Data Protection & Privacy in Sweden

Sweden operates one of the most rigorously enforced data protection regimes in the European Union. The General Data Protection Regulation (GDPR) applies directly as EU law, supplemented by the Swedish Data Protection Act (Dataskyddslagen, SFS 2018:218), which fills national gaps left open by the regulation. Businesses that collect, process or transfer personal data in Sweden face binding obligations on consent, data subject rights, breach notification and cross-border transfers - with administrative fines reaching up to EUR 20 million or four percent of global annual turnover. This article maps the legal framework, explains the practical tools available to controllers and processors, identifies the most common compliance failures by international operators, and outlines the strategic decisions that determine whether a business can operate with confidence in the Swedish market.

The primary instrument is the GDPR, which entered into force across the EU and became directly applicable in Sweden. The GDPR establishes the foundational principles: lawfulness, fairness and transparency (Article 5(1)(a)); purpose limitation (Article 5(1)(b)); data minimisation (Article 5(1)(c)); accuracy (Article 5(1)(d)); storage limitation (Article 5(1)(e)); and integrity and confidentiality (Article 5(1)(f)). These principles are not aspirational - they are enforceable obligations that the controller must be able to demonstrate compliance with at any time.

The Swedish Data Protection Act (Dataskyddslagen) supplements the GDPR in several important areas. It sets the minimum age for a child's consent to information society services at thirteen years under Section 22, which is lower than the GDPR's default of sixteen but within the permitted national range. It also governs the processing of personal data in the context of freedom of expression and information, carving out space for journalistic, academic and literary purposes under Chapter 1, Section 7. The Act designates the Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection, as the national supervisory authority with full investigative, corrective and sanctioning powers.

The Swedish Criminal Data Act (Brottsdatalagen, SFS 2018:1177) applies to the processing of personal data by competent authorities for law enforcement purposes, creating a parallel regime that commercial operators rarely encounter directly but must understand when dealing with public sector clients or regulated industries.

The IMY has issued binding decisions and guidance on topics ranging from cookie consent to employee monitoring. Its published decisions - while not binding precedent in the common law sense - carry significant persuasive weight and signal enforcement priorities. Swedish courts, including the Administrative Court of Appeal (Kammarrätten), have reviewed IMY decisions in cases involving healthcare providers, financial institutions and technology companies, consistently affirming the authority's broad discretion in assessing proportionality.

Every processing activity requires a lawful basis under Article 6 GDPR. The six available bases are: consent; performance of a contract; compliance with a legal obligation; protection of vital interests; performance of a task in the public interest; and legitimate interests of the controller or a third party. Swedish practice and IMY guidance have shaped how each basis applies in the national context.

Consent under Article 7 GDPR must be freely given, specific, informed and unambiguous. In Sweden, the IMY has taken a strict position on pre-ticked boxes, bundled consent and consent obtained as a condition of service. A common mistake made by international operators is treating a privacy policy acknowledgement as valid consent for marketing or analytics processing. Swedish courts and the IMY treat these as legally distinct acts. Consent must be granular - separate consent for each distinct purpose - and must be as easy to withdraw as to give.

The legitimate interests basis under Article 6(1)(f) GDPR requires a three-part balancing test: identifying the legitimate interest, assessing the necessity of the processing, and weighing the interest against the data subject's rights and freedoms. Swedish supervisory practice has been sceptical of broad reliance on legitimate interests for behavioural advertising, employee monitoring and data sharing within corporate groups. Controllers who rely on this basis without a documented balancing test face enforcement risk.

For special categories of personal data - health data, biometric data, genetic data, data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership or sexual orientation - Article 9 GDPR requires an additional condition from the explicit list, such as explicit consent or a substantial public interest ground. The Dataskyddslagen, Section 3, provides that processing of sensitive data for research and statistics purposes is permitted under specific safeguards, including pseudonymisation and data minimisation requirements.

Processing of personal data relating to criminal convictions and offences under Article 10 GDPR may only be carried out under the control of official authority or when authorised by Swedish law. This restriction is particularly relevant for employers conducting background checks and for financial institutions performing anti-money laundering due diligence.

To receive a checklist on lawful basis selection and consent management for Sweden, send a request to info@vlo.com.

