ARTICLE · 12 APRIL 2013

Data Protection Laws of the World Handbook: Second Edition - Sweden

DLA Piper Australia

Explore more from DLA Piper Australia

As a member of the EU, Sweden implemented the EU Data Protection Directive 95/46/EC in 1998 with the Personal Data Act.

SwedenPrivacy

Jennifer M. Kashatus

Richard Van Schaik

Carol A.F. Umhoefer

+1 more

LAW

Being a member of the European Union, Sweden implemented the EU Data Protection Directive 95/46/EC in 1998 with the Personal Data Act (Sw. personuppgiftslagen, SFS 1998:204, below "the Act"). The previous Swedish Data Act enacted in 1973 had by then already been considered to be outdated for many years.

DEFINITION OF PERSONAL DATA

Personal data means all kinds of information that is directly or indirectly referable to a natural living person.

DEFINITION OF SENSITIVE PERSONAL DATA

Sensitive personal data means personal data that discloses race or ethnic origin, political opinions, religious or philosophical convictions and membership of trade unions. Personal data relating to health or sexual life is also embraced by the term.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

Related Articles

The Swedish Cybersecurity Act Autumn 2026 – Supervision So Far And New Requirements From 1 October

Advokatfirman Vinge KB

Does A Press Certificate Exempt Data Brokers From GDPR?

Cybersäkerhetslagen – senaste nytt efter sommaren

Advokatfirman Cederquist KB

Ny utredning ska se över regelverket för vårdens behandling av personuppgifter

Advokatfirman Cederquist KB

Adekvansbeslutet för dataöverföringar mellan EU och USA utmanas

European UnionPrivacy

Advokatfirman Cederquist KB

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Privacy
- Data Protection

Related Comparative Guides

Comparative Guide

Data Protection & Cybersecurity

See more popular content from

Privacy

Does A Press Certificate Exempt Data Brokers From GDPR?

The EU Court of Justice has ruled on whether Swedish press certificates can shield commercial data brokers from GDPR obligations. The landmark decision clarifies that holding a press certificate does not automatically exempt companies from data protection law, and that running a paid database of personal information without genuine editorial processes does not qualify as journalism.

Cybersäkerhetslagen – senaste nytt efter sommaren

Swedish cybersecurity regulations stemming from NIS 2 have transitioned from implementation to practical application during summer 2026. The National Cybersecurity Centre (NCSC) within the Swedish Defence Radio Establishment (FRA) has assumed responsibility for cyber operations, while new incident reporting requirements and security measures are being phased in.

Advokatfirman Cederquist KB

The Swedish Cybersecurity Act Autumn 2026 – Supervision So Far And New Requirements From 1 October

The Swedish Cybersecurity Act has been in force for eight months, with supervisory authorities beginning enforcement activities focused primarily on notification obligations and incident reporting.

Advokatfirman Vinge KB

Adekvansbeslutet för dataöverföringar mellan EU och USA utmanas

The transfer of personal data from the EU to the USA faces renewed scrutiny following a US Supreme Court ruling that grants the President authority to remove Federal Trade Commission members. This development challenges the independence requirements underlying the EU-US Data Privacy Framework and its adequacy decision, potentially jeopardizing the legal basis for transatlantic data transfers that thousands of organizations rely upon.

European UnionPrivacy

Advokatfirman Cederquist KB

The Swedish Data Protection Authority Changes Its Name To The Swedish Authority For Privacy Protection (IMY)

Since 1 January 2021, the Swedish Data Protection Authority, has a new name - the Swedish Authority for Privacy Protection (IMY). IMY is the supervisory authority for matters concerning the...

Foyen Advokatfirma

Ny utredning ska se över regelverket för vårdens behandling av personuppgifter

The Swedish government has initiated an inquiry to review existing regulations on personal data processing in healthcare. The investigation will analyze how current provisions can be updated to meet technological developments while facilitating patient-centered research and maintaining individual privacy protection.

Advokatfirman Cederquist KB

The Territorial Scope Of The GDPR

The territorial scope of the General Data Protection Regulations (the ‘GDPR' or the ‘regulation') is determined within Article 3, adopting two main criteria for this purpose; ‘establishment' and ‘targeting'.

The Klarna Ruling Clarifies The Requirements Surrounding The Obligation To Provide Information According To GDPR

On 11 March 2024, the Stockholm Administrative Court of Appeal handed down a judgement in case 2829-23, establishing that Klarna Bank AB must pay a fine of SEK 7.5 million due to violations...

Europe's Digital Omnibus

In November 2025, the European Commission proposed the Digital Omnibus, which aims to make parts of the EU's digital regulation easier to work with.

Swedish Trading Company Faces Million Euro Fine For Using Meta Pixel

Swedish company in advertently transfers data of up to a million people to Meta. Significant fine imposed. Swedish banking and trading provider, Avanza, was using a so-called Meta pixel on its website and mobile app.