Swedish Data Protection Act (Dataskyddslagen)

· About Swedish Data Protection Act (Dataskyddslagen)

Key Takeaways

  • The Swedish Data Protection Act (Dataskyddslagen, SFS 2018:218) complements the GDPR in Sweden and applies to personal data processing where the GDPR allows national rules, especially for public authorities and certain sensitive-data situations.
  • The Swedish Authority for Privacy Protection (IMY) enforces the Act and the GDPR in Sweden, and it remains the central supervisory authority for data protection matters.
  • A 2025 amendment strengthened complaint handling by allowing a complainant, after three months without a substantive response from IMY, to request a decision; this change took effect on 1 May 2025.
  • Sweden also adopted a 2026 amendment package that changed section 27 and introduced Chapter 9, section 6a, with at least part of the package entering into force on 1 August 2026.
  • Penalties under the Act are limited and specific, with sanction fees available for enumerated infringements and, in some cases, other public-law consequences; the Act does not create a general standalone Swedish privacy-fine regime separate from the GDPR.

What It Is

The Swedish Data Protection Act, formally Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, is Sweden’s national supplement to the GDPR.[8][13] It fills in the areas where EU law permits member states to add national rules, rather than replacing the GDPR’s core framework.[8][13]

The Act is enforced by the Swedish Authority for Privacy Protection (IMY), which is Sweden’s data protection authority and the body responsible for protecting individuals’ fundamental rights and freedoms in relation to personal data processing.[2][5]

The Act was adopted in April 2018 and entered into force on 25 May 2018, the same day as the GDPR became applicable.[8][12] A key 2025 phase-in date was 1 May 2025, when new complaint-procedure provisions came into effect.[15] A further 2026 amendment package was issued in 2026, with at least one change taking effect on 1 August 2026.[1]

Who Must Comply

The Act applies as a Swedish complement to GDPR-covered processing in Sweden, so its practical reach is broad wherever GDPR applies and Swedish national derogations matter.[8][13] That includes controllers and processors established in Sweden, as well as foreign entities processing personal data in a way that falls under the GDPR and intersects with Swedish supplementary rules.[8][13]

It is especially relevant for public authorities, employment-related processing, and other areas where Swedish law makes national choices within the GDPR’s margin of discretion.[8][13] The Act also supports sector-specific rules on matters such as criminal-data processing and other nationally regulated processing contexts.[1][4][8]

The main exemptions are not full exemptions from data protection law, but situations where the GDPR itself does not apply, or where another law validly displaces a general rule through a specific derogation or legal obligation.[3][8] In practice, the most important threshold question is whether the processing is governed by the GDPR; if so, the Swedish Act may add conditions, procedures, or limits.[8][13]

Core Requirements

  1. Use a lawful basis and Swedish supplementary rules together. The GDPR supplies the core lawful-basis framework, while the Swedish Act adds national provisions that can affect how processing is carried out in Sweden.[8][13]
  1. Treat public-sector processing as specially regulated. Swedish supplementary law contains additional rules for public authorities, meaning public bodies cannot rely only on the GDPR’s general text when assessing legality and disclosures.[8][13]
  1. Apply the complaint-right procedure correctly. Since 1 May 2025, a complainant who has waited three months without a substantive response from IMY may request a decision, and may appeal a decision by the authority to stop further supervisory action.[15]
  1. Check whether a sanction fee can apply to the specific infringement. Sweden uses enumerated sanction-fee provisions rather than a fully open-ended national penalty regime, so the legal basis for any fee must be identified in the Act or related provisions.[1]
  1. Handle special categories and sensitive contexts with extra care. Swedish supplementary rules address nationally sensitive processing areas, including certain employment and criminal-data contexts, where the Act may narrow or condition processing that the GDPR otherwise permits.[4][8]
  1. Monitor updates to the Act and related ordinances. Sweden has continued to amend the Act, including a 2026 package affecting section 27 and adding Chapter 9, section 6a, so compliance teams must review current consolidated text before relying on older guidance.[1]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | Adoption of Dataskyddslagen | April 2018 | Parliament adopted the supplementary national data-protection law.[8] | | Entry into force | 25 May 2018 | The Act became applicable alongside the GDPR.[8][12] | | Complaint-procedure amendment | 1 May 2025 | A complainant may seek a decision after three months without a substantive IMY response.[15] | | Section 27 / Chapter 9 amendment package | 1 August 2026 | A 2026 amendment changed section 27 and added Chapter 9, section 6a.[1] |