The GDPR grants data subjects a comprehensive set of rights that controllers must operationalise, not merely acknowledge. In Sweden, the IMY has investigated and sanctioned organisations for failing to respond within the mandatory one-month period under Article 12(3) GDPR, for providing inadequate responses to access requests, and for failing to implement erasure requests without sufficient justification.

The right of access under Article 15 GDPR entitles a data subject to obtain confirmation of whether their data is being processed, a copy of the data, and supplementary information including the purposes, categories, recipients and retention periods. Swedish practice requires that the response be provided in a clear and intelligible format. Where a controller processes large volumes of data about an individual, it may not simply provide a raw database export - it must structure the response meaningfully.

The right to erasure under Article 17 GDPR - commonly called the right to be forgotten - applies where the data is no longer necessary for the original purpose, where consent has been withdrawn, or where the data has been unlawfully processed. Controllers frequently underestimate the operational complexity of erasure: data may be held in backup systems, third-party processors, archived communications and legacy databases. A non-obvious risk is that erasure from the primary system without addressing downstream processors creates ongoing liability.

The right to data portability under Article 20 GDPR applies where processing is based on consent or contract and is carried out by automated means. The controller must provide the data in a structured, commonly used and machine-readable format. In Sweden, this right has been invoked in disputes between employees and employers, and between consumers and digital service providers.

The right to object under Article 21 GDPR is absolute where processing is for direct marketing purposes. The controller must cease processing immediately upon receipt of an objection, without requiring the data subject to provide reasons. Where processing is based on legitimate interests or a public task, the data subject may object on grounds relating to their particular situation, and the controller must demonstrate compelling legitimate grounds to override the objection.

Controllers must implement procedures for receiving, logging, assessing and responding to data subject requests. Many underappreciate that a failure to respond - even where the underlying processing is lawful - constitutes an independent GDPR violation subject to separate sanctions.

A personal data breach is defined under Article 4(12) GDPR as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The notification obligations that follow are among the most operationally demanding aspects of GDPR compliance.

Under Article 33 GDPR, a controller must notify the IMY of a breach without undue delay and, where feasible, within 72 hours of becoming aware of it. The notification must include a description of the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address the breach. Where notification cannot be made within 72 hours, the controller must provide reasons for the delay alongside the notification.

The 72-hour clock starts when the controller becomes aware - not when the breach occurred. In practice, this means that internal escalation procedures, incident response plans and pre-drafted notification templates are essential. A common mistake is treating the 72-hour window as beginning only after a full internal investigation is complete. The IMY expects prompt notification even where facts remain uncertain, with supplementary information provided subsequently.

Under Article 34 GDPR, where a breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must also notify the affected data subjects without undue delay. High-risk breaches typically involve financial data, health data, identity credentials or data enabling fraud or discrimination. The IMY has issued guidance specifying that notification to data subjects must be in plain language and must include concrete advice on protective steps they can take.

Processors face a distinct obligation under Article 33(2) GDPR: they must notify the controller without undue delay after becoming aware of a breach. Processor contracts must therefore include clear breach notification procedures, defined escalation contacts and agreed response timelines. Many international businesses operating through Swedish subsidiaries or local processors discover during an incident that their data processing agreements (DPAs) lack the specificity required to coordinate an effective response.

The IMY has imposed significant fines for breach notification failures. Enforcement has targeted both the failure to notify within 72 hours and the failure to implement adequate technical and organisational measures to prevent breaches in the first place. The cost of non-specialist handling - including delayed notification, incomplete DPAs and absent incident response procedures - routinely exceeds the cost of preventive compliance investment.

To receive a checklist on data breach response procedures for Sweden, send a request to info@vlo.com.

Transferring personal data outside the European Economic Area (EEA) requires a legal transfer mechanism under Chapter V GDPR. The available mechanisms are: an adequacy decision by the European Commission; standard contractual clauses (SCCs) adopted by the Commission; binding corporate rules (BCRs) approved by a supervisory authority; codes of conduct or certification mechanisms; or derogations for specific situations under Article 49 GDPR.

The SCCs adopted by the European Commission in 2021 are the most widely used transfer mechanism for commercial relationships. They come in four modules covering controller-to-controller, controller-to-processor, processor-to-controller and processor-to-processor transfers. Swedish controllers must implement the correct module, complete the annexes with accurate descriptions of the processing, and conduct a transfer impact assessment (TIA) where the legal framework of the destination country may not ensure an equivalent level of protection.

