Sweden

Sweden's national top-up is Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, in force since 25 May 2018. It does not narrow the territorial reach of the EU General Data Protection Regulation; it adds Swedish-specific rules, notably chapter 2 section 4 (age of consent) and chapter 3 section 10 (Swedish personal identity numbers). Sector statutes such as the Gambling Act and the Protective Security Act have their own, separate reach: the Gambling Act binds anyone holding or needing a Swedish licence, wherever incorporated.

Sector-by-sector ratings, all checked 18 August 2026: - Online gambling: data must stay in the country. Gambling Act chapter 16 section 2 — 'Licenshavarens spelsystem ska vara placerat i Sverige.' Two escapes exist: a licence in another supervised country whose regulator has an agreement with the Swedish Gambling Authority, or giving the Swedish Gambling Authority remote access to the system. - Telecoms records retained for law enforcement: data must stay in the country at European Union level. Ordinance (2022:511) chapter 9 section 4, third paragraph — 'Uppgifterna får inte lagras utanför Europeiska unionen.' Storage anywhere in the European Union is fine; storage in the United States or United Kingdom is not. - Security-sensitive activity and classified information: data must stay in the country. Protective Security Ordinance (2021:955) chapter 3 section 9 requires an international protective security undertaking before classified information goes to a foreign authority or an international organisation, and chapter 3 section 2 requires written consultation with the Swedish Security Service before any information system handling confidential-or-above material is deployed. - Accounting records: data can leave with the right paperwork with a Sweden-first default. Bookkeeping Act chapter 7 section 2 — 'De ska förvaras i Sverige.' Chapter 7 section 3a permits electronic storage in another European Union country on notification to the Swedish Tax Agency plus immediate online access and the ability to print in Sweden; outside the European Union only where mutual assistance arrangements exist, or with the Tax Agency's specific permission under chapter 7 section 4. - Mapping, aerial imagery and sea-depth data: data can leave with the right paperwork. Act (2016:319) bans disseminating a compilation of geographic information about Swedish waters or gathered from aircraft without a permit, and breach is a criminal offence. - Public sector: data can leave with the right paperwork. No localisation statute, but secrecy law bites — see Q7. - Health, banking, payments, insurance, securities, telecom subscriber data, education: no storage-location rule found, checked 18 August 2026. Swedish patient records law sets a ten-year minimum retention but says nothing about where records sit.

Sweden's data protection authority publishes guidance mirroring the European position: adequacy decisions, standard contractual clauses with supplementary measures, binding corporate rules, and narrow one-off derogations. Sweden has issued no national transfer instrument and no national list. Two Swedish-specific twists sit outside privacy law: retained telecoms data cannot leave the European Union at all even to an approved country, and classified information needs a state-level protective security undertaking rather than a commercial contract. On 3 July 2026 the Swedish authority published a note that a United States Supreme Court decision may affect transfers to the United States, tracking the European Data Protection Board's 31 July 2026 letter to the Commission.

Integritetsskyddsmyndigheten (IMY) was renamed from Datainspektionen in 2021. Its public supervision register showed 129 supervision cases and decisions dated 27 May 2026 (Svensk Bakgrundsanalys), 16 June 2026 (Securitas Sverige), 2 July 2026 (Coast Guard) and 3 July 2026 (Police Authority, Visa Information System). Enforcement style is active rather than aggressive: decisions are frequent, but Swedish fines are moderate by European standards and public authorities are capped by national law at 5 million Swedish kronor (about 500,000 US dollars) for lesser breaches and 10 million kronor (about 1 million US dollars) for serious ones. Under the Cybersecurity Act in force since 15 January 2026, supervision is split across sector regulators — the Energy Agency, the Transport Agency, Finansinspektionen, the Health and Social Care Inspectorate, the Medical Products Agency, the Food Agency, the Post and Telecom Authority and six county administrative boards — while the National Defence Radio Establishment is the national incident response team and single point of contact.

