Background, solutions and data security
Kela’s strategic development programme, Eepos, will reform Kela’s benefit administration and customer services to better meet the requirements of a digital operating environment.
Read on for a more detailed account of how the Eepos programme will be implemented, what technological solutions and partner organisations Kela has chosen for the programme and how Kela will ensure the continuity and data security of its services in the future.
Kela strives to act as a pioneer in customer-oriented services and to secure its position as a prominent actor in the social security service network in the future, too. This goal is put into practice with the aid of a strategic development programme called Eepos.
Through Eepos, Kela will reform its benefit administration and customer services and the related operating methods and systems in stages to ensure that they meet the requirements of the digital first movement. Work on the reforms is projected to continue until the 2030s.
The goal of Kela’s reforms is to deepen our customer-oriented approach and to ensure a better customer experience across all our services. For our customers, this means more streamlined services that can be accessed with less effort and faster processing times for benefit applications.
Once completed, the strategic development programme will improve Kela’s operations in many ways:
- Information will flow better and be easier to access. Technical solutions implemented at Kela will enable better data mobility, and that, in turn, will improve the efficiency of public services within the bounds of the relevant legislation.
- Kela’s core functions can be executed securely in a world of fewer economic resources and qualified employees. New solutions will streamline and automate the work done at Kela. Our ability to detect benefit fraud will be improved.
- Kela can better meet the requirements of an increasingly digitalised operating environment and enhanced productivity. The innovative systems that Eepos will deliver will create efficiencies and savings at the stage when the old systems can be replaced.
- Kela will be able to implement social security more effectively in all circumstances and situations in the coming decades. Kela’s ability to offer new services will be significantly improved. With new benefit administration systems that permit adaptation to evolving needs, Kela will be in a position to implement legislative amendments more quickly than before.
In order to ensure the success of our extensive and complex reform, we decided to use a tendering process to acquire an off-the-shelf solution with turnkey implementation from a supplier with experience and proven success in the implementation of similar reforms in the field of social security.
The reform Kela plans to implement is exceptional in both its nature and scope. Kela’s field of operation is unique in Finland. There is limited availability on the Finnish market for off-the-shelf solutions and expertise in this field. However, there are several international solutions available.
Kela has signed a contract with a foreign partner organisation. A significant number of the experts retained by our partner organisation come from other countries, but Finnish experts may also be appointed to the project. We are confident this will happen to some extent.
Going forward, Kela will develop and improve its systems and services in cooperation with its chosen partner organisations. During this collaboration, our focus will be on our core competence, which is our in-depth knowledge of Finnish social security and legislation and their implementation. Meanwhile, our partner organisations will contribute their expertise and technologies.
Kela attempted to implement a large-scale reform in the previous decade, but it was ultimately unsuccessful. In the early 2020s, we carried out a technology pilot as part of the implementation of the family leave reform, attempting once more to implement a reform primarily with the aid of in-house development work.
During the pilot, we learned that it would have taken us approximately 15–30 years to independently develop the reform Kela required at that point and that the costs involved would have been many times higher than those of the recent procurement. International case studies also supported our conclusions. The new overall system Kela requires is immense in scale. The reason for this is the large number of different benefits and the volume of customer data we process as well as the number of different functions their processing requires.
We must maintain extremely strict data security due to the nature of our operations. The technologies we have chosen will enable us to implement cost-effective solutions that meet future needs. In order for our new platform to meet the requirements imposed by our operations, some adjustments will have to be made in any case and some functions must be tailored to Kela’s needs. The agreement we have signed with our partner organisation also enables us to supplement the procurement with new technical solutions.
Kela’s duty is to ensure that the Finnish social security system functions correctly and that it is customer-oriented and implemented safely and securely. We compared different options based on these criteria and chose the technical solution that best meets them.
We use cloud services responsibly, safely and securely, and these factors were given significant weight when we made our choice. Decades of effort have been invested into the development and security of the solution we chose.
During the procurement process, various potential emergency conditions that may affect the availability of different technologies were also taken into account. The chosen service provider has undertaken to develop and produce solutions that enable Kela to carry out its core functions even during significant disturbances in the status quo.