The TIA requirement emerged from the Court of Justice of the EU's Schrems II judgment and has been incorporated into Swedish supervisory practice. The IMY expects controllers to document their TIA, assess the laws and practices of the destination country - particularly regarding government access to data - and implement supplementary measures where necessary. Supplementary measures may include encryption, pseudonymisation, contractual commitments from the importer, or technical architecture changes that prevent the importer from accessing data in clear.

Binding corporate rules are an alternative for multinational groups that transfer data internally across multiple jurisdictions. BCRs require approval by the lead supervisory authority - which for groups with their EU main establishment in Sweden would be the IMY - and must meet the requirements set out in Articles 47 and 46 GDPR. The BCR approval process is lengthy, typically taking one to two years, and requires detailed documentation of the group's data flows, governance structure and enforcement mechanisms.

The Article 49 derogations - including explicit consent, necessity for contract performance, important reasons of public interest and vital interests - are intended as exceptions for occasional transfers, not as a basis for systematic cross-border data flows. The IMY has been explicit that relying on consent as a derogation for routine commercial transfers is inappropriate, because consent obtained in this context is rarely freely given.

A non-obvious risk for Swedish subsidiaries of US or Asian parent companies is that data sharing within the corporate group - including HR data, customer data and financial data - constitutes a cross-border transfer requiring a valid mechanism. Many groups operate for years without adequate transfer documentation, discovering the gap only during an IMY audit or following a complaint from a data subject or employee.

The Data Protection Officer (DPO) is a mandatory role under Article 37 GDPR for three categories of organisation: public authorities and bodies; controllers or processors whose core activities require large-scale, regular and systematic monitoring of data subjects; and controllers or processors whose core activities involve large-scale processing of special categories of data or criminal conviction data.

In Sweden, the IMY has clarified that 'large-scale' is assessed by reference to the number of data subjects, the volume of data, the geographic scope of the processing and the duration of the processing activity. A mid-sized Swedish e-commerce business processing behavioural data on hundreds of thousands of users would typically meet the threshold. A small professional services firm processing employee and client data in limited volumes would not.

The DPO must have expert knowledge of data protection law and practice under Article 37(5) GDPR. The role may be filled by an employee or by an external service provider. The DPO must be involved in all matters relating to the protection of personal data, must have access to the highest management level, must not receive instructions regarding the exercise of their tasks, and must not be dismissed or penalised for performing their duties under Article 38 GDPR.

A common mistake by international companies establishing Swedish operations is appointing a DPO who lacks genuine independence - for example, the company's general counsel or compliance officer who also has operational responsibilities that create conflicts of interest. The IMY has flagged this structural problem in enforcement decisions.

The DPO's contact details must be published and communicated to the IMY. The DPO serves as the primary contact point for data subjects exercising their rights and for the IMY in supervisory proceedings. In practice, the DPO also coordinates the Records of Processing Activities (RoPA) required under Article 30 GDPR, manages data protection impact assessments (DPIAs) under Article 35 GDPR, and oversees vendor due diligence for data processing agreements.

The DPIA is mandatory where processing is likely to result in a high risk to data subjects. The IMY has published a list of processing types that require a DPIA, including systematic and extensive profiling, large-scale processing of special categories of data, and systematic monitoring of publicly accessible areas. A DPIA must describe the processing, assess necessity and proportionality, evaluate risks and identify mitigation measures. Where residual risks remain high after mitigation, the controller must consult the IMY before commencing processing under Article 36 GDPR.

Scenario one: A US technology company launches a SaaS platform for Swedish enterprise clients. The company processes personal data of the clients' employees and end-users on servers located in the United States. The company must implement SCCs with each Swedish client, conduct TIAs for US transfers, appoint a DPO if the processing meets the threshold, maintain a RoPA, and ensure that its standard DPA template complies with GDPR requirements. A failure to complete SCCs before go-live creates immediate transfer violation exposure. Legal costs for structuring the compliance framework typically start from the low thousands of EUR, with ongoing DPO services adding to the annual budget.

