SwedenDataskyddslagen (Data Protection Act), GDPR-Complementing Provisions
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Sweden; Dataskyddslagen adds domestic legal bases mainly for public-sector processing, not a modification of the private-sector Article 6 list.
These lines are LexLint's reading of the law's text. Also read by: Integritetsskyddsmyndigheten (IMY) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.imy.se/verksamhet/dataskydd/dataskydd-pa-olika-omraden/myndighet
- Guidance body
- Integritetsskyddsmyndigheten (IMY)
- Open questions
- When a register statute ('registerförfattning') governs a public body's processing, which provisions of Dataskyddslagen still apply, given that the register statute takes precedence over Dataskyddslagen but must conform to the GDPR?
What it makes you log
Who may demand the log
Regulator
Logging duty
The Act names no log or record. Chapter 6 section 1 extends the supervisory authority's Article 58(1) powers, which include ordering a controller to provide information and obtaining access to the data and information needed, to supervision of the Act, so a controller must be able to produce what the authority asks for. Nothing in the Act fixes what is kept, a cadence or a retention period; the GDPR record duties sit in Articles 30 and 33(5), which this row does not cite.
- Kind
- Implicit
- As of
- Provision
- Dataskyddslagen (2018:218), 6 kap. 1 §, applying Regulation (EU) 2016/679, Art. 58(1)
- Trigger
- personal_data_processing
What this law does
Sweden gives the General Data Protection Regulation (GDPR) domestic effect through Dataskyddslagen (SFS 2018:218), enacted and in force . The Act has seven chapters and is light touch, filling only the gaps GDPR leaves open (member-state legal bases for public-authority processing, a reduced fine scale for public authorities, appeal routes) and adding no separate biometric-specific chapter or general criminal-penalties chapter.
Sweden separately has a distinct Kamerabevakningslagen (SFS 2018:1200, Camera Surveillance Act) regulating any camera or optical-electronic monitoring equipment through an impact-assessment and registry duty rather than data-category rules.
Chapter 2 section 5 also lets private persons process personal data in order to supply data that the Economic Crime Authority, the Coast Guard, the Police Authority, the Tax Agency, the Security Service, Customs or the Prosecution Authority has requested to prevent, deter or detect crime or to investigate or prosecute it. That section took effect on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .