SwedenIMY Enforcement, GDPR Article 82, Dataskyddslagen Chapter 6-7, and Group Proceedings
Regulation (EU) 2016/679, Arts. 82-83; Dataskyddslagen, ch. 6-7; Lag (2002:599) om grupprattegang
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Compensate any person in Sweden who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Integritetsskyddsmyndigheten (IMY) (guidance, recorded ); Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 83(5) sets the higher GDPR administrative-fine tier at up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher; Article 83(4) sets a lower tier, up to EUR 10,000,000 or 2 percent, for the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43. Both GDPR ceilings apply directly in Sweden as a Regulation, with no domestic re-enactment needed, to any controller or processor including private-sector ones. A narrower, Sweden-specific carve-out applies only when the party fined is a Swedish public authority ("myndighet"): Dataskyddslagen (2018:218) ch. 6 sec. 2, exercising the Member State option in GDPR Article 83(7), caps Integritetsskyddsmyndigheten's sanktionsavgift against a public authority at SEK 5,000,000 for an Article 83.4 infringement and SEK 10,000,000 for an Article 83.5-83.6 infringement; both figures are confirmed against Dataskyddslagen ch. 6 sec. 2, which reads in the original Swedish: "Sanktionsavgiften ska bestämmas till högst 5 000 000 kronor vid överträdelser som avses i artikel 83.4 i EU:s dataskyddsförordning och till högst 10 000 000 kronor vid överträdelser som avses i artikel 83.5 och 83.6 i förordningen." (in English: the sanction fee shall be set at no more than SEK 5,000,000 for infringements under Article 83.4 of the GDPR, and at no more than SEK 10,000,000 for infringements under Article 83.5 and 83.6 of the GDPR). Dataskyddslagen ch. 6 sec. 1 also confines IMY's fining power under this Act to infringements captured by GDPR Article 83 itself.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Integritetsskyddsmyndigheten (IMY), designated Sweden's data protection supervisory authority under GDPR Article 51 by Förordning (2018:219) med kompletterande bestämmelser till EU:s dataskyddsförordning, sec. 3.
Enforcement record
IMY's own Årsredovisning (Annual Report) for 2025, signed by the Director General on : Table 5 (Tillsyn och korrigerande befogenheter) records 3 administrativa sanktionsavgifter (administrative sanction fee decisions) in 2025, against 6 in 2024 and 11 in 2023, a declining year over year count. The report separately names all three 2025 decisions (Aktiebolaget Storstockholms Lokaltrafik, SEK 75,000; Waxholms Ångfartygs AB, SEK 75,000; Diskrimineringsombudsmannen, SEK 100,000), which sum to SEK 250,000 in fines for the year, with a median fine of SEK 75,000, corroborating the Table 5 count of 3. The count and the total both cover calendar year 2025, IMY's most recently completed reporting year. Counts DPA-imposed administrative sanktionsavgifter only, not private civil claims under GDPR Article 82 or the Lag (2002:599) om grupprattegang mechanism. IMY's general 'Tillsyner och beslut' web listing (imy.se/tillsyner/) is explicitly labelled an urval (selection) of supervisions IMY judges useful to publicize, not an exhaustive count, so it was not used as the source of the count; the signed annual report was used instead.
- As of
- Trend
- Falling
- Currency
- SEK
- Source link
- https://www.imy.se/globalassets/dokument/arsredovisningar/imy-arsredovisning-2025.pdf
- Median fine
- 75,000
- Fines per year
- 250,000
- Actions per year
- 3
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Guidance link
- https://www.imy.se/verksamhet/dataskydd/det-har-galler-enligt-gdpr/personuppgiftsansvariga-och-personuppgiftsbitraden/att-tanka-pa-som-personuppgiftsbitrade
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Guidance body
- Integritetsskyddsmyndigheten (IMY)
- Open questions
- Which Swedish rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Who may demand the log
Regulator
Logging duty
GDPR Articles 82 and 83 and chapter 7 of Dataskyddslagen state no record duty. Chapter 6 section 1 extends the supervisory authority's Article 58(1) powers, which include ordering a controller to provide information and obtaining access to the data and information needed, to supervision of the Act, so a controller must be able to produce what the authority asks for. Nothing fixes what is kept, a cadence or a retention period.
- Kind
- Implicit
- As of
- Provision
- Dataskyddslagen (2018:218), 6 kap. 1 §, applying Regulation (EU) 2016/679, Art. 58(1)
- Trigger
- personal_data_processing
What this law does
Integritetsskyddsmyndigheten (IMY) is Sweden's supervisory authority. Dataskyddslagen Chapter 6 caps administrative fines against public authorities below General Data Protection Regulation (GDPR)'s own ceiling (SEK 5,000,000 for Article 83.4 violations, SEK 10,000,000 for Article 83.5-83.6), and the Act contains no separate criminal-penalties chapter at all. GDPR Article 82 arms an individual with a direct private right of action, restated for the Swedish Act's own violations by Dataskyddslagen Chapter 7 Section 1.
Sweden separately has a general civil group-litigation mechanism, Lag (2002:599) om grupprattegang, permitting private, organizational, and public group actions; its scope provision covers any claim that could be brought before a general court under civil-dispute rules.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .