Processes personal data, in Sweden

Dataskyddslagen, SFS 2018:218 · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Sweden; Dataskyddslagen adds domestic legal bases mainly for public-sector processing, not a modification of the private-sector Article 6 list.

Regulation (EU) 2016/679, Arts. 12-21; Dataskyddslagen (2018:218), ch. 5 §§ 1-2 · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Sweden within one month of receipt.
• You need not give information or access under GDPR Articles 13 to 15 where another law, or a decision under a law, bars disclosure to the person; if you are not a public authority, this also covers information that would be secret at a public authority under the Public Access to Information and Secrecy Act (2009:400), under Dataskyddslagen chapter 5 section 1.
• An access request from a person in Sweden under GDPR Article 15 does not reach personal data in an unfinished running text or a memorandum or similar note, unless the data have been disclosed to a third party, are processed only for archiving in the public interest or statistics, or have stayed in that unfinished form for more than a year, under Dataskyddslagen chapter 5 section 2.

Regulation (EU) 2016/679, Arts. 33-34; Dataskyddslagen (2018:218), ch. 1 § 4 · Read the law's page

• Notify IMY without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Sweden, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them, unless the incident is one that must be reported under the Protective Security Act (2018:585) or notified under the Act (2019:109) on protective security in the Riksdag and its authorities, which Dataskyddslagen chapter 1 section 4 takes outside Articles 33 and 34.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Sweden outside the EEA.

Regulation (EU) 2016/679, Arts. 82-83; Dataskyddslagen, ch. 6-7; Lag (2002:599) om grupprattegang · Read the law's page

• Compensate any person in Sweden who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Kamerabevakningslag, SFS 2018:1200 · Read the law's page

• Where camera surveillance is carried out in performing a public-interest task laid down in law or other regulation, assess before it starts whether the interest in the surveillance outweighs the individual's interest in not being watched, document that assessment and keep it for at least five years after the surveillance ends, and keep a register of the ongoing surveillance (Kamerabevakningslagen 7 to 10 §§). Camera surveillance that does not rest on such a task is outside 7 to 10 §§ and carries no register duty under this Act. The assessment and register duties in 8 to 10 §§ do not apply to the surveillance listed in 11 §, which from 1 August 2026 covers surveillance by the Armed Forces, or by a foreign military force in Sweden for international military cooperation or crisis management, in the course of military activity (SFS 2026:1373).

Regulation (EU) 2016/679, Art. 9; Dataskyddslagen, ch. 3; IMY decision Di-2019-2221 · Read the law's page

• Do not deploy a facial-recognition or fingerprint attendance-tracking system for a person in Sweden on consent alone; IMY treats employer consent as generally invalid given the employment power imbalance.
• Obtain a GDPR Article 9(2) basis, with weighty grounds, and complete a data protection impact assessment before deploying a biometric identification system in Sweden.

Lag (2022:482) om elektronisk kommunikation, 9 kap. 1 and 7 §§ · Read the law's page

• Erase or de-identify traffic data on users who are natural persons, and on subscribers, once the data is no longer needed to transmit an electronic message, unless it is kept for a use that 9 kap. 2, 15, 19 or 21 § allows (Lag 2022:482, 9 kap. 1 §). The duty binds a provider of a public electronic communications network or a publicly available electronic communications service.
• Process location data other than traffic data on natural-person users or subscribers only after it has been de-identified or the user or subscriber has consented, and only to the extent and for the time that a service needing the data requires (Lag 2022:482, 9 kap. 7 §).

Lagrådsremiss En ny produktansvarslag · Read the law's page

• The draft Produktansvarslag excludes free and open-source software that you develop or supply outside a business activity (Ch. 1, Sec. 1).
• If you develop, manufacture or produce a product, software included, or put your name, trade mark or another mark on it to present yourself as its maker, you answer as its manufacturer for damage a safety deficiency in it causes (Ch. 1, Sec. 4; Ch. 3, Sec. 1).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: a deficiency due to your software or a related service is not excused because it arose after you placed the product on the market (Ch. 1, Sec. 4; Ch. 3, Sec. 5, second paragraph).
• Meet the product safety rules that apply to your product: they count in deciding whether it has a safety deficiency, and failing a rule meant to prevent the damage presumes a deficiency (Ch. 2, Secs. 2 and 4).
• Account for what your product learns or acquires after release: the effect of any ability to keep learning or to acquire new features is weighed in deciding whether it has a safety deficiency (Ch. 2, Sec. 2(4)).
• Be ready to produce a document or an object when a court orders it under the Code of Judicial Procedure; failing to do so presumes the product has a safety deficiency (Ch. 2, Sec. 4(1)).
• If you manufacture outside the European Economic Area, your importer, your representative or, where there is neither, your provider of distribution services answers for the product (Ch. 3, Sec. 1(3) and (4)).
• If you substantially change a product outside its manufacturer's control and then supply it, you answer as its manufacturer (Ch. 3, Sec. 4).
• If you distribute a product, or provide an online platform that lets a consumer conclude a distance contract with a trader, refer the injured person to the liable person established in the European Economic Area or to your own supplier within one month, or you answer for the product (Ch. 3, Secs. 2 and 3).
• Be able to show that you did not put the product on the market, that the deficiency probably did not exist then, that it results from compliance with product safety rules, or that scientific and technical knowledge made it impossible to discover (Ch. 3, Sec. 5).
• Do not rely on a contract term that is worse for the injured person than the Act: it has no effect against that person (Ch. 1, Sec. 5).