Technical implementation of the Population Information System query interface

Query interfaces between a customer system and the Population Information System are identified and protected mainly using server certificates. Data transfer between the Population Information System query interface and the Information System takes place over the Internet, with HTTPS/TLS protection. TLS 1.2 or newer must be used to protect data communications.

Organisations must use the Suomi.fi Data Exchange Layer provided by the Digital and Population Data Services Agency to establish a connection. The obligation is laid down in the Act on Central Government’s Joint e-Service Support Services.  More information on the details of introducing the Data Exchange Layer is available on the Suomi.fi website.

The Population Information System information contained in the product (response message) to be granted to your organisation is agreed upon in connection with the data permit application process. In the response message, each customer organisation will only receive information about the object of the search (such as a person, apartment, building or property) to which it is entitled.

The Digital and Population Data Services Agency has ready-made products with different content for different purposes. If your organisation cannot find a product that suits your information needs, a new product can be tailored for you. You can find a list of the personal data currently available through the interface and their format in the personal data catalogue (XML Schema format) on this page.

An overview of the technical operations of the interface, such as different types of query and response messages, are available on this page in the API Technical Description document (in WSDL format).

As a rule, information is disclosed only by means of a unique identifier for the object of the search, such as a personal identification number, an electronic service identifier or a building identifier. Information can also be retrieved using other than unique search criteria, if required by law by the duties of the customer organisation.

The organisation must manage the logging appropriately. The organisation that has been granted rights to the application query is obliged to keep the log data for five (5) years. The organisation must be able to explain afterwards who carried out the query (persona-specific), what information was retrieved and when the query was made (dd.mm.yyyy, time).

The permit holder is also responsible for the security of the Information System and the legality of the processing of each piece of information retrieved and that the queries comply with the terms and conditions of the data permit and the purpose of the granted products.

Note that you are not allowed to use the Population Information System query interface to update your entire customer register or other registers in your information system. If you need to update your registers, check the following links for the public sector and the private sector.

The Population Information System query interface service description document provides a more detailed description of the service and the obligations of the customer organisation.