Sweden

Section 10 a of chapter 16 of the Criminal Code makes it an offence to depict a child in a pornographic image, or to distribute, transfer, offer, display, otherwise make available, acquire, offer, broker, possess, or view such an image. A child is defined as a person whose pubertal development is not complete or who is under eighteen years of age. A gross offence under section 10 a carries imprisonment of one to six years.

Section 10 b lifts the section 10 a prohibitions on depiction and possession for a person who produces a pornographic image of a child where the difference in age and development between the person depicted and the person producing the image is minor and the surrounding circumstances do not call for liability.

Section 10 b also lifts those prohibitions for a person who draws, paints, or otherwise makes such an image by comparable handicraft, if the image is not meant to be spread, transferred, shown, or made available to others. In any other case section 10 b provides that an act is not an offence if, given the circumstances, it is justifiable.

The definition in section 10 a turns on the depicted subject's apparent developmental and age characteristics rather than on any requirement that the image be a photograph of an identified real person. Section 10 a's current wording took effect on 1 May 2020 under Lag (2020:173).

Chapter 2, section 7 of the Consumer Credit Act requires the consumer to be informed clearly and comprehensibly where a personalised offer of credit rests entirely on automated processing of personal data.

Chapter 3, section 15 requires a trader whose credit assessment involves automated processing of personal data to review the assessment on the consumer's request, through human involvement, to explain it and the significance of the automated processing for the decision on the application, and to inform the consumer of the risks of automated processing. The trader must also inform the consumer of those possibilities in connection with the credit assessment.

Chapter 9, section 6 lets the Swedish Consumer Agency (Konsumentverket) issue a warning to a trader that does not follow Chapter 3, section 15, and the warning carries a sanction fee where the breach is not minor. Chapter 9, section 7 sets the sanction fee at no less than SEK 5,000 and no more than SEK 10 million, and not above 10 percent of the trader's turnover in the preceding financial year. Transitional provision 1 provides that the Act takes effect on 20 November 2026. The Act was issued on 4 June 2026.

General Data Protection Regulation (GDPR) Article 9 special categories apply directly; Dataskyddslagen chapter 3 supplies domestic legal bases for processing sensitive data to meet employment-law and social-security duties, which any controller may use (section 2), and for a public authority to process it for an important public interest (section 3), with no biometric-specific definition or carve-out.

IMY's landmark biometric decision, Di-2019-2221 (20 August 2019), fined the Skelleftea municipal school board 200,000 SEK for using facial-recognition cameras to register student attendance, finding the processing violated Article 9 (no valid legal basis) and Article 5 (data minimization).

IMY's current guidance cites this decision for the rule that biometric attendance tracking is, as a rule, not permitted, and that employer consent is generally not a valid basis given the power imbalance in an employment relationship.

A controller must notify IMY without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms, and must notify the affected individual without undue delay where the breach is likely to result in a high risk.

Dataskyddslagen chapter 1 section 4 takes personal-data incidents that must be reported under the Protective Security Act (säkerhetsskyddslagen, 2018:585), or notified under the Act (2019:109) on protective security in the Riksdag and its authorities, outside Articles 33 and 34.

Sweden gives the General Data Protection Regulation (GDPR) domestic effect through Dataskyddslagen (SFS 2018:218), enacted 19 April 2018 and in force 25 May 2018. The Act has seven chapters and is light touch, filling only the gaps GDPR leaves open (member-state legal bases for public-authority processing, a reduced fine scale for public authorities, appeal routes) and adding no separate biometric-specific chapter or general criminal-penalties chapter.

Sweden separately has a distinct Kamerabevakningslagen (SFS 2018:1200, Camera Surveillance Act) regulating any camera or optical-electronic monitoring equipment through an impact-assessment and registry duty rather than data-category rules.

Chapter 2 section 5 also lets private persons process personal data in order to supply data that the Economic Crime Authority, the Coast Guard, the Police Authority, the Tax Agency, the Security Service, Customs or the Prosecution Authority has requested to prevent, deter or detect crime or to investigate or prosecute it. That section took effect on 1 April 2025.

Kamerabevakningslagen (SFS 2018:1200), enacted 20 June 2018 and in force 1 August 2018, regulates any TV camera or optical-electronic equipment enabling persistent or regularly repeated monitoring of persons in Sweden, where the equipment is in Sweden and the operator is established in Sweden or in a third country.

As of 1 April 2025 it eliminated the earlier permit regime: surveillance carried out in performing a public-interest task laid down in law now needs a documented impact assessment and a registry of ongoing surveillance, and every camera operator has a signage duty.

The Act does not itself define or specifically regulate facial recognition or biometric identification; a facial-recognition-capable camera falls within its scope only as surveillance equipment generally, with the biometric-processing duty supplied separately by General Data Protection Regulation (GDPR) Article 9 and Dataskyddslagen Chapter 3.

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. Dataskyddslagen has seven chapters, none of them on cross-border transfer, so Chapter V governs unmodified.

