten certified environments, all in Finland.12Act 552/2019 (n 6), §§ 20, 24 to 26, 51b; Findata Regulation 1/2022, Annex 1, section 3.1.2; HE 87/2025 vp. What comes out is governed by section 52. The permit holder anonymizes the results before they leave, and Findata verifies the anonymization, since 1 May 2026 on a risk-based assessment. In 2025 it verified the anonymity of Kapseli outputs 1,322 times, noting issues in 14 % of all its checks.11 Individual-level data do not leave. That is not a policy of the authority. It is the design of the statute.

In the Finnish model, which the EHDS generalizes, the sponsor does not acquire a dataset. The sponsor is admitted, for a term and for a purpose, to a room the data will never leave, and what it carries out has been checked by the state.

The 2025 reform changed who decides and, at the margin, where the room may be. Under the new section 6a permit competence is split between Findata and the register organizations, with Findata alone deciding on data in the national Kanta services and on private providers' data. Section 51c then allows Findata, for a special reason, to release a dataset into a secure environment other than a section 20 environment, including one abroad, if the risks to national security and to the dataset are minor, one participant in the project conducts research in a Finnish research organization, and the level of data protection and information security is sufficient. The parliamentary committee described the provision as a temporary solution for international research cooperation before the EHDS applies.13Laki 1159/2025: §§ 6a to 6c, 51c, 51d; StVM 15/2025 vp. Findata's own statement in the consultation had warned that the exception would allow data to move outside the reach of Finnish law and supervision.14Findata, statement of 14 April 2025 on the reform. The door abroad exists, then, but it opens only for a project anchored in a Finnish research institution, and the body that decides whether it opens is the one that argued against it.

3. When Logging In from Boston Is a Transfer

The permit conditions Findata attaches to every decision, in the version updated on 6 May 2026, draw the perimeter in three sentences. Personal data may be processed under the permit only within the EU and EEA unless the decision states otherwise. Data obtained under the permit may not be processed, nor may a technical connection be opened, from outside the EU and EEA unless the decision so permits. And where the decision does permit it, the permit holder, as controller, is responsible for a transfer basis under Chapter V of the GDPR, including any supplementary measures. Findata verifies that a basis exists when it decides but does not assess the lawfulness of the transfer further.15Findata, terms of the data permit decision (6 May 2026), conditions 1.5, 4.1, 6.1, 6.2, 7.2.8. An analyst who logs into Kapseli from an office in Boston has, on that reading, transferred personal data to the United States without a byte leaving Helsinki.

Findata's guidance then adds the distinction that decides who may sit at the keyboard. Processing from abroad is by default a transfer even when the data remain in a remote environment. An employee of a controller established in the EU or EEA may nevertheless process the data in Kapseli from abroad without a transfer, whereas staff of any other organization may not do so without a Chapter V basis. The bases the guidance accepts are an adequacy decision, which it calls the primary route, standard contractual clauses, accepted only once the signed clauses have been filed with it, binding corporate rules and, in exceptional cases only, the Art. 49 GDPR derogations.16Findata, data-permit guidance (15 June 2026) and FAQ on processing outside the EU/EEA; GDPR (n 7), Chapter V. For a US sponsor holding the permit in its own name the adequacy route runs through Data Privacy Framework certification, whose standing after the US Supreme Court's decision of 29 June 2026 on the removability of Federal Trade Commission members is examined in Insight 64. Where the permit instead sits with an EU subsidiary or a European contract research organization whose employees do the analysis, every login stays inside the perimeter, and the US parent, and the US regulatory team that will defend the study, see only what section 52 lets out.

That price is where the two regimes meet. The entity that holds the investigational new drug application and will file the marketing application is the entity the FDA's guidance addresses when it says that patient-level data must be capable of submission and that agreements with the data's owners should secure that capability. A Finnish permit holder cannot give that undertaking, because the statute that admitted it lets only anonymized results out and the regulation governing the environment keeps it in the EU or EEA. The guidance contemplates that, where an appropriate justification exists for why a sponsor cannot submit patient-level data, a third party may provide them to the FDA. The Act gives Findata no procedure for handing pseudonymized individual-level data to a foreign regulator, and section 52 gives it the opposite duty.2 Whether an FDA reviewer will accept an analysis it cannot re-run on the underlying rows is a question the guidance does not answer and the Finnish statute does not ask.

The section 51c route to an environment outside Finland relocates the problem rather than dissolving it. Its condition of a participant conducting research in a Finnish research organization means a commercial sponsor reaches a foreign environment only by building the study around an academic partner. The permit is then defined by that partner's research purpose, the section 37 line reappearing inside the project's own structure.13 Where the foreign environment is in the United States, the Chapter V analysis returns in full, this time for a dataset rather than a login.

Switzerland occupies a position that looks like the American one and is not. Switzerland is not an EU or EEA member, so a sponsor in Basel, or the Swiss subsidiary through which many US groups run their European operations, is an applicant established outside the EU and EEA for the fee decree and cannot host a certified environment under Findata's regulation. But the Chapter V basis differs in kind. The European Commission's adequacy decision for Switzerland, maintained at the Commission's January 2024 review, is the Art. 45 GDPR route that Findata treats as primary, so the geometry of the Swiss position matches the US one while its legal footing does not. The Swiss permit holder's own processing then answers to the DSG, which under Art. 3 DSG applies to matters that have an effect in Switzerland even if initiated abroad, with the EDÖB rather than any Finnish body as the supervisor of that layer.17Datenschutzgesetz (DSG) (SR 235.1), Art. 3 Abs. 1; Commission Decision 2000/518/EC (Switzerland). A group that assumes its Swiss and US entities stand in the same place before Findata has the fee right and the transfer analysis wrong.

