Search results

Personal data shall not be kept longer than necessary for the purposes of the processing. When the purposes of a particular data processing are fulfilled, the main rule is therefore that the data in q

Yes, it does not matter where the data subject is located in your assessment of whether or not you need to notify the breach to a data protection authority. If you are established in the EU/EEA, the G

All businesses that handle personal data must comply with the General Data Protection Regulation (GDPR). This means, among other things, that you need to follow the fundamental principles, ensure that the processing has a lawful ground and inform the data subjects about how you handle their personal data.

No, you do not need to notify all personal data breaches to IMY. If the breach is unlikely to result in a risk to the rights and freedoms of natural persons, it does not need to be reported to us. Eve

Yes, you may be entitled to compensation if you have suffered material or immaterial damages due to your personal data being processed in violation of the General Data Protection Regulation (GDPR). Yo

Yes, in some cases. IMY can request that the search engine delete search results that appear during searches that can be linked to you as a person, for example, your first and last name. This requires

The Patient Data Act supplements the General Data Protection Regulation (GDPR) and contains rules for the processing of personal data in healthcare. The Patient Data Act must be applied by all healthcare providers, both public and private.

Our website provides information on what you can do if you want to remove information on social media. Targeting on social media (in Swedish) If the post is offensive or harmful, it may be a crime of

No, IMY cannot delete your personal data for you. A common misunderstanding is that IMY can delete your personal data regardless of where it is processed. This is not the case. IMY only holds data abo

Law enforcement authorities shall carry out an impact assessment before any new type of processing of personal data or if there have been significant changes to ongoing processing of personal data. This is only necessary if the processing is likely to result in a specific risk to the privacy of the data subject.