General Data Protection Regulation (GDPR) Article 22 gives a person in Sweden the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Dataskyddslagen adds no rule of its own on automated decisions.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Sweden can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. Chapter 5 of Dataskyddslagen narrows two of these rights for any controller.

Section 1 lifts the information and access duties of GDPR Articles 13 to 15 where another law, or a decision under a law, bars disclosure to the person, and for a controller that is not a public authority it also covers information that would be secret at a public authority under the Public Access to Information and Secrecy Act.

Section 2 keeps an access request from reaching personal data in an unfinished running text or memorandum, unless the data have been disclosed to a third party, are processed only for archiving or statistics, or have stayed in that form for more than a year.

Integritetsskyddsmyndigheten (IMY) is Sweden's supervisory authority. Dataskyddslagen Chapter 6 caps administrative fines against public authorities below General Data Protection Regulation (GDPR)'s own ceiling (SEK 5,000,000 for Article 83.4 violations, SEK 10,000,000 for Article 83.5-83.6), and the Act contains no separate criminal-penalties chapter at all. GDPR Article 82 arms an individual with a direct private right of action, restated for the Swedish Act's own violations by Dataskyddslagen Chapter 7 Section 1.

Sweden separately has a general civil group-litigation mechanism, Lag (2002:599) om grupprattegang, permitting private, organizational, and public group actions; its scope provision covers any claim that could be brought before a general court under civil-dispute rules.

Section 9 c of chapter 4 of the Criminal Code makes it an offence for a person to unlawfully gain access to information intended for automated processing, or to unlawfully alter, delete, block, or enter such information into a register, or to unlawfully and seriously disturb or hinder the use of such information by another similar means.

The ordinary offence carries a fine or imprisonment of up to two years; a gross offence carries imprisonment of one to eight years, with gravity assessed by whether the act caused serious damage, concerned a large volume of information, or was otherwise of a particularly dangerous nature.

The provision's trigger is unlawful access, not the circumvention of a security measure, so it reaches a broader range of conduct than a statute conditioned on defeating an access control, and its reach to a scraper reading a public, unauthenticated page has not been tested by a reported Swedish decision. Section 9 c's current wording took effect on 1 August 2026 under Lag (2026:1318), the most recent of several amendments since the offence was first added to the Criminal Code.

A person with lawful access to a work may make copies of it for text and data mining purposes under section 15 a, provided the copies are not kept longer than necessary and are not used for other purposes. This general exception does not apply where the author has, in an appropriate manner, reserved that right, which is the opt-out.

A separate exception in section 15 b lets research organizations, libraries and museums accessible to the public, archives, and film or sound heritage institutions make copies of works they lawfully access, except computer programs, to carry out text and data mining for research purposes, without the section 15 a opt-out.

Section 15 c defines text and data mining as an automated technique used to analyze text and data in digital form for the purpose of generating information, and defines a qualifying research organization. Under section 15 b, a contractual term restricting the right to use a work is void, and an author may still take proportionate measures to secure the integrity and security of networks and databases containing the work.

The maker of a catalogue, table, or other similar work in which a large number of items has been compiled, or which is the result of a substantial investment, has the exclusive right to make copies of the work and make it available to the public, running for fifteen years from a date set elsewhere in the section. The right took effect on 1 January 1998 under Lag (1997:790), whose own transitional provisions name section 49 specifically.

The section's current wording was last amended by Lag (2022:1712), in force from 1 January 2023. The provision applies to a work whose maker is a Swedish citizen or has habitual residence in Sweden, and also to a work whose maker is a Swedish legal person with its registered office, head office, or principal place of business in Sweden. This is the sui generis database right that Directive 96/9/EC requires Member States to provide for the maker of a database showing a substantial investment. Where such a work or a part of it is also protected by copyright, the copyright may be asserted as well.

The Cybersäkerhetsförordning (2025:1507) (Cybersecurity Ordinance) was issued by the Government on 11 December 2025 as supplementary provisions to the Cybersäkerhetslag (2025:1506) and entered into force on 15 January 2026, repealing the earlier ordinance (2018:1175) on information security for essential and digital services.

Section 4 brings the state authorities listed in Annex 1 to the ordinance (2022:524) on state authorities' preparedness within the Act, unless they are exempted under chapter 1, section 12 of the Act. Under sections 5 and 6, a notification under chapter 2, section 2 of the Act is made to the single point of contact, and incident reporting under chapter 2, sections 5 to 8 is made to the computer security incident response team (CSIRT) unit.

Section 7 names the supervisory authority for each sector, among them the Post- och telestyrelsen for digital infrastructure, digital providers and ICT service management between businesses, the Finansinspektionen for banking and financial market infrastructure, the Statens energimyndighet for energy and the Transportstyrelsen for transport.

Section 8 also makes the Post- och telestyrelsen the supervisory authority for the county administrative boards and for operators offering domain name registration services. Section 18 requires the supervisory authority to cooperate with the Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection) when handling incidents that are also personal data incidents.