4. Three Neighbors, Three Doors: Denmark, Sweden and Norway

Denmark keeps the room, adds a domicile test at the door, and was rebuilding the door at publication. Forskerservice, the research service of Sundhedsdatastyrelsen, discloses data only to Danish data-controller institutions. Individual-level data are made available on research machines at the authority or at Statistics Denmark, reached remotely from the authorized research environment, and may not be sent home. Any disclosure for processing outside the territorial scope of the GDPR, and the data protection authority names the United States as its example, requires Datatilsynet's prior authorization under § 10 of the Danish Data Protection Act, whose first paragraph reserves such processing to statistical or scientific studies of significant importance to society and whose third paragraph requires that authorization.18Sundhedsdatastyrelsen, Forskerservice pages; databeskyttelsesloven, § 10; Datatilsynet guidance; Danmarks Statistik authorization conditions. A US sponsor therefore reaches Danish registers through a Danish institution or not at all. The rebuilding is a single entry rather than an open one. The act of 20 June 2025 inserted §§ 48a to 48e into the sundhedsloven to create Ét Kontaktpunkt, one contact point for health data for research and innovation, and left the commencement of that block to the minister. The act of 29 December 2025 establishing Digital Sundhed Danmark, in force since 1 January 2026, gives that new body the role of the contact point and, until its final establishment, houses it in a preparatory body that is to absorb Sundhedsdatastyrelsen's tasks. The decree on Ét Kontaktpunkt of 30 June 2026 entered into force on 1 August 2026, three days before publication, with the duty to file applications through the contact point applying from 1 August 2027 and a 90-day decision deadline, extendable by a further 90 days, from 1 May 2027. The decree also provides for a national analysis platform and for processing environments the contact point approves.19Lov nr. 717 af 20. juni 2025, § 1 nr. 3 (§§ 48a to 48e sundhedsloven) and § 4(2); Lov nr. 1758 af 29. december 2025 om Digital Sundhed Danmark, §§ 6, 34, 36; BEK nr. 627 af 30. juni 2026 om Ét Kontaktpunkt, §§ 1, 8, 10, 13, 14, 31. None of that changes the domicile test, and no Danish health data access body under the EHDS had been designated as of publication.

Sweden hands over a copy, and then restricts where the copy may be read. Socialstyrelsen's registers are covered by absolute secrecy under chapter 24, § 8 of the Public Access to Information and Secrecy Act, and an approval under the Ethics Review Act is the first formal step to obtaining anything from them. The data, once approved, are delivered by registered letter to the research principal, closer to the US model than anything in Finland, but only a principal that can carry a Swedish ethics approval receives the letter. In March 2026 the wait for a case officer alone stood at about three months, followed by two to four months of handling.20Socialstyrelsen, data for research (pages updated to 19 March 2026); OSL chapter 24, § 8; Ethics Review Act (2003:460). Statistics Sweden's microdata never leave its MONA system, and the user terms allow MONA to be used only in a country within the EU or EEA or in a third country the Commission has approved for transfers, with no network routing through unapproved third countries.21Statistics Sweden, MONA user terms (13 April 2023). The government assigned Socialstyrelsen on 20 May 2025 to prepare to become the health data access body, a January 2026 inquiry report proposed it for that role, and on 26 June 2026 the government extended the preparatory assignments to 30 April 2027. No designation was in force at publication.22Government assignment S2025/00977 (20 May 2025); SOU 2026:6; assignments of 26 June 2026.

Norway is outside the EU and inside the EEA, and at publication its door was closed to foreign hands. Since 15 March 2023 Helsedataservice, part of the Norwegian Institute of Public Health since 1 January 2024, has decided on access to eleven national registers on one application and one decision. Under § 19 f of the Health Register Act the clock is 30 working days, or 60 where registers are linked, against which the service's own estimate is three to six months.23FOR-2023-01-11-48; helseregisterloven, § 19 f; Helsedataservice on processing times (27 November 2025). The national analysis platform that was to hold the data was canceled in February 2023, over the difficulty of using a public cloud after the Schrems II judgment. The case-handling guide in its February 2026 version records that, as of December 2024, the system could not receive an application from a non-Norwegian actor at all, because it requires a Norwegian identifier, and that applications from abroad would wait for the EHDS.24Helsedataservice, case-handling guide v2 (9 February 2026); ministry consultation note of 6 October 2022 and press report of 15 February 2023 on the canceled platform. The EHDS itself is marked EEA-relevant and under consideration for incorporation into the EEA Agreement, which requires the Storting's consent. The Ministry of Health published a consultation on a Norwegian EHDS act on 8 June 2026, with responses due by 28 September 2026, proposing the institute as coordinating access body and describing the regime for third-country access as strict.25Stortinget EU/EEA notice (16 April 2026); ministry consultation on a Norwegian EHDS act (8 June 2026).

Nordic cooperation has not produced a fifth door. The Nordic Council of Ministers' projects since 2024 and Sitra's December 2025 proposal for a Nordic model of collaboration rest on coordinating existing structures rather than creating a new one.26Sitra, Nordic model proposal (16 December 2025); VALO and VALO2 project descriptions. A study designed to draw on all four countries' registers in one environment is therefore four applications under four statutes, three of which require a domestic institution or identifier, and one of which admits a foreign applicant at a higher fee into a room in Finland.