If Kela, Finnish public administration entities, industry operators or the EU were to be prohibited from using solutions produced in other countries, it would mean that no service based on information technology or telecommunications (network or mobile connection) would work because they make use of the same technologies.
Kela will integrate contingency plans for different emergency conditions into the system to ensure that Kela can provide at least the minimum level of social security services to citizens in all circumstances.
Kela already uses foreign technologies in existing benefit administration systems.
Kela’s main duty is to ensure that individuals who live in Finland have easy and secure access to benefits and services. We are transitioning to cloud services with a specific focus on ensuring cybersecurity, operational security and preparedness.
The solutions Kela has chosen comply with the cloud service policies established by the Finnish government and with legislation on the processing of personal data in cloud services. Kela has in fact imposed stricter requirements in some cases in order to ensure the data protection of Kela’s customers.
Kela also requires for cloud services to be produced within the EU and for the customers’ personal data to be processed in compliance with the GDPR and other strict data security requirements. The only data that will be exported to the cloud service are data that are absolutely necessary for the implementation of social security, and they will be processed within the EU in accordance with strict data protection principles.
Kela further requires encryption of all data exported to the cloud in such a way that third parties cannot access the data. No personal data, even indirect, may be transferred outside the EU without Kela’s consent. Kela has established strict requirements to ensure the secure processing of our customers’ data. Breaches of data protection provisions will result in significant contractual penalties.
With the adoption of cloud services, Kela gains access to significant new and constantly evolving services that will help us secure customer data and guard against cyberthreats to Kela’s operations. As such, cloud services are in themselves an important investment in security.
In 2023, Kela conducted a market survey to gather information on the potential for using off-the-shelf software. During the market survey, Kela conducted a significant number of market dialogues to gain a better understanding of reference organisations’ experiences of similar reforms both in Finland and abroad.
After the extensive market survey had been completed, Kela’s Board decided in December 2023 to initiate the procurement process required by the implementation of the Eepos development programme. This meant procuring the platforms and partner organisations needed to modernise Kela’s processes for benefit administration, digital services, customer relations management and the transfer of data.
The procurement process was initiated in January 2024. The procurement was arranged as a competitive dialogue.
In April 2025, Kela selected PricewaterhouseCoopers Business Services SRL (using Salesforce technology) to implement the large-scale reform of its benefit administration systems and services.
Before deciding on the procurement, Kela conducted thorough research into large Finnish public and private sector projects, projects implemented by corresponding public authorities in other countries and experiences in project implementation.
In the end, we decided to procure an end-to-end solution. Creating such a challenging solution and implementing it into use requires expertise that is not part of Kela’s core competence. Doing it alone would have entailed the risk of significantly higher costs and possibly even failure to complete the project.
If Kela had procured the new solution piece by piece, Kela would have had to manage the integration of the separate elements of the solution into a complete whole. We have already established previously that it is not possible to integrate separate elements into our existing architecture in a controlled manner, and this has, in fact, been identified as a key factor behind our previous failed attempts to reform our systems. Moreover, implementing our system reform one part at a time would have, in practice, meant building upon our existing architecture while also establishing completely independent functions for different kinds of benefits.
Procuring a system piece by piece can also take more time, which may result in parts of the procured technology becoming obsolete before implementation has been completed.
We have taken responsibility and ethics into account during the implementation of the procurement process for our Eepos programme. This includes, in particular, compliance with legislation, obligations related to terms of employment, financial responsibility and ethical business conduct as well as environmental and social responsibility.
We assessed compliance with responsible practices among the companies included in the tendering process immediately at the stage when we began to determine whether they meet the requirements that apply to all Kela partner organisations.
One of the criteria we enforced during the procurement phase was that the chosen partner organisation must comply with Kela’s ethical guidelines. We regularly monitor compliance with these guidelines. We implemented the procurement in accordance with the Act on Public Procurement and Concession Contracts and applicable procurement directives, which in themselves require the procuring entity to conduct an assessment of the reliability of the companies participating in the process.