Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Sweden enforces GDPR through IMY and, since 15 January 2026, a standalone Cybersecurity Act (Cybersäkerhetslagen) transposing NIS2, with sector-by-sector enforcement now centered on the FRA's National Cybersecurity Centre.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Directly applicable EU regulation governing personal data processing; sets the 72-hour breach notification standard and the €20m/4% fine cap uniformly across the EEA.
SourceSweden's supplementary act to the GDPR, in force since 25 May 2018, replacing the old Personal Data Act. Sets national derogations, e.g. on processing by public authorities and certain sector rules.
SourceSweden's NIS2 transposition, adopted December 2025 and in force since 15 January 2026, replacing the old Information Security Act. Expands scope to the 18 NIS2 sectors under a 'whole-entity' obligation model.
Source72 hours
Controllers must notify IMY without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, per GDPR Article 33, no Swedish gold-plating on this deadline.
Notify: IMY (Integritetsskyddsmyndigheten)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceApplicable , as of 2026-09-08
Fully transposed via the Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026, roughly 14 months after the EU's 17 October 2024 deadline. Supervisory responsibility moved twice during 2026, most recently to the Nationellt cybersäkerhetscenter (NCSC) at Försvarets radioanstalt (FRA) on 1 July 2026, alongside 18 sector-specific competent authorities.
SourceIntegritetsskyddsmyndigheten (Swedish Authority for Privacy Protection)(IMY)
Visit authority siteIMY (Integritetsskyddsmyndigheten), Sweden's data protection authority, within 72 hours of becoming aware of the breach where feasible, per GDPR Article 33.
The Cybersäkerhetslagen (Cybersecurity Act, SFS 2025:1506), in force since 15 January 2026, about 14 months later than the EU's original 17 October 2024 deadline.
As of 1 July 2026, the Nationellt cybersäkerhetscenter (NCSC) at Försvarets radioanstalt (FRA) holds the central supervisory role, alongside sector-specific competent authorities for each of the 18 NIS2 sectors.
Talk to us about scoping an engagement around your specific regulatory context.