Four Nordic doors to registry data for a foreign sponsor, August 2026 A grid with four columns, Finland, Denmark, Sweden and Norway, and five rows. Row one, who may hold the permit: in Finland any applicant, with a fee of EUR 3,000 outside the EU and EEA; in Denmark only Danish data-controller institutions; in Sweden a research principal holding a Swedish ethics approval; in Norway an applicant with a Norwegian identifier, foreign applicants deferred to the EHDS. Row two, where the analysis runs: in Finland a certified environment in the EU or EEA such as Kapseli; in Denmark a remote research machine at Sundhedsdatastyrelsen or Statistics Denmark, with environments approved by the contact point to follow from 2027; in Sweden a copy delivered to the principal, while Statistics Sweden (SCB) microdata stay in MONA; in Norway approved secure environments in Norway. Row three, access from outside the EU and EEA: in Finland only if the permit allows, treated as a Chapter V transfer; in Denmark only with Datatilsynet's authorization under section 10(3) of the Data Protection Act; in Sweden MONA may be used only in the EU or EEA or an adequacy country; in Norway not accommodated. Row four, the statutory clock: Finland three months, extendable by three, with a 2025 median of 49 days; Denmark 90 days, extendable by 90, under the decree of 30 June 2026 from 1 May 2027, with no fixed clock before; Sweden about three months to reach a case officer and then two to four months; Norway 30 working days, 60 with linkage, three to six months in practice. Row five, the EHDS access body as of August 2026: Findata proposed in a draft bill of 5 June 2026; Denmark none designated, the decree on the single contact point in force since 1 August 2026; Socialstyrelsen preparing under assignments of May 2025 and June 2026; the Norwegian Institute of Public Health (FHI) proposed, with EEA incorporation pending. A footer notes that Chapter IV of the EHDS applies from 26 March 2029 to the three EU systems, and to Norway on EEA incorporation, and that a third-country applicant is eligible under Art. 91 EHDS only through a reciprocity implementing act or an authorized participant, none of which existed at publication. Four Nordic doors to registry data for a foreign sponsor, August 2026 Finland Findata, Act 552/2019 Denmark Forskerservice Sweden Socialstyrelsen, SCB Norway Helsedataservice Who may hold the permit Any applicant (§ 43); EUR 3,000 outside the EU/EEA, EUR 1,600 in Danish data-controller institutions only Research principal with a Swedish ethics approval (2003:460) Norwegian identifier required; foreign applicants await EHDS Where the analysis runs Certified environment in the EU/EEA (Kapseli; Regulation 1/2022) Remote research machine at SDS or Statistics DK; approved environments 2027 Copy delivered to the principal; SCB microdata stay in MONA Approved secure environments in Norway (Helsedataservice) Access from outside EU/EEA Only if the permit allows; treated as a Chapter V transfer Datatilsynet authorization for processing outside the GDPR, § 10(3) MONA use only in the EU/EEA or an adequacy country Not accommodated (case-handling guide, February 2026) Statutory clock 3 months, extendable by 3 (§ 47); 2025 median 49 days 90 days (+90) from 1 May 2027 (BEK 627, § 13); none fixed before About 3 months to a case officer, then 2 to 4 months (Mar 2026) 30 working days, 60 with linkage (§ 19 f); 3 to 6 months actual EHDS access body, Aug 2026 Findata proposed (draft bill, 5 Jun 2026); Act 552/2019 retained None designated; contact-point decree in force 1 Aug 2026 Socialstyrelsen preparing (assignments May 2025, Jun 2026) FHI proposed; EEA incorporation pending (consultation, Jun 2026) From 26 March 2029: Chapter IV EHDS overlays the three EU systems, and Norway on EEA incorporation Art. 91 EHDS: third-country applicant eligible only via reciprocity act or authorized participant; none at publication
Conditions on which a sponsor established outside the EU and EEA reaches individual-level registry data in Finland, Denmark, Sweden and Norway as of August 2026, and the state of each country's designation of a health data access body under the EHDS, whose secondary-use chapter applies from 26 March 2029 in the EU and in Norway on incorporation into the EEA Agreement.

5. What the EHDS Changes, and What It Leaves to National Law

The European Health Data Space, Regulation (EU) 2025/327, will place every one of those bodies inside a common architecture, and Insight 54 sets out that architecture and its runway. The secondary-use chapter applies from 26 March 2029, further data categories, among them genetic, genomic and clinical-trial data, from 26 March 2031, and third-country participation in the cross-border infrastructure from 26 March 2035. Each Member State must designate one or more health data access bodies, and one as coordinator where there are several.27Regulation (EU) 2025/327 (EHDS), Art. 105, Art. 55; Findata EHDS page (28 May 2026). Findata's own page on the Regulation said in May 2026 that no decision on national implementation had been taken and that it was itself the closest Finnish equivalent to such a body. The Nordic rooms survive the Regulation. It was drafted around them. The question is what the Regulation changes at the door.

Much of the Finnish design is simply written into Union law. Art. 68(4) EHDS gives the access body three months from a complete application, extendable by three, which is section 47 in different words. Art. 73 EHDS admits a health data user only through a secure processing environment restricted to the natural persons listed in the permit, and requires the access body to review any download so that only non-personal data leave, which is sections 20 and 52. Art. 62 EHDS ties fees to the cost of making the data available and lets Member States reduce them for certain users located in the Union, which preserves the asymmetry the Finnish fee decree already runs. Whether a flat surcharge for applicants established outside the Union survives the requirement in Art. 62(3) EHDS that fees be non-discriminatory is, though, a question the Regulation does not answer. Two provisions matter more for a foreign sponsor than the convergence does. Art. 74(1) EHDS makes the access body a processor acting on behalf of the health data user as controller for the processing under the permit inside the environment. The login from Boston is therefore the user's own processing under Union law as much as under Findata's conditions, and the Regulation codifies the Chapter V problem rather than solving it. And Art. 87 EHDS requires access bodies to store and process the data in the Union, with an exception for a third country covered by an adequacy decision, so that a Swiss environment becomes conceivable under the Regulation where Findata's Regulation 1/2022 excludes it, while Art. 90 EHDS lets Member States keep or add limits on international access under Art. 9(4) GDPR, so that the Finnish condition may outlast the text it sits beside.28EHDS (n 27), Art. 68(1)(d) and (4), Art. 73(1) and (2), Art. 62(1) and (3), Art. 74(1), Art. 87, Art. 90.

What widens is the purpose. Art. 53(1)(e) EHDS defines the research purpose to include development and innovation activities for products or services and the training, testing and evaluation of algorithms, which the Finnish section 37 confines to aggregated statistics and which the 2025 reform deliberately left for the EHDS bill. The Regulation then narrows the applicant. Under Art. 68(1)(d) EHDS the applicant must be qualified in relation to the intended purposes and have appropriate expertise, including professional qualifications in healthcare, care, public health or research, a criterion a commercial sponsor meets through the people it names rather than through its corporate form. And Art. 91 EHDS narrows the applicant's origin in a way the Finnish Act never has. An application from an applicant established in a third country is eligible only if that country is an authorized participant in the infrastructure or the Commission has determined by implementing act that it allows Union applicants access under conditions not more restrictive than the Regulation's. No such act existed for any third country as of publication, and the non-binding guideline prepared for access bodies under the TEHDAS2 joint action in April 2026 frames the test as functional equivalence of access conditions rather than identical structures.29EHDS (n 27), Art. 53(1)(e), Art. 91, Art. 73(5); Commission FAQ v1.1 (26 March 2026); TEHDAS2 guidelines (April and May 2026). Whether a country with no national health-data access regime to reciprocate with can pass that test is a question for the Commission, and a US applicant that can hold a Findata permit in 2026 may be an ineligible applicant under the Regulation's own route in 2029.

