Privacy notice for a DNA test requested by a private individual
Privacy notice for data subjects (27.1.2026)
The Finnish Institute for Health and Welfare (THL) processes personal data on the basis of given consent, when you are a participant in a DNA test that has neither been requested or ordered by an authority to fulfil its legal obligations. When processing personal data, THL complies with the valid data protection legislation and ensures an appropriate level of information security.
This notice contains detailed information about how THL processes your personal data.
1. Controller
THL determines and is responsible for the processing of personal data for the purpose described in this notice. This means that THL is the data controller for this information.
Our contact information:
National Institute for Health and Welfare (THL)
PO Box 30
FI-00271 Helsinki, Finland
telephone: +358 29 524 6000
The contact person in matters regarding the processing of personal data described in this notice is:
Marjo Avela, Chief Specialist, Team Manager
telephone: +358 29 524 8723
Email: firstname.lastname(at)thl.fi
Email of THL’s data protection officer is: tietosuoja(om)thl.fi.
2. The purpose of processing personal data
We process your personal data when you participate in the DNA test that has not been commissioned or ordered by an authority to fulfil its legal obligations.
3. Legal basic of processing personal data
The processing of personal data is always based on valid legislation. THL’s tasks are laid down in the Act on the National Institute for Health and Welfare (31 October 2008/668).
The legal basis of processing personal data for the purposes covered by this notice is: Performance of a task carried out in public interest (Article 6(1)(e) and Article 9(2)(g) and (j) of the General Data Protection Regulation (with regard to archiving)).
4. What personal data are processed?
The person requesting the test or the person tested provides THL with the names and personal identity codes or birth dates, if a personal identity code is not available, of the persons tested. In addition, THL receives sample collection information about the samples to be studied and information about how the person was identified at the time of sample collection. In order for testing to be carried out consent is required from test subjects, the party requesting the testing, the parents/guardians/other legal guardians of subjects under the age of 15, as well as the heirs of a deceased subject. The letter of consent contains personal data and contact information, the place and time, a signature, the role of the person giving consent in the study in question, as well as information of the test type that is to be performed.
A DNA profile is produced for each person tested. DNA profiles are used to determine the kinship between persons tested in the same test or the identity of the tested persons. In some cases the DNA profile is the only test result.
5. What sources of personal data are used?
Information is received from the request and sample documents concerning the DNA testing, from the test consent document and any other documents that may be submitted.
Information about the guardians/parents of children under 15 years is retrieved from the Population Information System. If information about the guardians/parents is not available in the Population Information System, other reliable documentation must be submitted.
6. Transfer or disclosure of personal data
Personal data, test results (including DNA profiles of the test subjects) and the name and address of the person requesting the study are provided in the report of test results.
The person who has requested the test, the subjects tested and the parent/guardian who has consented to the test on behalf of a subject who is under the age of 15 will receive the report of test results.
The information is not disclosed outside THL, unless the requesting party is legally entitled to obtain the information.
7. Transfer and disclosure of personal data to non-EU/EEA countries
Personal data are not transferred to non-EU/EEA countries.
8. Profiling and automated decision-making
THL does not proceed to automated decision-making based on personal profiling.
9. Storage of personal data
The storage periods of personal data are determined in compliance with the Archives Act (831/1994) and THL’s information management plan. Paternity test material that includes personal data, including identifying data, is permanently archived after processing (Decision by National Archives AL/11909/07.01.01.03.01/2012) in the facilities reserved for the Forensic Genetics Team. The National Archives of Finland has also ordered the data in the laboratory information system of Forensic Genetics of the Finnish Institute for Health and Welfare to be kept in permanent storage in accordance with sections 8 and 11 of the Archives Act (831/1994). The data in the information system that is to be stored permanently will be stored in digital format as of 1 March 2010 (KA/22170/07.01.01.03.01/2018). Test samples are discarded two years after the completion of the test. The process corresponds to statutory forensic genetic parenthood tests (Act on Forensic Genetic Parenthood Tests 378/2005).
10. What rights do you have?
Under data protection legislation, you have certain rights. By exercising these rights, you can ensure that the protection of your privacy, which is one of your fundamental rights, is realised. If you would like to exercise your rights, contact THL’s registry office (kirjaamo(at)thl.fi).
In certain cases and situations, your rights may be restricted, for example due to one of THL’s statutory obligations or if the processing takes place for scientific research or for statistical or archiving purposes. If your rights are restricted, THL will provide for appropriate and necessary safeguards required under the data protection legislation.
Right to withdraw consent
We always request a consent for the test, and the requested consent serves as an additional safeguard for the processing of personal data. However, the consent given can be withdrawn only until the test has begun.
Withdrawal of the consent must be communicated to the investigating authority without delay (029 524 8900, vanhemmuustutkimus(at)thl.fi).
Right to access data concerning you
You have the right to know if THL is processing personal data concerning you. You also have the right to know which personal data concerning you are processed and how. Additionally, you have the right to receive a copy of the personal data concerning you, provided that giving you this copy will not have adverse effects on the rights and freedoms of others and that THL does not have legal grounds for refusing to disclose the data.
Right to rectification of data
As a point of departure, you have a right to have inaccurate or incorrect data rectified.
Right to erasure of your data
You may have the right to have your data deleted from THL’s register. If the processing of your data is based on the performance of THL’s statutory tasks or there is some other legal obligation associated with preserving it, your right to have the data deleted probably is restricted.
Right to restrict processin
You may have a right to restrict the processing of your personal data in cases laid down in the law. The right to restrict processing may exist, for instance, if you believe that the personal data concerning you are inaccurate, they are being processed unlawfully, or you have opposed the processing of your data. In this case, we may only process your personal data by your consent, where necessary for the establishment, exercise or defence of legal claims, or where it is in general interest or essential to protect another person’s rights.
Right to oppose the processing of personal data
You may have the right to oppose the processing of your personal data in cases laid down in the law. The right to oppose may exist, for example, if the processing is associated with automated decision-making based on profiling or if the data are used for direct marketing purposes.
Right to lodge a complaint with the supervisory authority
You have the right to request the Data Protection Ombudsman to assess the lawfulness of THL's practices.
Contact details:
Office of the Data Protection Ombudsman
Visiting address: Lintulahdenkuja 4, 00530 Helsinki
Postal address: P.O. Box 800, 00531 Helsinki, Finland
E-mail: tietosuoja(at)om.fi
Switchboard: +358 (0)29 566 6700