Chapter 2 §3 requires a väsentlig (essential) or viktig (important) verksamhetsutövare (operator) to take appropriate and proportionate technical, operational and organisational measures, on an all-hazards basis, to protect the network and information systems it uses for its operations or to provide its services, and their physical environment, against an incident, covering at minimum risk-analysis strategy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition and development, effectiveness assessment, cyber hygiene and staff training, cryptography, personnel security and access control, and, where relevant, authentication and secure communications.

Chapter 1 §7(1) names a provider of cloud services, data-centre services, content-delivery networks, outsourced operational or security services, an online marketplace, a search engine or a social-networking-platform service expressly among the digital providers this duty reaches; under Chapter 1 §9 an operator larger than a medium-sized enterprise in an NIS 2 Annex 1 sector is essential, and an operator that is not essential is important.

Chapter 2 §4 additionally requires the operator's management to undergo training on these measures. Chapter 2 §2 requires the operator to register with the designated authority. Chapter 1 §11 exempts a financial entity already covered by Regulation (EU) 2022/2554 (DORA) from this duty.

The Lag (2024:1278) med kompletterande bestämmelser till EU:s förordning om digital operativ motståndskraft för finanssektorn (Act with supplementary provisions to the EU regulation on digital operational resilience for the financial sector) supplements Regulation (EU) 2022/2554 (DORA), and entered into force on 17 January 2025.

Chapter 1, section 2 makes the Finansinspektionen the competent authority under DORA Article 46, and section 4 has it inform the Riksbank of major ICT-related incidents under DORA Article 19.6. Chapter 2 has the Finansinspektionen decide which financial entities carry out threat-led penetration tests under DORA Article 26 and how often, and has the Riksbank oversee and coordinate the tests and issue the attestations.

At the Riksbank's request, financial entities must provide the information it needs for its work with the tests, and the Riksbank may order them to comply. The Finansinspektionen supervises financial entities' compliance with DORA and the Act, may order any person to provide information and documents or to attend a hearing, and may inspect an entity's premises when necessary for supervision.

The maximum administrative sanction fee for a legal person that is a financial entity listed in chapter 4, section 1 is the highest of the krona equivalent of EUR 1,000,000 on 16 January 2023, 10 percent of the previous financial year's turnover, and three times the profit made from the breach where it can be determined.

Chapter 2 §5 requires a väsentlig or viktig verksamhetsutövare to inform the designated authority of a significant incident (betydande incident) as soon as it can and no later than 24 hours after becoming aware of it; an incident is significant if it has caused or could cause serious operational disruption or financial loss, or has affected or could affect other persons by causing significant harm.

Chapter 2 §6 requires the operator to follow with a formal incident notification, within 24 hours of awareness for a trust service provider and within 72 hours for others; §7 requires an interim status report on the authority's request, and §8 requires a final report within one month of the notification, or a progress report followed by a final report within a month of resolution if the incident is still ongoing.

Chapter 2 §9-10 add duties to inform affected service recipients, where appropriate, of a significant incident and of protective measures against a significant cyber threat. This is NIS2 Article 23's own clock. Cybersäkerhetsförordning (2025:1507) 6 § directs incident reporting under Chapter 2 §§5-8 to the computer security incident response team (CSIRT)-enhet. Section 31 of that Förordning makes Försvarets radioanstalt the CSIRT-enhet.

Section 19 permits a trader to use electronic mail, fax or an automatic calling system or similar automatic system for individual communication that no individual operates, in marketing to a natural person, only if the person has consented in advance.

Section 19 lifts the consent requirement where the trader obtained the natural person's electronic mail address in connection with a sale of a product to that person, the person has not objected to the address being used for marketing by electronic mail, the marketing concerns the trader's own similar products, and the person is clearly and distinctly given a free and easy chance to object when the address is collected and in every later marketing message.

Section 20 requires a marketing message sent by electronic mail always to contain a valid address to which the recipient can send a request that the marketing stop, and applies that requirement also to marketing to a legal person. Section 20 a prohibits inviting the recipient of marketing of information society services by electronic mail to visit websites whose marketing breaches section 9 or section 10, third paragraph.

Section 29 lets a trader be ordered to pay a market disruption fee (marknadsstörningsavgift) if the trader, or someone acting on its behalf, has intentionally or negligently breached a provision of the Act. Section 31 sets the fee at a minimum of SEK 10,000 and a maximum of 4 percent of the trader's turnover in the financial year before the infringement ended or the summons was served.

Where the infringement occurred in the trader's first year of business or turnover figures are missing or deficient, section 31 allows turnover to be estimated and the fee to be set at up to the amount in kronor corresponding to two million euro. Section 37 makes a person who intentionally or negligently breaches sections 18 to 22 a, among other provisions, liable to compensate the damage that causes a consumer or another trader.

Section 47 lets the Consumer Ombudsman (Konsumentombudsmannen), a trader affected by the marketing or an association of consumers, traders or employees bring an action for a prohibition or an order under sections 23 to 25. Section 48 gives the Consumer Ombudsman the action for a market disruption fee, and a trader affected by the marketing or an association of traders may bring it if the Ombudsman decides not to.