Finland's answer, at publication, was to keep both routes. The draft government proposal published for consultation on 5 June 2026 would make Findata the coordinating access body and the national contact point, with the university-hospital regions as regional access bodies, and it does not repeal the 2019 Act. The draft says the Act had only just been amended and retains more flexibility than the Regulation, in particular for researcher-initiated studies and international cooperation, third countries falling within the Regulation only from 2035. The bill is planned for the autumn of 2026, tied to the 2027 budget, with entry into force targeted for 1 January 2027.30Ministry of Social Affairs and Health, draft EHDS secondary-use bill (consultation 5 June 2026, VN/24423/2024). What the draft does not say is whether a national permit route can continue to admit an applicant from an unrecognized third country to the data categories of Art. 51 EHDS after 26 March 2029, or whether Art. 91 EHDS displaces it. The implementing acts that will define the secure environments themselves, due by 26 March 2027 under Art. 73(5) EHDS, had not been adopted.29 A permit granted under the Finnish Act in 2027 for a term running into the 2030s straddles that line with no text to say which side it falls on.

6. Strategic Considerations

The questions that decide whether a Nordic study is usable are not the ones a real-world-evidence plan is written to answer. Which entity applies, the US parent, an EU subsidiary, a European contract research organization or a Finnish academic partner under section 51c, determines whose employees may log in without a transfer, which fee applies, which Chapter V basis Findata will look for and who is controller inside the environment. The same choice determines whether any entity in the chain can give the FDA the undertaking about patient-level data that the 2023 guidance describes, and a sponsor that has already commissioned the study through a vendor has usually made that choice without knowing it was one. How the data utilization plan characterizes the purpose determines whether the answer comes back as rows under section 38 or as aggregates under section 37, and a plan drafted to satisfy the FDA's expectations about pre-specified analyses is not, without more, a plan drafted to survive the Finnish authority's reading of scientific research.

Behind those sit questions that depend on facts only the company holds and on events it cannot control. Whether the analysts who will actually open Kapseli are employees of the EU-established permit holder or of a US affiliate is a payroll fact with a transfer consequence. Whether the group's Data Privacy Framework certification remains a basis Findata will recognize through the term of the permit is a question the permit conditions answer by placing the risk on the holder. Whether the Danish contact point, the Swedish access body and the Norwegian institute will admit a foreign applicant when they exist, and on what terms, is unknown, and a protocol that assumes four countries' registers in one federated analysis assumes a legal vehicle that neither the Nordic proposal of December 2025 nor the Regulation supplies before 2029.

For a US-listed sponsor the feedback loop is concrete. A control arm the FDA cannot verify at patient level is a submission risk that surfaces late, after a year of analysis has been paid for. A data-access undertaking given to a regulator that the data holder's statute forbids the sponsor's vendor to perform is a contractual position a diligence team will read as a misrepresentation. And the withdrawal of an adequacy decision mid-permit is the kind of foreign regulatory event that an in-house team treats as a privacy matter and a Board treats as a disclosure question.

Whether a given program sits on the right side of each of these lines depends on where the applicant is established, who its analysts are, how its purpose is written, which regulator will read the result and when, and on legislation in four countries that was in draft, in consultation or in preparation at publication. Those are questions of fact, of drafting and of timing, and they require analysis tailored to the sponsor, the entities involved and the evidence the study is meant to produce.

REFERENCES

01
European Medicines Agency, Pharmacovigilance Risk Assessment Committee, 'PRAC concludes that eye condition NAION is a very rare side effect of semaglutide medicines' (6 June 2025), concluding that non-arteritic anterior ischemic optic neuropathy is a very rare side effect of semaglutide; Lægemiddelstyrelsen (Danish Medicines Agency), 'PRAC assesses the risk of NAION with semaglutide' (2025), recording that the signal was raised in the summer of 2024 by two Danish register-based studies drawing on Danish and Norwegian health registries. ↩
02
FDA, 'Considerations for the Use of Real-World Data and Real-World Evidence To Support Regulatory Decision-Making for Drug and Biological Products: Guidance for Industry' (August 2023), section III.B.3, stating that sponsors must ensure that they are able to submit patient-level data for any real-world data that have been analyzed as part of a clinical study included in a marketing application when required under 21 CFR 314.50 and 601.2; that where certain real-world data are owned and controlled by other entities, sponsors should have agreements in place with those entities to ensure that relevant patient-level data can be provided to FDA and that source data necessary to verify the real-world data are made available for inspection as applicable; and that, where an appropriate justification exists for why a sponsor cannot submit patient-level data through traditional channels, regulatory pathways exist for third parties to provide patient-level data to FDA to support a sponsor's marketing application. ↩
03
European Medicines Agency, 'Reflection paper on use of real-world data in non-interventional studies to generate real-world evidence' (EMA/99865/2025, final, published 3 April 2025); ICH M14, 'Guideline on general principles on planning, designing, analysing, and reporting of non-interventional studies that utilise real-world data for safety assessment of medicines' (EMA/CHMP/ICH/155061/2024, Step 5: final adoption by CHMP 18 September 2025, published 10 October 2025, date for coming into effect 18 March 2026). ↩
04
European Medicines Agency, Committee for Medicinal Products for Human Use, 'Concept paper on the development of a reflection paper on the use of external controls for evidence generation in regulatory decision-making' (EMA/125200/2026, adopted by CHMP 21 May 2026), recording that recent developments in data availability and statistical and pharmacoepidemiological methodology have led to an increase in proposals using external controls to support regulatory decision making, restating that randomized controlled trials are the gold standard of evidence to support causal conclusions on the benefits and risks of medicines, and planning a draft reflection paper for CHMP discussion in Q4 2026 with adoption expected in Q2 2027. ↩
05
European Medicines Agency, 'DARWIN EU data partners onboarded, year I, II, III and IV' (list dated 16 June 2026), naming among the onboarded partners the Danish Health Data Registries, the Consortium of the Finnish OMOP data partners (FinOMOP) with the Finnish Institute for Health and Welfare, the Cancer Registry of Norway at the Norwegian Institute of Public Health, the Norwegian Linked Health Registry at the University of Oslo, and the Swedish Medical Products Agency's population data-linkage node; European Medicines Agency, 'Real-world evidence framework to support EU regulatory decision-making, 4th report' (covering February 2025 to February 2026), recording 40 data partners in 18 European countries. ↩
06
Laki sosiaali- ja terveystietojen toissijaisesta käytöstä (552/2019) [Act on the Secondary Use of Health and Social Data], adopted 26 April 2019, in force 1 May 2019 (§ 59), as amended by laki 1159/2025 of 5 December 2025 (in force 1 May 2026, its § 2(4) from 1 January 2026); § 2(2) (the purposes of secondary use: statistics, scientific research, development and innovation, teaching, knowledge management, steering and supervision of social and health care by authorities, and planning and reporting tasks of authorities); § 2(4) (clinical trials, clinical investigations of devices and medical research under their own acts fall outside the Act); § 4 (the Social and Health Data Permit Authority, Findata, operates as an independent unit within the Finnish Institute for Health and Welfare, THL, under the steering of the Ministry of Social Affairs and Health); § 35 (register data may be processed for a secondary purpose only under a time-limited data permit granted by the controller or by Findata, or directly by statute); § 60 (transitional provisions: the permit and data-request functions applied from 1 January 2020). ↩
07
Act 552/2019 (n 6), § 38 (a data permit for scientific research and statistics may be granted in an individual case notwithstanding secrecy obligations; the freedom of scientific research is to be secured when a permit is considered), § 37 (for development and innovation activities carried out otherwise than as scientific research, Findata and the § 6 organizations may produce only aggregated statistical data on a data request, and only where the plan shows one of three listed aims), § 43 (general grounds for a data permit: the purpose must conform to the GDPR, the Data Protection Act and the applicable statutes and be most appropriately achievable with the data applied for; permits are granted for a fixed term and may be revoked), § 45 (decision on a data request). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1 (GDPR). HE 87/2025 vp, Hallituksen esitys eduskunnalle laiksi sosiaali- ja terveystietojen toissijaisesta käytöstä annetun lain muuttamisesta ja siihen liittyviksi laeiksi (11 September 2025), on § 37, recording that consultation responses had asked for individual-level data to be made available for development and innovation and that the proposal did not change the purposes in § 2 because they would be reviewed and harmonized in the government proposal implementing the EHDS Regulation. ↩
08
Helsingin hallinto-oikeus, decision of 17 February 2022 (Suomen Terveystalo Oy v Tietolupaviranomainen), final and not appealed further, as reported by Findata, 'Hallinto-oikeudelta ensimmäinen päätös toisiolain soveltamisesta' (30 March 2022): the applicant had sought a general permit to use patient data in real-world data research projects; Findata refused it as contrary to the Act; the court dismissed the appeal, holding that under the applicant's proposed procedure the case-by-case assessment would have been left to the applicant itself, which was contrary to the wording of the Act and the legislator's stated intention, and that the refusal did not restrict the constitutionally protected freedom of scientific research because it limited neither the research topic nor the methods. ↩
09
Findata, 'Issued permits' (public register of data permits and data-request decisions, version updated 30 July 2026), listing among permit holders Certara USA, Inc. (data permit issued 10 October 2024 for scientific research, valid until 1 December 2027, amended 9 April 2025 by a change of processors) and GlaxoSmithKline Research and Development Limited (data permit issued 17 December 2025, valid until 31 January 2035); Findata, 'Tietolupapäätöksen ehdot' [Terms of the data permit decision] (version updated 6 May 2026), condition 1.4 (a data permit is granted for the fixed term stated in the decision, which may be extended on application). The Act contains no statutory maximum duration. ↩
10
