SwedenIMY Enforcement, GDPR Article 82, Dataskyddslagen Chapter 6-7, and Group Proceedings
Regulation (EU) 2016/679, Arts. 82-83; Dataskyddslagen, ch. 6-7; Lag (2002:599) om grupprattegang
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018.
An enforcement supervision rule binding public and private bodies.
As of 2 September 2026.
What it requires
- Expect IMY to have General Data Protection Regulation (GDPR) Article 83 fining power over your processing of personal data of a person in Sweden, though its fines against Swedish public authorities are capped below the general GDPR ceiling.
- Expect any person in Sweden who suffered material or non-material damage from an infringement to have a direct GDPR Article 82 right to compensation from you as controller or processor.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 83(5) sets the higher GDPR administrative-fine tier at up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher; Article 83(4) sets a lower tier, up to EUR 10,000,000 or 2 percent, for the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43. Both GDPR ceilings apply directly in Sweden as a Regulation, with no domestic re-enactment needed, to any controller or processor including private-sector ones. A narrower, Sweden-specific carve-out applies only when the party fined is a Swedish public authority ("myndighet"): Dataskyddslagen (2018:218) ch. 6 sec. 2, exercising the Member State option in GDPR Article 83(7), caps Integritetsskyddsmyndigheten's sanktionsavgift against a public authority at SEK 5,000,000 for an Article 83.4 infringement and SEK 10,000,000 for an Article 83.5-83.6 infringement; both figures are confirmed against Dataskyddslagen ch. 6 sec. 2, which reads in the original Swedish: "Sanktionsavgiften ska bestämmas till högst 5 000 000 kronor vid överträdelser som avses i artikel 83.4 i EU:s dataskyddsförordning och till högst 10 000 000 kronor vid överträdelser som avses i artikel 83.5 och 83.6 i förordningen." (in English: the sanction fee shall be set at no more than SEK 5,000,000 for infringements under Article 83.4 of the GDPR, and at no more than SEK 10,000,000 for infringements under Article 83.5 and 83.6 of the GDPR). Dataskyddslagen ch. 6 sec. 1 also confines IMY's fining power under this Act to infringements captured by GDPR Article 83 itself.
- Rule
- Higher of
- As of
- 2 September 2026
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Integritetsskyddsmyndigheten (IMY), designated Sweden's data protection supervisory authority under GDPR Article 51 by Förordning (2018:219) med kompletterande bestämmelser till EU:s dataskyddsförordning, sec. 3.
Enforcement record
IMY's own Årsredovisning (Annual Report) for 2025, signed by the Director General on 18 February 2026: Table 5 (Tillsyn och korrigerande befogenheter) records 3 administrativa sanktionsavgifter (administrative sanction fee decisions) in 2025, against 6 in 2024 and 11 in 2023, a declining year over year count. The report separately names all three 2025 decisions (Aktiebolaget Storstockholms Lokaltrafik, SEK 75,000; Waxholms Ångfartygs AB, SEK 75,000; Diskrimineringsombudsmannen, SEK 100,000), which sum to fines_per_year of SEK 250,000 and a median_fine of SEK 75,000 for the year, corroborating the Table 5 count of 3. actions_per_year and fines_per_year both cover calendar year 2025, IMY's most recently completed reporting year. Counts DPA-imposed administrative sanktionsavgifter only, not private civil claims under GDPR Article 82 or the Lag (2002:599) om grupprattegang mechanism. IMY's general 'Tillsyner och beslut' web listing (imy.se/tillsyner/) is explicitly labelled an urval (selection) of supervisions IMY judges useful to publicize, not an exhaustive count, so it was not used as the actions_per_year source; the signed annual report was used instead.
- As of
- 18 February 2026
- Trend
- Falling
- Currency
- SEK
- Source link
- https://www.imy.se/globalassets/dokument/arsredovisningar/imy-arsredovisning-2025.pdf
- Median fine
- 75,000
- Fines per year
- 250,000
- Actions per year
- 3
What it reaches
Obligation class
Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Integritetsskyddsmyndigheten (IMY) is Sweden's supervisory authority. Dataskyddslagen Chapter 6 caps administrative fines against public authorities below General Data Protection Regulation (GDPR)'s own ceiling (SEK 5,000,000 for Article 83.4 violations, SEK 10,000,000 for Article 83.5-83.6), confirmed against the chapter, and the Act contains no separate criminal-penalties chapter at all.
GDPR Article 82 arms an individual with a direct private right of action, restated for the Swedish Act's own violations by Dataskyddslagen Chapter 7 Section 1.
Sweden separately has a general civil group-litigation mechanism, Lag (2002:599) om grupprattegang, permitting private, organizational, and public group actions; its scope provision covers any claim that could be brought before a general court under civil-dispute rules, with no data-protection-specific text confirming actual use for a GDPR claim.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotprocesses_biometricsprocesses_voice
Read the law
Dataskyddslagen ch. 6-7
Lag (2002:599) om grupprattegang secs. 2, 4-6
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.