The Patent and Market Court (Patent- och marknadsdomstolen) is the competent court for actions on prohibitions, orders, market disruption fees and damages under section 46 a. The Act took effect on 1 July 2008.

Chapter 9, section 28 permits information to be stored in or retrieved from a subscriber's or user's terminal equipment only if the subscriber or user has access to information about the purpose of the processing and consents to it. Section 28 allows storage or access without consent where it is needed to transmit an electronic message over an electronic communications network, or is necessary to provide a service at the express request of the user or subscriber.

Chapter 1, section 8 gives the word consent in Chapters 8 and 9 the same meaning as in the EU data protection regulation. Chapter 1, section 7 defines a subscriber as a person who has concluded a contract with a provider of publicly available electronic communications services for the provision of such services. Chapter 1, section 7 defines a user as a person who uses or requests a publicly available electronic communications service.

Chapter 13, section 2 punishes with a fine a person who intentionally or negligently stores or retrieves information in breach of Chapter 9, section 28, if the act is not punishable under the Criminal Code, and a minor case is not a crime. The Post and Telecom Authority (Post- och telestyrelsen) is the regulatory and supervisory authority under the Act. Chapter 11, section 1 has the supervisory authority supervise compliance with the Act and with the decisions and regulations issued under it. The Act took effect on 3 June 2022.

Chapter 4, section 8 makes it a crime to unlawfully gain access to a message that a postal or telecommunications company conveys as a postal item or in an electronic communications network. The crime is called breach of postal or telecommunications secrecy (brytande av post- eller telehemlighet) and carries a fine or imprisonment for at most two years. Lag (2012:280) amended section 8 with effect from 1 July 2012.

Chapter 4, section 9 a punishes, as unlawful eavesdropping (olovlig avlyssning), a person who in a case not covered by section 8 unlawfully and by a technical device for reproducing sound secretly listens to or records speech in solitude, conversations between others, or negotiations at a meeting or other gathering to which the public has no access, and in which the person does not take part or to which the person has gained access without authority, with a fine or imprisonment for at most two years.

Section 11 allows a prosecutor to prosecute unlawful eavesdropping not committed in a public place, or preparation of it, only if the injured party reports the crime for prosecution or prosecution is called for from a public point of view. Section 9 a was added to the Criminal Code by SFS 1975:239.

Chapter 5, section 2 obliges an operator that had 50 or more employees at the start of the calendar year to have internal reporting channels and procedures for reporting and follow-up. Chapter 8, section 1 requires whoever is obliged to have internal or external reporting channels and receives oral reports to document the reporting by a recording that can be saved in a durable and accessible form or by minutes.

If the oral reporting takes place other than at a physical meeting, the documentation duty may also be met by a transcript of the recording or in another suitable way. Chapter 8, section 2 provides that a reporting may be recorded only if the reporting person consents to it. Chapter 8, section 3 requires the reporting person to be given the opportunity to check, correct and approve by signature a transcript or minutes.

Chapter 10, section 1 has the authorities the government designates as supervisory authority see to it that operators follow the Act's provisions on internal reporting channels and procedures for reporting and follow-up. The Act took effect on 17 December 2021. Chapter 5 first applied on 17 July 2022 to operators other than private operators with 50 to 249 employees, and on 17 December 2023 to those private operators.

Chapter 9, section 27 provides that, beyond what sections 1 to 3, 6 a and 31 allow, no one other than the users concerned may take part of or otherwise process data in an electronic message transferred in a public electronic communications network or with a publicly available electronic communications service, or traffic data belonging to the message, unless one of the users has consented to the processing.

The ban does not prevent automatic, intermediate and temporary storage that is necessary for the transmission of an electronic message, or storage to the extent necessary for operating an electronic communications network or service.

The ban does not prevent others from gaining access to the content of an electronic message that is publicly available anyway, if access is given only to make onward transmission to other recipients more efficient and the data on who requested the information are erased. The ban does not prevent a person from listening in with a radio receiver, or otherwise gaining access by using such a receiver, to a radio-conveyed electronic message not intended for that person or for the public.

The ban in the first paragraph does not apply when a provider of number-independent interpersonal communications services processes data in accordance with Regulation (EU) 2021/1232.

Chapter 1, section 7 defines an electronic message as all information exchanged or transmitted between a limited number of parties through a publicly available electronic communications service, except information transmitted as part of broadcasts of radio and television programs aimed at the public unless it can be linked to the individual subscriber or user. Chapter 1, section 8 gives the word consent in Chapter 9 the same meaning as in the EU data protection regulation.

Lag (2026:1302) amended section 27 with effect from 1 August 2026 and added Chapter 9, section 6 a. Chapter 12, section 1 has the supervisory authority decide on a sanction fee against a person who commits any of a list of infringements. Among the listed infringements is not processing the data in an electronic message, or the traffic data belonging to it, in accordance with Chapter 9, section 27.