Sosiaali- ja terveysministeriön asetus Sosiaali- ja terveysalan tietolupaviranomaisen suoritteiden maksullisuudesta (1230/2025) of 15 December 2025, valid to 31 December 2026, as amended by asetus 329/2026 of 30 April 2026 (in force 1 May 2026), setting the fee for a data permit at EUR 1,600 for an applicant whose place of business is in Finland or another EU or EEA country where the processing time is seven hours or more, and at EUR 3,000 for an applicant whose place of business is in a country other than an EU or EEA country, with EUR 2,600 for a data-request decision and EUR 700 for a non-minor amendment; Act 552/2019 (n 6), § 49 (fees for permit and data-request decisions, which must be transparent) and § 50 (charges for extraction, linkage, pre-processing, pseudonymization and the secure environment); Findata, 'Hinnasto' (price list valid 1 January to 31 December 2026, updated 12 May 2026), including the monthly Kapseli charges and the note that, for decisions taken after 1 May 2026, controllers invoice their extraction costs directly to the permit holder. ↩
11
Act 552/2019 (n 6), § 47 (a decision on a data-permit application is to be given without delay and at the latest within three months of the complete application reaching the organization, extendable by at most three months for weighty reasons, the applicant being informed), § 48 (controllers deliver permitted data within 30 working days of the decision; Findata or the compiler delivers to the permit holder within 60 working days of the permit, extendable for weighty reasons), § 52 (results produced in a secure operating environment are anonymized by the permit holder before they leave it; Findata verifies the anonymization on the basis of a risk-based assessment, the wording introduced with effect from 1 May 2026, and may itself produce the anonymized results on request); Findata, 'Annual report 2025' (published March 2026): 370 applications received, of which 37 % data-permit applications, 57 % amendments and 6 % data requests; 340 decisions, 91 % positive; median processing time for data permits 49 days, down from 82 days in 2024, with 85 % decided within three months; public-sector applicants 74 % and private-sector applicants 18 % (67 % and 26 % in 2024); 162 active Kapseli environments and 937 users at year end; 1,322 anonymity checks of Kapseli outputs, 14 % of them raising issues; controllers' 30-working-day deliveries on time in 80 % of cases and Findata's own delivery deadline met in 77 %. ↩
12
Act 552/2019 (n 6), § 20 (data released under the Act are processed in a secure operating environment; Findata provides such a service alone or with other authorities, and other organizations may also provide one; the environment must be accessible from different places), §§ 24 to 26 (Findata prescribes the requirements for other providers' environments, which must hold a certificate from an information-security assessment body valid for at most five years), § 51b (outside the § 51c and § 51d exceptions, a permitted dataset is released for processing only into a § 20 environment unless it has been formed into aggregated statistics); Findata, Regulation 1/2022, 'Requirements for other service providers' secure operating environments' (THL/214/14.00.07/2022, issued and effective 19 January 2022, applied to individual-level analysis from 1 May 2022), Annex 1, section 3.1.2, points 1 and 2 (the secure operating environment must be physically located in the EU/EEA and its service provider must be an organization registered in the EU/EEA); Findata, 'Kapseli' (service description, undated: remote use through a web browser, strong two-factor authentication, a static organizational IP address required); HE 87/2025 vp (n 7), recording ten certified environments under § 20, all located in Finland. ↩
13
Act 552/2019 (n 6), as amended by laki 1159/2025 (n 6): § 6a (an application concerning one § 6 organization's data goes to that organization; an application concerning several may go to Findata, which then decides for all, or to each organization separately; Findata always decides on Kanta data, on private providers' data and on its own ready-made datasets), § 6b (the same allocation for data requests), § 6c (a § 6 organization may transfer its permit competence to Findata), § 51c (Findata may, for a special reason, grant a permit under which the dataset is released into a secure environment other than a § 20 environment, if the risks to national security and to the dataset are minor, one participant in the project conducts research in a Finnish research organization, and the level of data protection and information security is sufficient; the applicant must justify why a § 20 environment cannot be used), § 51d (anonymized release outside a secure environment for a special reason where the risks are minor and reliable anonymization is possible); StVM 15/2025 vp, Sosiaali- ja terveysvaliokunnan mietintö (5 November 2025), describing § 51c as a temporary solution for enabling international research cooperation before the EHDS Regulation applies, and noting that the Regulation will create common European requirements for secondary-use environments applying from 2029. ↩
14
Findata, 'Lue Findatan lausunto toisiolain uudistamisesta: hajautettu lupamalli toisi uusia haasteita' (statement in the consultation on the reform, 14 April 2025), warning that the proposed exception permit to environments abroad would make it possible for data to move outside the scope of Finnish legislation and supervision. ↩
15
Findata, Terms of the data permit decision (n 9), condition 1.5 (personal data may be processed under the permit only within the EU/EEA unless the decision states otherwise; processing outside the EU/EEA requires the conditions in section 6 to be met before any transfer begins), condition 4.1 (the dataset may be processed only in Findata's secure operating environment unless the decision states otherwise), condition 6.1 (data obtained under the permit may not be processed, nor a technical connection opened, from outside the EU/EEA unless the decision so permits), condition 6.2 (where the decision permits processing outside the EU/EEA, the permit holder as controller is responsible for a transfer basis under Chapter V of the GDPR, including any necessary and sufficient supplementary measures; Findata verifies the existence of a basis in the permit assessment but does not assess the lawfulness of the transfer further), and condition 7.2.8 (extension of processing to outside the EU/EEA is an amendment requiring a new decision). ↩
16
Findata, 'Data permits' (guidance page, version of 15 June 2026), stating that the processing of personal data from abroad is by default considered a transfer of personal data even if the data is in a remote access environment, that the affiliation of the data processor with the data controller may affect the assessment, and that where the processor is employed by a data controller located within the EU/EEA processing from abroad is not considered a transfer, with the worked example of an employee of an EU-based controller processing data in Kapseli from the United States and staff of other organizations being unable to do so without a Chapter V basis; the same page lists the accepted bases as an adequacy decision under Art. 45 GDPR (the primary basis), standard contractual clauses under Art. 46(2) GDPR, accepted only after the applicant or permit holder has submitted the signed clauses to Findata, binding corporate rules under Art. 47 GDPR and the Art. 49 GDPR derogations in exceptional cases only; Findata, 'Expanding the processing of personal data outside the EU and EEA' (FAQ), to the same effect. GDPR (n 7), Chapter V. ↩
17
Bundesgesetz über den Datenschutz (Datenschutzgesetz, DSG) vom 25. September 2020 (SR 235.1), in force 1 September 2023, Art. 3 Abs. 1 (the Act applies to matters that have an effect in Switzerland, even if they are initiated abroad); Commission Decision 2000/518/EC of 26 July 2000 pursuant to Directive 95/46/EC on the adequate protection of personal data provided in Switzerland [2000] OJ L215/1, maintained in the Commission's report of 15 January 2024 on the first review of the functioning of the adequacy decisions adopted pursuant to Directive 95/46/EC (COM(2024) 7 final). ↩
18
