Data protection & privacy law in Sweden (2026)

Legal framework

EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), implemented nationally by the Act (2018:218) with supplementary provisions to the EU GDPR (Dataskyddslagen) and Ordinance (2018:219); supervised by Integritetsskyddsmyndigheten (IMY, Swedish Authority for Privacy Protection).

GDPR & data protection in Sweden

In Sweden, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Swedish Authority for Privacy Protection (IMY).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Swedish Authority for Privacy Protection (IMY)

Applies to

any organisation processing the personal data of people in Sweden, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Sweden supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Sweden

1. 01Comprehensive GDPR baseline

   The GDPR applies directly in Sweden and is the primary, omnibus data-protection law covering all sectors; it replaced the former Personal Data Act (1998:204) on 25 May 2018.

   imy.se government.se

2. 02National supplementary act

   The Data Protection Act (2018:218) and Ordinance (2018:219) provide supplementary provisions where the GDPR allows national derogations, and notably extend GDPR-style protection even to processing outside EU-law competence.

   riksdagen.se svenskforfattningssamling.se

3. 03Supervisory authority (IMY)

   Integritetsskyddsmyndigheten (IMY), formerly Datainspektionen and renamed on 1 January 2021, is the national supervisory authority; it handles supervision, complaints, and EDPB cooperation across the EU.

   imy.se en.wikipedia.org

4. 04Sector-specific statutes

   Beyond the GDPR, IMY also enforces the Patient Data Act (healthcare records), the Criminal Data Act (implementing the EU Law Enforcement Directive for police/justice), and the Camera Surveillance Act.

   imy.se cms.law

5. 05Camera surveillance reform (2025)

   From 1 April 2025 the prior IMY permit requirement for camera surveillance in public spaces was abolished; authorities must instead document a balancing test and keep a register of ongoing surveillance.

   cms.law

6. 06Enforcement and sanctions

   IMY can levy GDPR fines up to EUR 20 million or 4% of global turnover (capped at SEK 5-10 million for public authorities). In 2025 it fined pharmacies Apoteket AB and Apohem AB SEK 37m and SEK 8m for Meta-pixel data leaks, and acted against cookie-consent 'dark patterns'.

   imy.se grip.globalrelay.com

GDPR in Sweden: FAQ

Timeline of decisions

1. 1 Apr 2025Enforcement
   IMY Issues Formal Criticisms for Dark-Pattern Cookie Banners

   IMY sanctioned ATG, Aller Media and Warner Music Sweden for cookie consent interfaces that used asymmetric design, prominent 'Accept' buttons, multi-step 'Reject' flows and pre-ticked boxes, to coerce consent. IMY declared dark-pattern cookie enforcement an ongoing priority through 2026.

   CMS Law (reporting on IMY decisions)

2. 1 Jan 2025Enforcement · official
   IMY Fines SL Group SEK 250 000 for Sobriety-Test Data Mishandling

   IMY fined Storstockholms Lokaltrafik (SL) and Waxholms Ångfartygs AB a combined SEK 250,000 for improperly processing employees' sobriety-test results without a lawful basis under GDPR, reinforcing scrutiny of workplace health and biometric data.

   EDPB

3. 30 Aug 2024Enforcement · official
   Pharmacy Meta-Pixel Fines: Apoteket SEK 37M, Apohem SEK 8M

   IMY imposed the largest GDPR fines in Swedish history against two online pharmacies for transmitting highly sensitive health data, STI tests, contraceptives, OTC medicines, to Meta via tracking pixels without a lawful basis, totalling SEK 45M (~€4M).

   IMY

4. 1 Jul 2023Enforcement · official
   IMY Bans Google Analytics and Issues First Major EU-US Transfer Fines

   Following noyb's 101 complaints, IMY ordered CDON, Coop, Dagens Industri and Tele2 to stop using Google Analytics and fined Tele2 SEK 12M (~€1M) and CDON SEK 300,000 for sending personal data to the US without adequate safeguards, Sweden's first major enforcement of post-Schrems II transfer rules.

   EDPB

5. 1 Jan 2021Decision · official
   Datainspektionen Renamed Integritetsskyddsmyndigheten (IMY)

   By government decision the Swedish data-protection authority was renamed from Datainspektionen (est. 1973) to Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection, IMY), signalling an expanded mandate covering personal integrity in a digital society.