Chapter 12, section 2 sets the sanction fee at a minimum of SEK 5,000 and a maximum of SEK 10,000,000. Chapter 12, section 2 lets the supervisory authority waive the fee in whole or in part if the infringement is minor or excusable or if charging it would otherwise be unreasonable. The Post and Telecom Authority (Post- och telestyrelsen) is the regulatory and supervisory authority under the Act. The Act took effect on 3 June 2022.

Section 19 permits a trader to use an automatic calling system or similar automatic system for individual communication that no individual operates, in marketing to a natural person, only if the person has consented in advance. Section 21 permits a trader to use methods for individual communication at a distance other than those in section 19, unless the natural person has clearly objected to the method being used.

Section 19 reaches an automatic calling system or similar automatic system only where no individual operates it, so section 21 applies to any other method of individual communication at a distance. Section 29 lets a trader be ordered to pay a market disruption fee (marknadsstörningsavgift) if the trader, or someone acting on its behalf, has intentionally or negligently breached a provision of the Act.

Section 31 sets the fee at a minimum of SEK 10,000 and a maximum of 4 percent of the trader's turnover in the financial year before the infringement ended or the summons was served. Section 37 makes a person who intentionally or negligently breaches sections 18 to 22 a, among other provisions, liable to compensate the damage that causes a consumer or another trader. The Act took effect on 1 July 2008.

Section 19 provides that a service provider that transmits or stores information for another may be held liable for a crime concerning the content of the information only if the crime was committed intentionally. The Act applies to information society services, which section 2 defines as services normally provided for payment, at a distance, by electronic means and at the individual request of a recipient.

Section 1 states that the Act does not apply to questions of taxation, the processing of personal data, anticompetitive cooperation between undertakings, notarial activity or similar activity directly connected with the exercise of public authority, defending or representing a client before a court, or gambling in which money is staked. Lag (2024:957) repealed sections 16, 17 and 18 of the Act with effect from 1 December 2024. The Act took effect on 1 July 2002.

The Act applies to an electronic bulletin board, which section 1 defines as a service for the electronic conveyance of messages, a message being text, image, sound or other information.

Section 2 excludes the mere provision of networks or connections, the conveyance of messages within or between authorities or within a company or group, services protected by the Freedom of the Press Act or the Fundamental Law on Freedom of Expression, messages intended only for a particular recipient or a defined circle of recipients (electronic mail), and messages covered by Regulation (EU) 2021/784 on terrorist content online.

Section 3 requires the provider of an electronic bulletin board to give everyone who joins the service information about the provider's identity and about the extent to which incoming messages become available to other users. Section 4 requires the provider to oversee the service to the extent reasonably required given the scope and focus of the activity, so as to be able to meet the duty in section 5.

Section 4 a lifts the oversight duty in section 4 for a provider whose bulletin board is an intermediary service under the Digital Services Act. For such a provider, the duty in section 5 applies when the message has come to the provider's knowledge. Section 4 a was added by Lag (2024:956), in force from 1 December 2024.

Section 5 requires the provider, when a user sends in a message, to remove it or otherwise prevent its further dissemination if its content is manifestly of a kind covered by the provisions on unlawful threat, unlawful invasion of privacy, incitement to rebellion, agitation against a population group, child pornography offence, unlawful depiction of violence, or public provocation to terrorism or especially serious crime.

Section 5 also requires removal or prevention of dissemination if it is manifest that the user has infringed copyright, or a right protected by Chapter 5 of the Copyright Act, by sending in the message. Section 5 gives the provider the right to take part of the messages on the service so as to be able to meet that duty. Section 5 in its present form was inserted by Lag (2022:670), in force from 1 July 2022.

Section 6 punishes with a fine a person who intentionally or negligently breaches section 3. Section 7 punishes a person who intentionally or through gross negligence breaches section 5, first paragraph, with a fine or imprisonment for at most six months or, if the crime is grave, imprisonment for at most two years, and a minor case is not punished. Section 7 does not apply where the act is punishable under the Criminal Code, the Copyright Act or the terrorist offences act. The Act took effect on 1 May 1998.

Section 52 i applies the chapter to information society services that have as one main purpose to store and give the public access to a large amount of works uploaded online by their users, where the provider organizes and promotes the works for profit and the service plays an important role on the content market by competing with other existing or potential online content services.

Section 52 j treats the service provider as itself transmitting to the public a work that a user makes available by uploading it to the service. Section 52 j also provides that section 18 of Lag (2002:562) is not to apply to the liability the Copyright Act lays down for such a transmission. Section 18 of Lag (2002:562) has since been repealed.

Section 52 k extends a licence the provider holds for transmission to the public to the user's own transmission, provided the user is not acting for profit or the user's activity does not generate significant revenue. Section 52 l frees the provider from liability for an unauthorized transmission under section 52 j if, where it has received a well-founded notice from the rightholder, it promptly blocks access to the content.

Section 52 l also requires, for that freedom from liability, that the provider has done what can reasonably be required to obtain authorization for the transmissions it makes on the service and to ensure that content infringing copyright in works for which rightholders have supplied relevant and necessary information is not made available on the service.