Sundhedsdatastyrelsen, 'Forskerservice: Lovgivning og tilladelser' and 'Forskermaskinen' (service pages, undated), stating that Forskerservice discloses data only to Danish data-controller institutions, that individual-level data are as a rule made available on research machines at Sundhedsdatastyrelsen or Statistics Denmark accessed remotely with two-factor authentication from the authorized research environment, and that individual-level data may not be sent home without a separate application; Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordning om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sådanne oplysninger (databeskyttelsesloven), § 10(1) (special-category data may be processed for the sole purpose of statistical or scientific studies of significant importance to society), § 10(2) (no subsequent processing for other purposes) and § 10(3) (disclosure to a third party only with the supervisory authority's prior authorization where the disclosure is for processing outside the territorial scope of the GDPR, relates to biological material or is for publication); Datatilsynet, 'Forskning og statistik' (guidance, undated), naming processing in the United States as an example of the first case; Danmarks Statistik, 'Autorisering' (conditions for authorizing research environments, undated) and 'Priser for forskningsservice 2026'. ↩
19
Lov nr. 717 af 20. juni 2025 om ændring af sundhedsloven, lov om apoteksvirksomhed og lov om videnskabsetisk behandling af sundhedsvidenskabelige forskningsprojekter og sundhedsdatavidenskabelige forskningsprojekter (bill L 182 of 27 March 2025), § 1 nr. 3, inserting §§ 48a to 48e into the sundhedsloven: § 48a (Ét Kontaktpunkt is established as a single entry to health data for research and innovation; the minister lays down rules on its operation, tasks, data responsibility and supervision), § 48b (requests for the disclosure of electronic health data for statistical or scientific studies of significant societal importance are submitted to and processed by the contact point; a request concerning a single controller may go directly to it), § 48c (processing on behalf of the regional councils), § 48d (controllers must share unless this causes additional work significantly exceeding the recipient's interest) and § 48e (processing for listed purposes); § 4(1) (in force 1 July 2025) and § 4(2) (the minister determines the entry into force of § 1 nr. 3 and 4 and § 2). Lov nr. 1758 af 29. december 2025 om Digital Sundhed Danmark, § 6 (Digital Sundhed Danmark performs the role of Ét Kontaktpunkt and ensures a single entry to health data for research and innovation), § 34 (a preparatory Digital Sundhed Danmark established on 1 January 2026 to coordinate the transfer of tasks, assets, rights, obligations and staff from MedCom, sundhed.dk, Sundhedsdatastyrelsen and one or more regions to the new body when it is finally established) and § 36 (in force 1 January 2026); Sundhedsdatastyrelsen, 'Digital Sundhed Danmark i gang' (9 January 2026), recording final establishment scheduled for 2027. Bekendtgørelse nr. 627 af 30. juni 2026 om Ét Kontaktpunkt (Sundheds- og Kirkeministeriet, issued under § 48a(2) and § 48b(3) sundhedsloven as amended by lov nr. 717/2025), § 1(2) (Digital Sundhed Danmark operates the contact point, which forms part of the preparatory body under § 34 of the 2025 Act), § 8 (a national analysis platform; the contact point may approve processing environments and sets their technical requirements), § 10 (duty to submit applications through the contact point), § 13 (decision within 90 days of a duly completed application, extendable in special cases by a further 90 days), § 14 (processing environments must be approved by the contact point before they are made available) and § 31 (in force 1 August 2026, save that § 6 and §§ 11 to 13 apply from 1 May 2027 and § 10 from 1 August 2027); Sundhedsdatastyrelsen, 'European Health Data Space' (page, undated), stating that large parts of the concrete implementation are to be settled through further legislation in the coming years and naming no access body. ↩
20
Socialstyrelsen, 'Data för forskning' (service pages 'Sekretessprövning', 'Tid och kostnader' (updated 19 March 2026), 'Förbered beställning' and 'När du skickat in din beställning', read as of publication), stating that the registers are covered by absolute secrecy under Offentlighets- och sekretesslag (2009:400), chapter 24, § 8; that an approved application under Lag (2003:460) om etikprövning av forskning som avser människor is the first formal step to obtaining data; that data are delivered by registered letter to the recipient at the research principal; that the wait for a case officer was about three months, followed by two to four months of handling and four to six weeks from approval to delivery; and that the fees were SEK 1,650 per hour of handling with a basic charge of SEK 12,800, most orders costing SEK 30,000 to 70,000. ↩
21
Statistiska centralbyrån, 'MONA, användarvillkor' (user terms, updated 13 April 2023) and 'Vad är MONA' (undated): the user undertakes to use MONA only in a country within the EU or EEA or in a third country approved by the European Commission for transfers, not to use a network connection routing traffic through third countries not approved for transfers, not to use MONA in public places, and not to copy or export microdata from MONA to another computer or storage medium; results are downloaded while microdata remain in MONA. ↩
22
Regeringen, 'Uppdrag till Socialstyrelsen att förbereda för att bli ansvarigt organ för tillgång till hälsodata enligt EHDS' (S2025/00977, 20 May 2025); SOU 2026:6, En nationell digital infrastruktur i hälso- och sjukvården (January 2026), proposing Socialstyrelsen as the body for access to health data for secondary use under the EHDS Regulation, E-hälsomyndigheten as digital health authority and Statistics Sweden as the provider of secure processing environments; Regeringen, press release of 26 June 2026 on new assignments to three authorities, under which Socialstyrelsen continues to prepare the access-body function and reports by 30 April 2027, with Inspektionen för vård och omsorg on supervision and E-hälsomyndigheten on infrastructure; Socialstyrelsen, 'Socialstyrelsen förbereder för rollen som HDAB' (6 February 2026). ↩
23
Forskrift 11. januar 2023 nr. 48 om nasjonal løsning for tilgjengeliggjøring av helsedata, under which Helsedataservice holds decision authority from 15 March 2023 for eleven national registers, including the Cancer Registry, the Cause of Death Registry, the Medical Birth Registry, the Norwegian Patient Registry, the Norwegian Prescription Registry and the Municipal Patient and User Registry, on one application and one decision regardless of the number of sources, with the regional committees for medical and health research ethics retaining exemption decisions in some cases; Lov 20. juni 2014 nr. 43 om helseregistre og behandling av helseopplysninger (helseregisterloven), § 19 f (data are to be made available within 30 working days of a complete application, or 60 working days where compilation from several registers is required), as quoted by Helsedataservice, 'Behandlingstid' (updated 27 November 2025), which estimates three to six months from complete application to delivery; Helsedataservice, guidance on personally identifiable data (read in its 2026 version), naming approved secure analysis environments such as TSD, HUNT Cloud and SAFE; Helsedataservice, notice that the health-data department moved from the Directorate of e-Health to the Norwegian Institute of Public Health on 1 January 2024. ↩
24
