Sweden

Sweden's national top-up law is Lag (2018:218), which sits alongside the European privacy rules. It has been in force since 25 May 2018. It does not narrow who the European General Data Protection Regulation reaches. It adds Swedish-only rules on top. Two stand out. Chapter 2 section 4 covers the age at which a child can consent. Chapter 3 section 10 covers Swedish personal identity numbers. Industry laws such as the Gambling Act and the Protective Security Act have their own separate reach. The Gambling Act binds anyone who holds or needs a Swedish licence, wherever the company is registered.

Industry by industry, all checked 18 August 2026: - Online gambling: data must stay in the country Gambling Act chapter 16 section 2 says the licence holder's gaming system must be placed in Sweden. Two ways out exist. Hold a licence in another supervised country whose regulator has an agreement with the Swedish Gambling Authority. Or give the Swedish Gambling Authority remote access to the system. - Telecoms records kept for law enforcement: data must stay in the country at European Union level. Ordinance (2022:511) chapter 9 section 4, third paragraph, says the data may not be stored outside the European Union. Storage anywhere inside the European Union is fine. Storage in the United States or the United Kingdom is not. - Security-sensitive activity and classified information: data must stay in the country Protective Security Ordinance (2021:955) chapter 3 section 9 requires an international protective security undertaking before classified information goes to a foreign authority or an international organisation. Chapter 3 section 2 requires written consultation with the Swedish Security Service before you deploy any system handling material classified confidential or above. - Accounting records: data can leave only if conditions are met, with Sweden as the default. Bookkeeping Act chapter 7 section 2 says the records must be kept in Sweden. Chapter 7 section 3a allows electronic storage in another European Union country. You must tell the Swedish Tax Agency, give it immediate online access, and be able to print the records in Sweden. Outside the European Union you need a mutual assistance arrangement, or the Tax Agency's specific permission under chapter 7 section 4. - Mapping, aerial imagery and sea-depth data: data can leave only if conditions are met Act (2016:319) bans spreading a compilation of geographic information about Swedish waters, or gathered from aircraft, without a permit. Breaking that ban is a crime. - Public sector: data can leave only if conditions are met There is no law about where the data must sit. Secrecy law is what stops you instead. See Q7. - Health, banking, payments, insurance, securities, telecom subscriber data and education: we found no rule about where data must be stored, checked 18 August 2026. Swedish patient records law sets a ten-year minimum for keeping records but says nothing about where they sit.

Sweden's data protection authority publishes guidance that mirrors the European position. That means official decisions that a country is safe enough, standard contractual clauses with extra safeguards, group-wide binding rules, and narrow one-off exceptions. Sweden has issued no national transfer rules and no national list of its own. Two Swedish points sit outside privacy law. Retained telecoms data cannot leave the European Union at all, even to an approved country. And classified information needs a state-level protective security undertaking rather than a commercial contract. On 3 July 2026 the Swedish authority published a note that a United States Supreme Court decision may affect transfers to the United States. That note tracks the European Data Protection Board's letter to the Commission of 31 July 2026.

The Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten, was renamed from Datainspektionen in 2021. Its public supervision register showed 129 supervision cases. Decisions are dated 27 May 2026 (Svensk Bakgrundsanalys) and 16 June 2026 (Securitas Sverige). Two more are dated 2 July 2026 (Coast Guard) and 3 July 2026 (Police Authority, Visa Information System). Its style is active rather than aggressive. Decisions come often, but Swedish fines are moderate by European standards. National law caps fines on public authorities at 5 million Swedish kronor (about 500,000 US dollars) for lesser breaches. For serious ones the cap is 10 million kronor (about 1 million US dollars). Under the Cybersecurity Act, in force since 15 January 2026, supervision is split across industry regulators. Those are the Energy Agency, the Transport Agency, Finansinspektionen and the Health and Social Care Inspectorate. They also include the Medical Products Agency, the Food Agency, the Post and Telecom Authority and six county administrative boards. The National Defence Radio Establishment is the national incident response team and single point of contact.