Section 52 m lifts the second requirement for a service that has been available to the public in the European Economic Area for less than three years, if its annual turnover is below the equivalent of EUR 10 million and its unique visitors in the preceding calendar year did not exceed 5 million per month on average. Section 52 n requires the provider, on request of a rightholder or a user, to give information about the measures it takes under section 52 l to prevent infringing content.

Section 52 o requires the provider to ensure that its measures to block access to content under section 52 l do not prevent lawful transmissions to the public to any appreciable extent. Section 52 o allows methods of automatic blocking to be used only to block content that can with a high degree of probability be assumed to infringe copyright. Section 52 o requires the user to be promptly notified when access to content is blocked.

Despite measures under section 52 l, section 52 p lets a user make non-infringing content available and make works available for quotation, criticism, review, caricature, parody or pastiche, and it requires the provider to inform users in its terms of use of these rights. When access to content a user uploaded has been blocked because of a measure under section 52 l, section 52 q requires the provider to have procedures to handle the user's complaint.

Under section 52 q complaints are to be decided promptly, the content is to be restored if the rightholder's request is not duly justified, and a decision not to restore access must be preceded by a manual review.

Section 52 r makes the provider liable for damage a user suffers if the provider intentionally or negligently breaches section 52 o. Section 52 s lets a court order a provider that breaches section 52 o or section 52 q, first or third paragraph, to take corrective action on pain of a periodic penalty, on an action brought by a user or by an organization that represents users. Section 52 u makes a contract term that restricts a user's right under the chapter invalid.

The chapter was inserted by Lag (2022:1712), which took effect on 1 January 2023 and lists Directive (EU) 2019/790 among its sources.

Section 3 makes the authority the government designates the competent authority under the Terrorist Content Online Regulation. The Police Authority (Polismyndigheten) is listed in its instruction as the competent authority under Article 12 of that Regulation.

Section 4 lets the competent authority order a hosting service provider that breaches Article 5(1) to (3), 5(5), 7, 10, 15(1) or 17 of the Regulation as originally worded to take the measures needed to meet the obligation, and the order may carry a periodic penalty (vite). Section 6 lets the competent authority charge a sanction fee to a hosting service provider that breaches Article 3(3), 3(6), 4(2), 4(7), 6, 11 or 14(5) of the Regulation as originally worded.

Section 7 sets the sanction fee at a minimum of SEK 5,000 and a maximum of SEK 5,000,000 or, for systematic or persistent failure to meet the obligation in Article 3(3), the higher amount that follows from Article 18(3) of the Regulation. Section 9 allows a sanction fee only if the person concerned has been given the opportunity to comment within two years of the infringement.

Section 13 allows an appeal of the competent authority's decisions to the general administrative court, and leave to appeal is required for the administrative court of appeal. The Act took effect on 1 July 2023. A sanction fee may be decided only for breaches that took place after the Act took effect.

The Act sets out the conditions for removing content that aims to recruit people to commit crime. Section 2 defines recruitment content as content that can reasonably be assumed to form part of punishable preparation or conspiracy to commit a crime carrying imprisonment of two years or more, or of involving a minor in crime under Chapter 16, section 5 a of the Criminal Code.

Section 3 applies the Act only to recruitment content directed at Swedish citizens or persons resident in Sweden, made available by someone who is in Sweden, or concerning crimes to be committed in Sweden or against a Swedish citizen or resident. Section 4 excludes content covered by Regulation (EU) 2021/784 on terrorist content online.

Section 5 lets the competent authority order a hosting service provider covered by the Digital Services Act to remove recruitment content or make it inaccessible online. An order under section 5 takes effect immediately. Section 7 requires a hosting service provider that receives an order to remove the content or make it inaccessible online as soon as possible and within one hour of receiving the order.

Section 8 requires a hosting service provider to preserve the content and its related data for six months from the time they were removed or made inaccessible because of an order. If the order has been appealed, the material is always to be preserved until the case has been decided by a final decision. Section 9 lets the competent authority charge a sanction fee to a hosting service provider that breaches its obligations under sections 7 and 8.

Section 10 sets the sanction fee at a minimum of SEK 5,000 and a maximum of SEK 5,000,000 or, for systematic or continuing failure to meet the obligation in section 7, up to an amount corresponding to 4 percent of the provider's global turnover in the preceding financial year. Section 11 allows the fee to be reduced in whole or in part if the infringement is minor or excusable, or if charging it would be unreasonable in the circumstances.

Section 15 allows an appeal of the competent authority's decisions to the general administrative court, and leave to appeal is required for the administrative court of appeal. Under Förordning (2026:1237), section 3, the Police Authority (Polismyndigheten) is the competent authority. The Act took effect on 15 July 2026.

Section 4 makes the Post and Telecom Authority (Post- och telestyrelsen) a supervisory authority under Lag (2024:954). Section 4 also makes the Post and Telecom Authority the digital services coordinator.

Section 5 makes the Swedish Consumer Agency (Konsumentverket) a supervisory authority for Article 25 as to interfaces that mislead or manipulate consumers, for Articles 26(1) and 26(3) as to commercial advertisements aimed mainly at consumers, for Article 27 as to recommender systems aimed mainly at consumers, for Article 28(2) as to commercial advertisements, and for Articles 31 and 32.