Floors: Bookkeeping Act chapter 7 section 2 — seven years from the end of the calendar year in which the financial year ended, and the records must be kept in Sweden unless the chapter 7 sections 3a-4 conditions are met. Patient Data Act chapter 3 section 17 — 'En journalhandling ska bevaras minst tio år efter det att den sista uppgiften fördes in i handlingen', with longer periods possible by ordinance. Telecoms operators subject to the law-enforcement retention duty must keep specified traffic and subscriber data and may not store it outside the European Union. Public authorities are also bound by the Archives Act, which starts from a presumption of preservation rather than deletion — the opposite default to the private sector. Ceilings: GDPR Article 5(1)(e) storage limitation, enforced by IMY; camera surveillance material has no fixed statutory period and falls back on necessity. Note that Sweden's exact telecoms retention periods per data category are set below statute level and are flagged as unconfirmed in this record.

Clock 1 — GDPR Article 33: 72 hours to IMY; Article 34: notify individuals without undue delay where the risk is high. Clock 2 — Cybersäkerhetslagen (2025:1506) chapter 2 section 5: early warning within '24 timmar efter det att verksamhetsutövaren har fått kännedom om incidenten'; chapter 2 section 6: incident report within 72 hours, reduced to 24 hours for trust service providers. Clock 3 — DORA (Regulation (EU) 2022/2554) as supplemented by Lag (2024:1278), for financial entities reporting major information and communication technology incidents to Finansinspektionen. Clock 4 (from 1 January 2027, if enacted) — the proposed Critical Entities Resilience Act would add a 24-hour incident report for critical operators in eleven sectors. Separately, a security incident in security-sensitive activity is reported to the Security Service or the Armed Forces under protective security rules.

(1) Lag (2018:218) chapter 2 section 4: 'Vid erbjudande av informationssamhällets tjänster direkt till ett barn som bor i Sverige ska behandling av personuppgifter vara tillåten med stöd av barnets samtycke, om barnet är minst 13 år.' (2) Chapter 3 section 10: 'Personnummer och samordningsnummer får behandlas utan samtycke endast när det är klart motiverat med hänsyn till ändamålet med behandlingen.' (3) The principle of public access to official documents is constitutional; a document that reaches an authority is in principle public unless a secrecy ground applies. (4) Offentlighets- och sekretesslagen (2009:400) chapter 3 section 1 defines secrecy as a ban on disclosure 'muntligen, genom utlämnande av en allmän handling eller på något annat sätt', which is why merely making data technically reachable by a provider is legally fraught; chapter 10 section 2 a, added by Lag (2023:335), creates a narrow exception for a provider engaged 'endast tekniskt bearbeta eller tekniskt lagra uppgiften' and only where it is 'inte olämpligt'. (5) Lag (2016:319) section 12: 'döms till böter eller fängelse i högst ett år.' A sixth, softer trap: public-authority fines under Swedish law are capped at 5 million and 10 million kronor, which sounds lenient until you realise it removes the fear factor and pushes Swedish regulators towards orders to stop processing instead.

Dated: Proposition 2025/26:303, 'En ny lag för ökad motståndskraft hos kritiska verksamhetsutövare', implementing the European Critical Entities Resilience Directive — 'Den nya lagen och övriga lagändringar föreslås träda i kraft den 1 januari 2027.' It is a bill, not law, and must not be planned around as binding. The EU Data Act's zero cloud-egress-fee deadline of 12 January 2027 applies in Sweden automatically. The proposed EU Cloud and AI Development Act was presented on 3 June 2026 and is years from adoption; the Swedish government says it will engage actively in the negotiations. Dormant switches, which matter more than pending bills: - The Gambling Authority controls whether a licensee may keep its gaming system abroad; withdrawing the remote-access accommodation would force repatriation with no legislation needed. - The Security Service can, under Protective Security Act chapter 4 section 11, order that a planned outsourcing 'inte får genomföras' — a veto over a signed cloud contract, exercised case by case and not published. - The Armed Forces, Lantmäteriet and Sjöfartsverket control geographic-information permits and can tighten conditions administratively; aerial photography restrictions can be switched on by the government at times it designates. - The national cloud policy can be reissued with binding procurement requirements without new legislation. - The European Union–United States Data Privacy Framework remains valid but is under appeal at the Court of Justice and was formally questioned by the European Data Protection Board on 31 July 2026; IMY flagged the issue on 3 July 2026.