Scenario two: A Swedish retail group implements an employee monitoring system tracking productivity through computer activity logs. The processing involves systematic monitoring of employees, triggering the DPO requirement and a mandatory DPIA. The lawful basis must be assessed carefully - legitimate interests may be available but requires a documented balancing test that accounts for employees' reasonable expectations of privacy in the workplace. The IMY has taken enforcement action against employers who implemented monitoring without adequate transparency, without a DPIA, or without consulting the DPO. The risk of inaction is significant: an employee complaint to the IMY can trigger a full audit within weeks.

Scenario three: A Swedish healthcare provider suffers a ransomware attack that encrypts patient records. The provider must assess within hours whether the attack constitutes a personal data breach, determine whether notification to the IMY is required within 72 hours, assess whether affected patients must be notified, and coordinate with the processor responsible for the encrypted systems. Healthcare data is a special category under Article 9 GDPR, making the risk assessment more acute. Delays in notification, inadequate documentation of the incident response, or failure to implement prior technical measures will each attract separate enforcement scrutiny. Incident response legal costs vary significantly depending on the scale of the breach and the complexity of the notification process.

We can help build a strategy for GDPR compliance in Sweden, including DPO structuring, transfer mechanism implementation and breach response planning. Contact info@vlo.com.

What are the most significant practical risks for a foreign company processing Swedish personal data without a local compliance structure?

The primary risk is enforcement action by the IMY, which may be triggered by a data subject complaint, a breach notification or a proactive audit. The IMY has authority to impose administrative fines, issue reprimands, impose temporary or permanent bans on processing, and order the suspension of data transfers. A foreign company without a local DPO, without adequate DPAs with Swedish processors, and without a RoPA is exposed on multiple fronts simultaneously. The absence of a local compliance structure also makes it difficult to respond to IMY inquiries within the tight deadlines the authority typically sets - often 30 days or less. Establishing a compliance framework after an investigation has commenced is significantly more costly and less effective than preventive structuring.

How long does an IMY investigation typically take, and what are the financial consequences of a finding of non-compliance?

IMY investigations vary considerably in duration depending on complexity, ranging from several months for straightforward cases to over a year for complex multi-issue investigations involving large organisations. Administrative fines under Article 83 GDPR are tiered: less serious violations attract fines up to EUR 10 million or two percent of global annual turnover; more serious violations - including breaches of the basic principles, lawful basis requirements, data subject rights and cross-border transfer rules - attract fines up to EUR 20 million or four percent of global annual turnover. The IMY also has the power to order remedial measures that impose ongoing operational costs. Beyond fines, organisations face reputational damage, potential civil claims from affected data subjects under Article 82 GDPR, and the management burden of responding to enforcement proceedings.

When should a business choose to appoint an external DPO rather than an internal one, and what does that decision involve?

An external DPO is often the better choice for small and medium-sized enterprises that lack internal data protection expertise, for companies where internal candidates face conflicts of interest due to their other responsibilities, and for organisations that need to demonstrate genuine independence to the IMY. The external DPO must have access to the organisation's systems, processes and senior management, and must be contractually protected against instructions that would compromise their independence. The arrangement requires a service agreement that defines the scope of the DPO's responsibilities, the resources available to them, and the escalation procedures for high-risk matters. Cost levels for external DPO services in Sweden vary depending on the complexity of the organisation's processing activities and the level of engagement required.

Data protection compliance in Sweden demands a structured, documented and operationally embedded approach. The GDPR's requirements - supported by the Dataskyddslagen and enforced by the IMY - apply to every stage of the data lifecycle, from collection and processing to storage, transfer and deletion. International businesses that treat compliance as a one-time documentation exercise rather than an ongoing operational discipline consistently face the highest enforcement exposure. The strategic decisions - lawful basis selection, DPO appointment, transfer mechanism implementation, breach response planning - each carry material legal and financial consequences that justify specialist legal input.

To receive a checklist on building a comprehensive data protection compliance programme for Sweden, send a request to info@vlo.com.

Our law firm Vetrov & Partners has experience supporting clients in Sweden on data protection and privacy matters. We can assist with GDPR compliance structuring, DPO services, data processing agreement drafting, transfer impact assessments, breach notification management and IMY enforcement proceedings. To receive a consultation, contact: info@vlo.com.