What Is GDPR + Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning (Swedish Data Protection Act)?
Sweden applies the EU General Data Protection Regulation directly, supplemented by Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, commonly called the Swedish Data Protection Act. The Act entered into force on 25 May 2018 alongside the GDPR and supplies Swedish rules for national-law opening clauses, including sensitive data in employment and social-protection contexts, personal identity numbers, complaint handling, and limits on certain rights. The current Riksdag record is a consolidated text, not the untouched 2018 version. The supervisory authority is Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection. IMY says it has been Sweden’s data-protection authority since 1973 and changed its name from Datainspektionen on 1 January 2021. It supervises GDPR and complementary Swedish data-protection rules, handles complaints and breach notifications, and can issue warnings, reprimands, orders, and administrative fines within the applicable framework. Sweden’s framework has an important constitutional boundary. The Data Protection Act says the GDPR and the Act do not apply to the extent that doing so would conflict with the Freedom of the Press Act or the Fundamental Law on Freedom of Expression, and it removes specified GDPR chapters and Swedish chapters for journalism and academic, artistic, or literary creation. That boundary, together with Sweden’s constitutional principle of public access to official documents, makes publication by search services and aggregation of public records a fact-specific question rather than ordinary GDPR deletion boilerplate.
At a glance
- Full name
- GDPR + Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning (Swedish Data Protection Act)
- Short code
- GDPR + Data Protection Act
- Jurisdiction
- Sweden
- Enacted
- 2018
- Last major update
- The current Riksdag text remains SFS 2018:218 and is marked amended through SFS 2026:1589. The 2025 amendment (SFS 2025:256) changed the complaint-handling provision in Chapter 6, section 8; a 2026 amendment concerning foreign-intelligence processing is marked to enter into force on 1 January 2027. No replacement supplementary act was located in the reviewed current sources
- Regulator
- Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection
- Private right of action
- Yes
Scope, who GDPR + Data Protection Act covers
Protected data
Data subject rights
Right to information and access under GDPR Articles 13–15, subject to statutory secrecy and other access limitations
Right to rectification of inaccurate or incomplete personal data (Article 16)
Right to erasure or restriction where the GDPR conditions are met (Articles 17–18), subject to legal, public-interest, freedom-of-expression, and other exceptions
Right to data portability for qualifying consent- or contract-based processing (Article 20)
Right to object, including an unconditional right to object to direct marketing (Article 21)
Right not to be subject to qualifying decisions based solely on automated processing, including profiling (Article 22)
Right to complain to IMY about allegedly incorrect processing and to receive information about the complaint handling in the circumstances set out in the Swedish Act
Right to compensation for qualifying damage caused by unlawful processing (GDPR Article 82 and Chapter 7, section 1 of the Swedish Act)
Right to have personnummer or coordination-number processing justified by the purpose, the need for reliable identification, or another considerable reason when consent is absent; this is a processing safeguard, not a general deletion right
Notable features
Sweden’s Chapter 1, section 7 constitutional rule protects the relationship with the Freedom of the Press Act and the Fundamental Law on Freedom of Expression: the GDPR and Swedish Act do not apply to the extent of a conflict, and specified GDPR provisions do not apply to journalism or academic, artistic, or literary creation. The Freedom of the Press Act also constitutionalises public access to official documents, although official documents can be secret to protect, among other interests, individuals’ personal or economic circumstances. IMY separately cautions that GDPR access is not the same thing as a right to receive a public document.
Enforcement & penalties
Regulator: Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection
Penalties: GDPR Article 83 provides the general two-tier administrative-fine structure: up to €10 million or 2% of worldwide annual turnover for the lower tier, and up to €20 million or 4% for the higher tier, whichever is higher. The Swedish Act permits IMY to fine public authorities for Article 83.4–83.6 infringements, with Swedish ceilings of SEK 5 million for Article 83.4 matters and SEK 10 million for Article 83.5–83.6 matters. IMY may also issue corrective measures such as warnings, reprimands, and orders; the applicable provision and facts control the outcome.
Private right of action: GDPR Article 82 provides a compensation route for qualifying material or non-material damage. IMY explains that a person may claim compensation from the controller or processor or bring a court action, while IMY itself does not obtain compensation for the individual. The existence and amount of a claim remain dependent on the facts and applicable exceptions.
Relevance to data brokers
Swedish people-search and public-record services can involve personal data, personnummer, criminal-data rules, public-access law, and constitutional publication protection at the same time. IMY has ongoing supervisory reviews involving Lexbase, Krimfup, Upplysning, and Mrkoll; the authority says these reviews concern whether search services are acting contrary to GDPR by publishing criminal-conviction data in searchable databases or failing to erase personal data after requests. No dedicated Swedish data-broker opt-out registry or concluded universal removal rule was located in the reviewed sources, so a request must be assessed against the operator’s role, source, legal basis, constitutional status, and the particular data.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Is Sweden governed by the GDPR or a separate national privacy law?+
Both. The GDPR applies directly, and Sweden’s Data Protection Act (SFS 2018:218) supplements it with Swedish rules and derogations. The current Riksdag record is amended through SFS 2026:1589, so the Act should not be described as unchanged since 2018.
Does a Swedish personal identity number have special protection?+
Yes. Under Chapter 3, section 10 of the Swedish Act, personnummer and coordination numbers may be processed without consent only when clearly justified by the purpose, the importance of reliable identification, or another considerable reason. This does not create an automatic right to delete every use of a personnummer.
Can I require a Swedish people-search service to remove my information?+
You can make a GDPR request where the applicable conditions are met, but removal is not guaranteed. The result may depend on the service’s legal basis, the type and source of data, secrecy and public-access rules, and whether the service has constitutional protection under Sweden’s press or expression laws. IMY’s current reviews of several search services show that these questions remain legally and factually active.
Official sources & citations
- Sveriges riksdag: current consolidated Swedish Data Protection Act (SFS 2018:218)
- EUR-Lex: General Data Protection Regulation (Regulation (EU) 2016/679)
- IMY: About the Swedish Authority for Privacy Protection and its 2021 name change
- IMY: current GDPR full text and update date
- IMY: current data-subject rights guidance
- IMY: complain about incorrect processing
- Government Offices of Sweden: the principle of public access to official documents
- IMY: current supervisory reviews of search services with publication certificates
Other international privacy regimes
GDPR + Data Protection Act sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: