Search results

Read about the data subject's rights according to the GDPR.

The Swedish Authority for Privacy Protection (IMY) is focusing on three areas in its guidance and supervision during 2026. These areas are crime prevention, children and young people, and AI in the public sector.

The Swedish Privacy Protection Authority (IMY) has done a supervision of a personal data incident at the Equality Ombudsman (DO). IMY concludes that the DO did not take sufficiently effective security measures and issues an administrative fine of SEK 100,000.

The Swedish Authority for Privacy Protection (IMY) has supervised the company Sportadmin following an IT attack in which a large volume of personal data was leaked. The review shows that Sportadmin did not have an appropriate level of security to protect the personal data the company processed. IMY therefore decides to impose an administrative fine of SEK 6 million.

The Swedish Authority for Privacy Protection is responsible for the processing of personal data for which the authority determines the purpose and means. The authority processes, for example, personal data in the handling of the authority's business, in the handling of questions and in the administration of courses and subscriptions.

Swedish Authority for Privacy Protection (IMY) has about 160 employees, most of whom are lawyers. Our organisation reflects our areas of operations and the way we work.

The Swedish Authority for Privacy Protection (IMY) concludes that SL, who operate the public transport in Stockholm, has violated GDPR when equipping ticket inspectors with body cameras that record video and sound. The IMY issues an administrative fine against SL of SEK 16 million.

We work to protect all your personal data, such as information about your health and finances, ensuring it is handled properly and does not fall into the wrong hands. Here you can read more about our mission and how we operate.

The Swedish Data Protection Authority (IMY) criticizes the Hospital Board in Region Uppsala, for not having taken sufficient security measures in connection with the processing of personal data about, among other things, health, in e-mail.