Section 6 makes the Swedish Agency for Media (Mediemyndigheten) a supervisory authority for Articles 14, 26(2) and 28(1), for Article 25 as to recipients other than consumers, for Articles 26(1) and 26(3) as to advertisements without a commercial purpose and advertisements not aimed mainly at consumers, for Article 27 as to recommender systems aimed mainly at others than consumers, and for Article 28(2) as to advertisements without a commercial purpose.

Section 8 has the Post and Telecom Authority lead a coordination function in which all the supervisory authorities take part. Section 10 has the Post and Telecom Authority vote for Sweden in the European Board for Digital Services. The Ordinance took effect on 1 December 2024.

Chapter 1, section 3 makes a supervisory authority designated by the government a competent authority under the Digital Services Act and has the government decide which supervisory authority is the digital services coordinator. Chapter 2, section 1 requires an order to act against illegal content under Article 9 of the Digital Services Act to meet the requirements of Article 9(2).

Chapter 2, section 2 requires an order to provide information under Article 10 of the Digital Services Act to meet the requirements of Article 10(2). Chapter 2, section 3 requires a notification of a suspected criminal offence under Article 18(1) of the Digital Services Act to be made in Sweden to the Police Authority (Polismyndigheten).

Chapter 3, section 1 has a supervisory authority supervise compliance with the Digital Services Act, with acts adopted under Articles 15(3), 24(6) or 87, with the Act itself and the regulations issued under it, and with commitments made binding under the Digital Services Act or the Act. Chapter 3, section 2 lets a supervisory authority charge an investigation fee and a sanction fee and attach a periodic penalty (vite) to its decisions.

Chapter 3, section 3 lets a court, on an application from a supervisory authority, order an inspection and order a temporary restriction of recipients' access to a service or online interface. Chapter 3, section 16 caps a periodic penalty at 5 percent of the average global daily turnover or daily income per day. Chapter 3, section 19 caps an investigation fee at 1 percent of the annual income or global annual turnover in the preceding financial year.

Chapter 3, section 23 requires a sanction fee from a provider of an intermediary service that breaches an obligation under Article 11(1), 11(3), 12(1), 13(1), 14(6), 16(4), 18(1), 24(1), 24(2), 24(3), 26(2), 26(3), 30(1), 30(6), 31(1), 32(1) or 32(2) of the Digital Services Act as originally worded. Chapter 3, section 25 sets the sanction fee at a minimum of SEK 5,000 and a maximum of 6 percent of the provider's global annual turnover in the preceding financial year.

Chapter 3, section 25 lets the supervisory authority waive a sanction fee in whole or in part if the infringement is minor or excusable and the provider takes corrective action, if another authority has taken sufficient action, or if it would otherwise be unreasonable to charge it.

Chapter 3, section 24 bars a sanction fee where the infringement is covered by an order carrying a periodic penalty that forms the basis of an application to enforce it, or where the person concerned has not been given the opportunity to comment within two years of the infringement. Chapter 4, section 1 makes the Administrative Court in Stockholm (Förvaltningsrätten i Stockholm) the competent court.

The transitional provisions allow a sanction fee under Chapter 3, section 23 only for infringements committed after the Act took effect. The Act took effect on 1 December 2024.

The Act supplements Regulation (EU) 2024/1083, the European Media Freedom Act. Section 3 states that the national regulatory authority is the authority designated as the national regulatory authority under Article 30 of the Audiovisual Media Services Directive.

Section 4 requires a person who has made information accessible under Article 6(1), or published information under Article 25(2), of the Regulation to give the supervisory authority the information and a note of where it is available as soon as possible. Section 5 requires a media market concentration to be notified to the supervisory authority if it has been notified to the Competition Authority (Konkurrensverket) or to the European Commission.

That duty applies only if the undertakings concerned together had a turnover in Sweden above SEK 1 billion in the preceding financial year and at least one of them is a provider of media services or of an online platform giving access to media content. The person who notified the concentration to the Competition Authority or the Commission is to make the notification to the supervisory authority the same day.

Section 8 requires a person with obligations under Article 6(1), 18(1) to (6), 18(8), 24(1), 24(2), 25(1) or 25(2) of the Regulation, or under section 5, to give the supervisory authority on request the information and documents it needs. Section 9 lets the supervisory authority issue the orders needed to make those articles of the Regulation, or sections 4, 5 or 8, be followed, and an order may carry a periodic penalty (vite).

Section 10 allows an appeal of an order under section 9 to the general administrative court, with leave to appeal required for the administrative court of appeal. Lag (2025:1243) amends sections 8 and 9 with effect from 8 May 2027. From that date section 8 adds a duty on a person with obligations under Article 20(2) or 20(3) of the Regulation to hand over on request the product samples or similar items the authority needs.

Under Förordning (2025:1244), section 5, the Swedish Agency for Media (Mediemyndigheten) is to complete its assessment of a media market concentration within 45 working days of a notification containing the required information. The Act took effect on 1 January 2026.

