Search results

The Swedish Privacy Protection Authority (IMY) has done a supervision of a personal data incident at the Equality Ombudsman (DO). IMY concludes that the DO did not take sufficiently effective security measures and issues an administrative fine of SEK 100,000.

Data protection by design and data protection by default is a requirement for all data controllers, and applies to companies of all sizes. The term privacy by design and by default is also used when talking about data protection by design and by default.

Read about the data subject's rights according to the GDPR.

An organisation that processes personal data is in certain cases required to designate a data protection officer. The role of the data protection officer is to check that the General Data Protection Regulation is complied with within the organisation by means of, for example, conducting checks and providing information. On this page you can find out more about data protection officers.

All organisations must comply with the applicable data protection legislation when processing personal data, regardless if you are a public authority, a small company or an association.

When you enter our website imy.se, no cookies are set. However, cookies are set if you use our e-services, quiz feature, forms or make your own settings in our listening function.

The Swedish Authority for Privacy Protection is responsible for the processing of personal data for which the authority determines the purpose and means. The authority processes, for example, personal data in the handling of the authority's business, in the handling of questions and in the administration of courses and subscriptions.

In January 2025, the Swedish Agency for Digital Government (Digg) together with the Swedish Authority for Privacy Protection (IMY) launched guidelines to encourage the use of generative AI in public administration. The purpose of the guidelines is to enhance the ability to use generative AI in a safe, ethical and efficient way.

The Swedish Authority for Privacy Protection (IMY) has decided to impose administrative fines of SEK 37 million on Apoteket AB and SEK 8 million on Apohem AB. This comes after the companies used the so-called Meta Pixel on their websites and transferred sensitive personal data to Meta.

The Swedish Authority for Privacy Protection (IMY) has fined Aktiebolaget Storstockholms Lokaltrafik (SL) and Waxholms Ångfartygs AB (WÅAB) for processing personal data relating to sobriety tests conducted by employees in breach fo the GDPR. IMY issues an administrative fine of SEK 75, 000 against each companies.