Skip to content

Make a whistleblower report if your employer does not comply with data protection rules

You can submit a whistleblower report to IMY if you have information that the organisation you currently work for, have previously worked for or are have applied to work for, is violating the General Data Protection Regulation (GDPR) or supplementary national legislation like the Data Protection Act.

You may report violations involving actions taken by the organisation, or its failure to act as required. The misconduct can be intentional or unintentional, ongoing or completed.

Who can make a whistleblower report to IMY?

To be covered by the Whistleblowing Act, you must be an employee or belong to one of the other categories listed below. Only then will your report be treated as a whistleblower report by IMY.

You are covered by whistleblower protection if you belong to one of the following categories:

  • employee
  • person making an enquiry about or applying for a job
  • person applying or carrying out voluntary work
  • person applying or carrying out a traineeship
  • person otherwise carrying out work under the control and direction of an organisation, for example if you are employed by a temporary work agency but work for another organisation
  • self-employed person seeking or carrying out work
  • person who is available to be, or is, part of a company’s administrative, management or supervisory body, for example the board of directors or the managing director
  • shareholders who are available to be or who are active in the limited company
  • person who has previously belonged to one of the categories above and has received or obtained the information during that time.

 

Your identity is protected 

When IMY handles your whistleblower report , we are not allowed to disclose information that could reveal your identity. In some cases however, we may need to share identifying information with other supervisory departments within IMY. Even then, the information will not be disclosed if it could harm you or someone close to you.

Information that can be linked to another person or company is also protected. This could be, for example, information about your employer or colleagues. However this protection is not as strong. That type of information may be disclosed if it does not pose a risk of harm, unless confidentiality is necessary to safeguard IMY’s supervision and investigation.

Other protections for whistleblowers

As a whistleblower your employer is not allowed to obstruct or retaliate against you for making a report. You also cannot be penalised for breaching a duty of confidentiality or a provision related to obtaining information, provided that certain legal conditions are met.

Your employer is not allowed to prevent you from whistleblowing or punish you for doing so. This also includes protection if you consult your employee organisation or trade union before making the report. Retaliation can take many forms, such as being excluded or isolated in the workplace, dismissed from your job, denied a promotion, given different tasks or working hours, refused training opportunities, or treated unfairly in other ways.

The protection also extends to certain people connected to you as a whistleblower. This may include colleagues, relatives, or individuals who have supported or helped you in the process of whistleblowing.

Confidentiality refers to any restriction that limits on your ability to share information, whether the restriction comes from a contract, workplace policy, employer decision, or the law. For example, you might whistleblow about something that you normally would have to keep secret under the duty of loyalty in labour law, or a confidentiality clause in a contract.

You may be exempt from liability if you had reasonable grounds to believe that disclosing the confidential information was necessary to reveal the wrongdoing. However, It is important to note that this protection does not give you the right to disclose documents themselves. You may describe the content of the documents, but not hand over or publish the actual material.

There are exceptions from when you can be released from liability. You are not exempt from liability if you deliberately breach a qualified duty of confidentiality under the Public Access to Information and Secrecy Act (2009:400), or a duty under the Defence Inventions Act (1971:1078).

You may be exempted from liability if, prior to reporting, you break certain rules related to how you accessed or collected the information. These rules may be stated in legislation, decisions or agreements.  For example, you might have accessed information without proper authorisation, copied material you were not allowed to, or removed information from a secure location.

In these cases, you may be exempt from liability if you had reasonable grounds to believe that obtaining the information was necessary in order to expose the wrongdoing.

To be protected under the Whistleblowing act, you must be an employee or belong to another group covered by the law. The misconduct you report must concern the organisation where you currently work, have worked in the past, or applying to working for. It can also relate to another organisation you have come into contact with through your work.

You may also be protected if you report a serious risk or wrongdoing that has not yet happened but is highly likely to occur.

For the protection to apply, you must also have reasonable grounds to believe that the information about the wrongdoing is true. You do not need to provide proof, but your concerns must be well-founded. The information must not already be fully publicly available, and it must not be based on unverified rumours or hearsay.

Please note that the protection against retaliation and exemption from liability for breaching confidentiality or rules on obtaining information do not apply if you commit a criminal offence such as theft, unlawful access (trespass), or a data breach.

If your employer prevents you from whistleblowing or retaliates against you for doing so, you may be entitled to compensation. This can include compensation for both financial loss and emotional harm or victimisation.

Please note that any claim for compensation must be pursued on your own initiative, through the appropriate legal channels. IMY cannot assist you in this process.

 

How to whistleblow

If you wish to make a whistleblower report, you can contact IMY via a dedicated phone line or submit a written report by letter. Only authorised staff at IMY will receive and handle your report.

You can submit your report by post. Remember to include your telephone number and/or your postal address if you would like to receive a response regarding your case. We cannot contact you by e-mail.

You are not required to provide contact details, but if you choose not to IMY will be unable to follow up with you about your report

To submit your report:

  1. Place your report in an envelope and seal it.
  2. Write ‘External whistleblowing’ on the envelope and nothing else.
  3. Place the sealed envelope in a second envelope and send it to:

Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm

You can call IMY on our dedicated whistleblowing telephone number. We do not record calls. You may use this number both to make a report and to ask questions or raise concerns related to whistleblowing.

Telephone: 08-657 61 53

Opening hours: Thursdays 9.30-11.30

If you prefer to report in person, you can book an appointment to visit IMY’s office. To do so, contact us by letter or by calling 08-657 61 53. Telephone opening hours are Thursdays 09.30-11.30.

Please include a telephone number or postal address where we can reach you. Note that we are unable to contact you by email.

 

Do not use e-mail

Important: Please do not send whistleblower reports by e-mail. We do not consider e-mail secure enough for handling this type of sensitive information.

What happens after you submit a whistleblower report?

Only specially authorised staff at IMY will receive and handle your whistleblower report. If your report contains information that provides grounds for initiating supervision, the relevant details will be forwarded to one of IMY's supervisory units. It is then up to that unit to decide whether or not to open a formal supervision case.

You can also file a complaint

If you believe that someone is processing your personal data in violation of the GDPR, you can also file a complaint with IMY. This applies regardless of whether the situation is work-related or not. IMY has an obligation to investigate complaints under the GDPR. However, please note that filing a complaint does not grant you the same legal protection as submitting a whistleblower report under the Whistleblowing Act.

Complain about a processing of your personal data  

Processing of personal data in whistleblower cases  

Please see the information below on how we process your personal data when you submit a whistleblower report.

Processing of personal data in whistleblower cases (in Swedish)  

Latest update: 7 July 2025
Page labels Data protection