The Act supplements Regulation (EU) 2024/900 on the transparency and targeting of political advertising. Section 4 makes the authority or authorities the government designates the competent authority under Article 22(3) and (4) of the Regulation. Section 4 also notes that Article 22(1) of the Regulation makes the data protection supervisory authorities competent to supervise Articles 18 and 19.

Under Förordning (2025:1410), section 4, the Swedish Agency for Media (Mediemyndigheten) is the competent authority under Article 22(3) and (4). Section 6 gives the competent authority, beyond the powers in Article 22(5), the power to carry out inspections, decide remedial measures, charge sanction fees and attach periodic penalties to orders.

Section 11 allows a sanction fee from a provider of political advertising services that breaches an obligation under Article 7(1) first sentence, 7(2), 9(1), 9(3), 11(1), 11(3), 12(1), 12(3), 12(4), 13(2) to (4), 14(1) or 21(1) of the Regulation as originally worded. Section 13 sets the sanction fee at a minimum of SEK 5,000 and a maximum of 6 percent of the provider's global annual turnover in the preceding financial year.

Section 10 caps a periodic penalty at 5 percent of the average global daily turnover or daily income per day. Section 18 makes the Administrative Court in Stockholm (Förvaltningsrätten i Stockholm) the competent court. The Act took effect on 1 January 2026. A sanction fee may be decided only for breaches that took place after the Act took effect.

The Government's draft bill of August 2026 says that Directive 85/374 was transposed into Swedish law mainly by Produktansvarslag (1992:18). Section 1 awards damages for personal injury that a product has caused because of a safety deficiency. Section 1 also awards damages for property damage to property usually intended for private use that the injured person mainly used for that purpose. Section 2 defines products under the Act as movable things.

Section 3 gives a product a safety deficiency if it is not as safe as can reasonably be expected. Section 6 makes liable whoever manufactured, produced or collected the damaging product and whoever imported it into the European Economic Area to put it into circulation there. Section 6 also makes liable whoever marketed the product as its own by adding its name, trade mark or another distinguishing mark.

Section 7 makes each person who supplied the product liable where it does not show who is liable under section 6, unless that person names the liable person. Section 7 requires that naming within one month after the injured person made a claim or otherwise asked for it.

Section 8 frees a person from liability who shows that the product was not put into circulation in a business, who makes it probable that the deficiency did not exist then, or who shows that the deficiency results from mandatory rules issued by an authority. Section 8 also frees a person who shows that the scientific and technical knowledge when the product was put into circulation made it impossible to discover the deficiency.

Section 5 makes contract terms that limit liability under the Act without effect. Section 9 deducts SEK 3,500 when compensation for property damage is determined. Section 10 reduces damages as is reasonable where fault on the injured person's side contributed to the damage. Section 12 requires an action within three years from when the claimant received or should have received knowledge that the claim could be made.

Section 12 also requires an action within ten years from when the alleged liable person put the damaging product into circulation. The Government's draft bill says that software can give rise to liability under the Act if it is integrated in a product and is a necessary condition for the product to work. The same draft says that standalone software falls outside the scope of the 1992 Act.

The draft says that product liability for electricity is to stay regulated in the Electrical Safety Act (elsäkerhetslagen). The transitional provisions state that the Act enters into force on 1 January 1993. The Act is recorded as issued on 23 January 1992. The register records the latest amendment as SFS 2022:263.

A provider of a video-sharing platform established in Sweden under the Audiovisual Media Services Directive's establishment test must take appropriate measures so that user-generated videos, TV programs, and audiovisual commercial communications carrying graphic depictions of violence of a realistic nature or pornographic images are not made available in a manner creating a significant risk that children may see them, unless justifiable for particular reasons.

Personal data collected or otherwise generated by a video-sharing platform provider to meet that requirement may not be processed for commercial purposes.

A separate duty in the same chapter requires appropriate measures against user-generated videos, TV programs, or audiovisual commercial communications whose content amounts to specified criminal offences, including unlawful threat, incitement to rebellion, agitation against a population group, child pornography under the Criminal Code, unlawful depiction of violence, or public incitement to terrorism or particularly serious crime.

Mediemyndigheten (the Swedish Media Authority) supervises compliance with these measures and may issue an order, which may carry a conditional fine, to secure compliance; the chapter does not itself specify age verification, identity checks, or another particular technical method as the required measure.

The maker of a press publication has, subject to the limitations stated in Upphovsrättslagen, an exclusive right to control that publication through an information-society service and for online use, by making copies of it and by making it available to the public in a way that lets individuals access it from a place and at a time they individually choose.

That right does not reach a user's use that is not for gain, hyperlinking, or the use of single words or very short extracts of a press publication. It runs until the end of the second year after the year the press publication was published.

Authors whose works form part of a press publication are entitled to an appropriate share of the revenue the publication's maker receives from information-society service providers for exploitation under this right, collected and distributed by an organization representing a substantial number of authors of works used in Sweden in the relevant field.