   IMY

6. 21 Aug 2019Enforcement · official
   Sweden's First GDPR Fine: Facial Recognition Attendance System in School

   Datainspektionen fined Skellefteå municipality's school board SEK 200,000 for piloting facial recognition to track 22 pupils' attendance, violating Articles 5, 9, 35 and 36 GDPR; the regulator held that student consent cannot be freely given to a public authority with power over them.

   EDPB

7. 25 May 2018Law · official
   GDPR Applies; Sweden Enacts Complementary Dataskyddslagen (SFS 2018:218)

   The EU GDPR replaced the 1998 Personal Data Act as the primary framework. Sweden simultaneously enacted the Dataskyddslagen (SFS 2018:218) to exercise national margins of appreciation, covering processing of social-security numbers, freedom-of-expression exemptions and special rules for public authorities.

   Riksdagen (Swedish Parliament)

8. 21 Dec 2016Decision · official
   ECJ Tele2 Sverige ruling strikes down blanket internet data retention

   In Case C-203/15 (Tele2 Sverige AB v Post- och telestyrelsen), the European Court of Justice ruled that Sweden's general and indiscriminate retention of all subscribers' traffic and location data was incompatible with EU fundamental rights law, invalidating core provisions of Sweden's Electronic Communications Act and forcing a legislative overhaul of surveillance-enabling rules.

   Court of Justice of the European Union

9. 1 May 2012Law
   Sweden implements EU Data Retention Directive after €3 million EU fine

   After years of delay and a €3 million penalty from the EU Court of Justice, Sweden amended its Electronic Communications Act (LEK) to mandate six-month retention of internet and telephone metadata by ISPs for law-enforcement access. This was the minimum period under the 2006 EU Directive and set Sweden's surveillance-capability baseline.

   Hunton Andrews Kurth LLP

10. 1 Jun 2008Law · official
    FRA Signals Intelligence Law (SFS 2008:717) authorises bulk cable-traffic interception

    Sweden enacted Act 2008:717 on Signals Intelligence, granting the National Defence Radio Establishment (FRA) authority to intercept all cross-border internet cable traffic without a warrant and store metadata for up to one year. The law passed narrowly after fierce domestic debate and was later revealed to involve cooperation with the NSA, making it a landmark, and controversial, cornerstone of Sweden's online surveillance architecture.

    Sveriges Riksdag

11. 24 Oct 1998Law · official
    Personal Data Act (Personuppgiftslagen / PuL, SFS 1998:204) Enacted

    Sweden replaced its 1973 Data Act with PuL to implement EU Directive 95/46/EC, adopting a rights-based framework with principles of purpose limitation, data minimisation and data-subject rights; Datainspektionen retained supervisory authority with expanded powers.

    Riksdagen (Swedish Parliament)

12. 11 May 1973Law · official
    Sweden enacts the world's first comprehensive data protection law

    Sweden's Data Act (Datalagen, SFS 1973:289) was the first statute in the world to protect the privacy of personal data processed on computers, requiring mandatory licensing of data systems and creating the Data Inspection Board. It established Sweden as a global pioneer in digital privacy and laid the template for the EU data-protection framework that governs online safety to this day.

    Sveriges Riksdag

13. 11 May 1973Law · official
    Sweden Enacts World's First National Data Protection Law (Datalagen)

    The Swedish Riksdag enacted Datalagen (the Data Act, SFS 1973:289), the first national data protection statute in history, requiring government licensing of personal data registers and establishing Datainspektionen as the supervisory authority; it entered into force 1 July 1974.

    ILO NATLEX

Sources

1. 1.imy.se/en/
2. 2.imy.se/en/about-us/swedish-authority-for-privacy-protections-assignment/
3. 3.government.se/government-policy/the-constitution-of-sweden-and-personal-privacy/act
4. 4.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2018218
5. 5.svenskforfattningssamling.se/doc/2018218.html
6. 6.cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
7. 7.edpb.europa.eu/news/national-news/2025/swedish-sa-administrative-fine-against-two-co
8. 8.en.wikipedia.org/wiki/Swedish_Authority_for_Privacy_Protection
9. 9.imy.se/en/about-us/swedish-authority-for-privacy-protections-assignment/sa-a
10. 10.grip.globalrelay.com/imy-fines-swedish-two-pharmacies-skr-45m-for-gdpr-failures/