Helsedataservice, 'Saksbehandlingsveileder' (version 2, updated 9 February 2026), recording that as of December 2024 the arrangements did not allow applications from non-Norwegian actors to be received because the system requires a Norwegian identifier of an applicant, that pending the EHDS Regulation Helsedataservice would defer any applications from abroad, and that requests by pharmaceutical companies or insurers for data for marketing or product development fall outside the purpose of § 19 d helseregisterloven; Helse- og omsorgsdepartementet, 'Høring: forskrift om nasjonal løsning for tilgjengeliggjøring av helsedata' (6 October 2022), recording that work on the common data platform was paused in December 2021 over legal challenges with the use of a public cloud solution following the Schrems II judgment and that the platform was replaced by solutions based on existing data and analysis services and distributed data; Digi.no, 'Avlyser Helseanalyseplattformen' (15 February 2023), reporting the ministry's cancellation of the platform; Helsedirektoratet, 'EHDS konsekvensvurdering, gapanalyse per 11. april 2025' (19 May 2025), on secondary use. ↩
25
Stortinget, EU/EØS-nytt, 'Det europeiske helsedataområdet: høring av gjennomføringsregelverk' (16 April 2026), recording that the Regulation is marked EEA-relevant and is under consideration for incorporation into the EEA Agreement; Helse- og omsorgsdepartementet, 'Høringsnotat: forslag til lov om det europeiske helsedataområdet (EHDS)' (published 8 June 2026, consultation deadline 28 September 2026), proposing the Norwegian Institute of Public Health as coordinating health data access body and national contact point for secondary use, the Directorate of Health as digital health authority, a fee regime covering all costs and a strict regime for third-country access, and recording that incorporation into the EEA Agreement requires the consent of the Storting. ↩
26
Sitra, 'Nordic model for collaboration on the secondary use of health data: a proposal' (16 December 2025), proposing consolidation and coordination of existing Nordic structures rather than new institutions; Sitra, 'VALO: Value from Nordic health data' (project description), describing the VALO project (February 2024 to October 2025) and VALO2 (April 2025 to October 2026), funded by the Nordic Council of Ministers, as establishing common Nordic principles for implementing the EHDS Regulation and testing cross-border federated analysis, with Denmark, Finland, Iceland, Norway and Sweden as core participants. ↩
27
Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (EHDS) [2025] OJ L 2025/327, Art. 105 (entry into force 25 March 2025; general application 26 March 2027; Chapter IV on secondary use from 26 March 2029, save for the provisions applying from 26 March 2027; Art. 51(1), points (b), (f), (g), (m) and (p) from 26 March 2031; Art. 75(5) from 26 March 2035); Art. 55(1) (Member States designate one or more health data access bodies and, where several, one coordinator); Findata, 'EHDS' (page updated 28 May 2026), stating that no decisions had yet been made regarding national implementation and that the closest Finnish equivalent to a health data access body was Findata. ↩
28
EHDS (n 27), Art. 68(1)(d) (the applicant must be qualified in relation to the intended purposes and have appropriate expertise, including professional qualifications in the areas of healthcare, care, public health or research), Art. 68(4) (a data permit is issued or refused within three months of a complete application, extendable by three months), Art. 73(1) (access only through a secure processing environment restricted to the natural persons listed in the permit) and Art. 73(2) (the access body reviews any download request so that only non-personal data, including anonymized statistical data, leave the environment), Art. 62(1) (fees in proportion to the cost of making the data available; Member States may set reduced fees for certain types of health data users located in the Union) and Art. 62(3) (fees transparent and non-discriminatory), Art. 74(1) (the access body is controller for its own tasks but processor on behalf of the health data user as controller for the processing under a data permit in the secure processing environment), Art. 87(1) (access bodies store and process personal electronic health data in the Union when performing their secondary-use tasks) and Art. 87(2) (by way of exception, in a third country covered by an adequacy decision under Art. 45 GDPR), Art. 90 (transfers to third countries under Chapter V GDPR; Member States may maintain or introduce further conditions and limitations on international access under Art. 9(4) GDPR). ↩
29
EHDS (n 27), Art. 53(1)(e) (scientific research related to health or care sectors that contributes to public health or health technology assessments, or ensures high levels of quality and safety of healthcare, of medicinal products or of medical devices, with the aim of benefiting end-users, including development and innovation activities for products or services and the training, testing and evaluation of algorithms), Art. 91(1) (an application from a health data applicant established in a third country is eligible if that country is an authorized participant under Art. 75(5) or allows Union applicants access under conditions not more restrictive than the Regulation's, as determined by a Commission implementing act under Art. 91(2)), Art. 73(5) (implementing acts on secure processing environments by 26 March 2027); European Commission, DG SANTE, 'Frequently Asked Questions on the European Health Data Space' (version 1.1, 26 March 2026), listing the implementing acts due by 26 March 2027 and recording third-country participation in HealthData@EU from 26 March 2035; as of publication no implementing act under Art. 91(2) had been adopted for any third country and none under Art. 73(5); TEHDAS2 Joint Action, 'Guideline for health data access bodies on international and third country access and transfer of electronic health data' (milestone M4.3, accepted 27 April 2026), describing the two Art. 91 pathways, framing the reciprocity test as functional equivalence of access conditions rather than identical regulatory structures, and recalling that transfers of personal electronic health data remain governed by Chapter V GDPR; TEHDAS2 Joint Action, 'Guideline for health data access bodies on the procedures and formats for data access' (deliverable D6.3, version 2.0, released 27 May 2026), led by Findata; both non-binding. ↩
30
Sosiaali- ja terveysministeriö, 'Luonnos hallituksen esitykseksi eduskunnalle eurooppalaista terveystietoaluetta koskevan Euroopan parlamentin ja neuvoston asetuksen sähköisten terveystietojen toissijaista käyttöä ja asetuksen seuraamuksia täydentäväksi sääntelyksi' (draft government proposal, project STM114:00/2024, published for consultation on 5 June 2026 by request VN/24423/2024 with statements requested by 31 July 2026), proposing that Findata act as health data access body, as the coordinator under Art. 55 EHDS and as the national contact point for secondary use, with the wellbeing services counties hosting university hospitals and the HUS Group as regional access bodies; recording that the Act 552/2019 is not proposed to be repealed at this stage because it had only just been amended, retains more flexibility than the Regulation, in particular for researcher-initiated studies and international cooperation (third countries falling within the Regulation only from 2035), and because there was no experience yet of applying the Regulation; and stating that the proposed acts are intended to enter into force on 1 January 2027, the proposal being connected to the 2027 budget; Findata, statement of 15 July 2026 supporting the coordinating role subject to adequate resources. ↩

RELATED INDUSTRIES

Biotech & Pharma ICT & Digital Health

RELATED SERVICE

Health-data & research-data law

RELATED INSIGHTS

Biotech

The European Health Data Space: A Three-Year Runway for US Biotech Secondary-Use Access

15 min read ICT & AI

Transatlantic Data Transfers in 2026: The DPF After the Supreme Court Challenge

12 min read Pharma

Denmark's 14-Day Clinical Trial Approval: The Nordic Race and the Clocks That Keep Running

21 min read

Where a real-world-evidence program depends on registry data that a Nordic authority admits a sponsor to on its own terms, the choice of applicant, environment and purpose is a matter for tailored analysis.

Get in Touch