The available 2026 materials indicate that Sweden uses sanction fees for certain listed infringements, with one cited provision setting a fee of SEK 5,000 to SEK 10 million, and in some cases up to 10% of the trader’s turnover in the preceding financial year.[1] The Act also allows IMY to issue supervisory decisions and, in the complaint context, to decide not to pursue further action, which can then be appealed in the circumstances introduced in 2025.[15]

How to Comply

  1. Map your processing to the GDPR and Swedish supplements. Build a record of processing activities that identifies where Swedish national law changes the default GDPR analysis, especially for public-sector, employment, and special-category processing.[8][13]
  1. Classify data and use-case sensitivity early. Identify whether the processing involves special categories, criminal-data issues, or personal identity numbers, because Swedish supplementary rules can impose tighter conditions in those areas.[4][8]
  1. Assign ownership for IMY-facing matters. Create a clear internal process for complaints, supervisory requests, and time-bound responses so the organization can respond consistently if IMY or a data subject escalates a matter.[2][15]
  1. Embed controls aligned to ISO 27001. Use ISO 27001-style controls for access management, logging, incident handling, and supplier governance, because those controls support the GDPR security and accountability baseline that the Swedish Act assumes.[8][13]
  1. Use NIST CSF 2.0 to organize cyber risk. Map identify-protect-detect-respond-recover functions to personal-data processing systems so privacy compliance and cyber resilience stay aligned, especially for public authorities and high-risk processing.[8][13]
  1. Adopt ISO 42001 where AI processing touches personal data. If AI systems process personal data, use an AI management system to document governance, risk treatment, transparency, and human oversight, while separately checking Swedish and EU privacy rules.[1][8]
  1. Review sanctions and appeals paths annually. Confirm the current consolidated Act and any amending acts each year, because 2025 and 2026 changes show that procedural rights and sanction provisions can move quickly.[1][15]

Related Regulations

The GDPR is the primary instrument; the Swedish Act supplements it and cannot override the Regulation’s directly applicable core rules.[8][13]

The Data Protection Ordinance (2018:219) works with the Act as the domestic implementing framework and should be reviewed together with the statute.[4][8]

The Public Access to Information and Secrecy Act can conflict with disclosure expectations under privacy law, especially for public bodies that must balance openness and confidentiality.[8][13]

The Swedish Electronic Communications Act and related sector rules can overlap where personal data arises in communications services, requiring a combined privacy-and-telecom analysis.[1][4]

The EU AI Act increasingly overlaps where automated systems process personal data, but it is not a substitute for GDPR compliance or the Swedish Act’s national provisions.[1][13]

FAQ

Does the Swedish Data Protection Act apply to companies outside Sweden?

Yes, if the processing falls under the GDPR and Swedish supplementary rules are relevant. Extraterritorial reach follows the GDPR’s structure, so a foreign business can still need to observe Swedish national conditions when processing relates to Sweden or Swedish data subjects.[8][13]

Does the Act replace the GDPR in Sweden?

No. The GDPR remains the core law, and the Swedish Act only adds national provisions where EU law allows it.[8][13]

What changed in 2025?

On 1 May 2025, Sweden introduced a complaint-handling rule letting a complainant ask IMY for a decision after three months without a substantive response.[15] That change strengthened procedural remedies rather than rewriting the GDPR framework.[15]

What changed in 2026?

A 2026 amendment package changed section 27 and added Chapter 9, section 6a, with part of the package effective from 1 August 2026.[1] The practical lesson is that compliance teams should check the current consolidated Swedish text before relying on earlier summaries.[1]

What are the penalties under the Act?

The Act uses specific sanction-fee provisions for certain infringements, rather than a single universal national fine structure.[1] One cited provision sets a fee range of SEK 5,000 to SEK 10 million, and up to 10% of turnover in the preceding financial year for certain traders.[1]

Who enforces the law in Sweden?

The Swedish Authority for Privacy Protection (IMY) is the national supervisory authority.[2][5] It handles complaints, oversight, and supervisory action under the privacy framework.[2][5][15]

Sources

Put it into practice

More compliance guides