Operating secure environment registration

A secondary-use operating environment may not be deployed unless it is entered in the Astori register maintained by Finnish Supervisory Agency. The service provider of the operating environment is responsible for registration and for ensuring that the data in the register are up to date. Datasets requiring a data permit can only be delivered to secondary-use operating environments which conform to the requirements set and which are entered in the Astori register.

The service provider is responsible for registering the operating environment 

Service provider refers to an operator that offers its customers services related to a secure operating environment. If the operating environment consists of an entity of several service providers, one service provider with a business ID or VAT number representing the entity must be entered in the Astori register. Service providers are responsible for their own contractual and liability relationships. The Finnish Supervisory Agency manages guidance and supervision activities with the service provider reported to the register. The service provider listed in the register will list a contact person in connection with the registration.

Registration process

  1. Submitting a registration notification

    The service provider shall notify the register of the operating environment it offers when the operating environment has been granted a certificate by an information security inspection body. 

    Submit a registration notification  

    Please note that certificates submitted by the information security inspection body to the Finnish Supervisory Agency for information do not initiate a registration matter.

  2. Processing of a registration notification

    The Finnish Supervisory Agency will initiate processing once the operating environment’s service provider submits a registration notification.

    The Finnish Supervisory Agency will use the information provided in the registration to ensure that the operating environment meets the requirements set for it and will request additional information if necessary.

    The Finnish Supervisory Agency will add the operating environment to the public Astori register and notify the operating environment’s service provider of this.

  3. Maintaining register data

    Data protection and information security requirements must be met throughout the production use of the operating environment. The operating environment’s service provider is responsible for notifying the Finnish Supervisory Agency of any material changes concerning the operating environment, the service provider and the certificate granted by the information security inspection body in a timely manner.

    Submit Change to register data

    Essential changes to be reported to the Finnish Supervisory Agency include:

    • change to the name of the operating environment (the name must be unique and in the form it is offered to the customer)
    • changes related to the service provider (name, business ID or VAT number, change of contact person)
    • changes to the information security inspection body’s certificate.

Registration fees

Registration under the Act on the Secondary Use of Health and Social Data is subject to a fee.
Charges are based on an annual decree on fees paid to the Finnish Supervisory Agency.

Fees for registrations carried out under the Act on the Secondary Use of Health and Social Data:

  • Registration of a certificate issued by an information security inspection body costs EUR 1,200. 
  • Registration of changes to a certificate issued by an information security inspection body costs EUR 750. 
  • Registration of cancellation or rejection of a certificate issued by an information security inspection body costs EUR 500. 
  • Registration of an improvement notice or restriction issued by an information security inspection body costs EUR 300.

Please note that edits to register data are subject to a fee when registering certificate changes, cancellations and rejections of an information security inspection body as well as improvement notices and restrictions. Other changes to register data are free of charge. 

Contact information

Customer service for health and social services

Ask our customer service by using service form
By e-mail: [email protected]
By calling: +358 295 256 930 (Monday–Friday 9:00–15:00)​