Minimums. The Bookkeeping Act chapter 7 section 2 sets seven years, counted from the end of the calendar year in which the financial year ended. The records must be kept in Sweden unless you meet the conditions in chapter 7 sections 3a to 4. The Patient Data Act chapter 3 section 17 covers patient records. Each one must be kept for at least ten years after the last entry. Longer periods are possible by ordinance. Telecoms operators covered by the law-enforcement keeping duty must hold specified traffic and subscriber data. They may not store it outside the European Union. Public authorities are also bound by the Archives Act, which starts from keeping records rather than deleting them. That is the opposite default to the private sector. Maximums. Article 5(1)(e) of the European General Data Protection Regulation limits how long you may keep data, and the Swedish Authority for Privacy Protection enforces it. Camera surveillance footage has no fixed period in law, so you fall back on what is necessary. Note that Sweden's exact telecoms keeping periods for each type of data are set below the level of statute. They are flagged as unconfirmed in this record.

Deadline 1. Article 33 of the European General Data Protection Regulation gives you 72 hours to tell the Swedish Authority for Privacy Protection. Article 34 says you tell the people affected without undue delay where the risk is high. Deadline 2. The Swedish Cybersecurity Act, Cybersäkerhetslagen (2025:1506), chapter 2 section 5, requires an early warning within 24 hours of learning about the incident. Chapter 2 section 6 requires an incident report within 72 hours. That drops to 24 hours for trust service providers. Deadline 3. The European digital resilience regulation, Regulation (EU) 2022/2554, is topped up by Lag (2024:1278). Financial firms report major information and communication technology incidents to Finansinspektionen. Deadline 4, from 1 January 2027 if it is passed. The proposed Critical Entities Resilience Act would add a 24-hour incident report for critical operators in eleven industries. Separately, a security incident in security-sensitive activity is reported to the Security Service or the Armed Forces under protective security rules.

(1) Lag (2018:218) chapter 2 section 4 lets a child living in Sweden consent to online services from the age of 13. (2) Chapter 3 section 10 says Swedish personal identity numbers and coordination numbers may be used without consent only where clearly justified by the purpose. (3) Public access to official documents is a constitutional principle in Sweden. A document that reaches an authority is in principle public, unless a ground for secrecy applies. (4) Offentlighets- och sekretesslagen (2009:400) chapter 3 section 1 defines secrecy. It is a ban on disclosure by speech, by handing over an official document, or in any other way at all. That is why simply making data technically reachable by a provider is legally risky. Chapter 10 section 2 a, added by Lag (2023:335), creates a narrow exception. It covers a provider engaged only to handle or store the data technically, and only where using it is not inappropriate. (5) Lag (2016:319) section 12 sets the penalty at a fine or up to one year in prison. A sixth, softer trap. Swedish law caps fines on public authorities at 5 million and 10 million kronor. That sounds lenient until you see the effect. It removes the fear factor and pushes Swedish regulators towards orders to stop using the data instead.

Dated items. Proposition 2025/26:303 is a bill for a new law on the resilience of critical operators. It puts the European Critical Entities Resilience Directive into Swedish law. The bill proposes that the new law and the other changes start on 1 January 2027. It is a bill, not a law, and must not be planned around as binding. The European Data Act's deadline for zero cloud exit fees, 12 January 2027, applies in Sweden automatically. The proposed European Cloud and Artificial Intelligence Development Act was presented on 3 June 2026 and is years from adoption. The Swedish government says it will take an active part in the negotiations. Powers that can be used at any time, which matter more than pending bills: - The Gambling Authority controls whether a licence holder may keep its gaming system abroad. If it withdrew the remote-access arrangement, systems would have to come back to Sweden with no new law needed. - The Security Service can order that a planned outsourcing may not go ahead, under Protective Security Act chapter 4 section 11. That is a veto over a signed cloud contract. It is used case by case and is not published. - The Armed Forces, Lantmäteriet and Sjöfartsverket control permits for geographic information and can tighten the conditions without new law. The government can also switch on restrictions on aerial photography at times it designates. - The national cloud policy can be reissued with binding purchasing requirements, with no new law. - The European Union–United States Data Privacy Framework remains valid, but it is under appeal at the Court of Justice. The European Data Protection Board formally questioned it on 31 July 2026. The Swedish Authority for Privacy Protection flagged the issue on 3 July 2026.