--- title: "Sweden Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/sweden/ source_html: /jurisdictions/sweden/index.html description: "Sweden data protection and privacy regulation: 10 categories, 89 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: cab257a7777575a0824b7d90c33a11fa0ae9feb9380507057f110f0050f26133 generator: "fe-fleet/md-twin@1.0" --- # Sweden Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Sweden Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/sweden/), [World Payments](https://payments.gi/jurisdictions/sweden/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 89 claims · 41 sources in the cumulative register Download report (PDF) Expand all Sweden's data protection authority, IMY, sharpened its enforcement posture materially across several fronts this cycle. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Sectoral Watch (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=SWEDEN)[Build Report](/reports/?j=SWEDEN)[Compare](/compare/?j=SWEDEN) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Integritetsskyddsmyndigheten (IMY) — Swedish Authority for Privacy Protection Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 1 Red categories 57 Sub-modules 89 Claims 17 Tier-1 sources Traffic-light mix 3 green 6 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red Law made at European Economic Area (Bloc) level that applies in Sweden is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Sweden’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,041 Full executive summary 393 ###### Latest update · 4 November 2026 #### Lead Signal Sweden's data protection authority has issued a corrective order against another arm of the state, finding that camera-surveillance signage operated by the national police at Gothenburg Central Station was insufficient. The authority's decision, published 27 October 2026, noted in particular that travellers arriving by train were not adequately warned that they were under camera surveillance, and it has ordered remediation within three months. The decision is a concrete and dated enforcement action rather than a standing or background position, and it sits within the authority's ordinary transparency-duty jurisdiction under camera-surveillance law, extended here to a law-enforcement body rather than a private operator. #### Other Developments The interim allocation of market-surveillance responsibility under the EU AI Act continues to sit alongside the authority's core privacy remit. A government decision of 15 June 2026 designated the data protection authority as one of five bodies — alongside the telecoms regulator, the financial supervisor, the medical products agency and the national accreditation body — with AI Act market-surveillance responsibility, covering in the authority's case AI systems used in law enforcement and in credit assessment. That allocation is explicitly interim, running only until the end of this year, pending a permanent structure expected to follow from the pending government inquiry report known as SOU 2025:101. No change to that allocation, and no further detail on the permanent structure, has emerged. #### Cross-Monitor Connections The interim AI Act market-surveillance designation touches directly on the territory covered by the artificial-intelligence monitor, where the eventual permanent allocation of market-surveillance responsibility among Sweden's five designated regulators will be of direct relevance once the pending inquiry report is acted on. #### Outlook The three-month remediation clock set against the national police now runs to late January 2027; whether the force complies on time, and whether the authority treats any non-compliance as a matter for a further formal sanction, will be the clearest near-term test of how far the authority is willing to press a corrective order against a fellow state body. On the AI Act allocation, the end-of-year expiry of the interim designation means a decision on the permanent market-surveillance structure is due within the next two months, and the authority's role in that structure — particularly whether its current remit over law-enforcement and credit-assessment AI systems is retained, narrowed or widened — is worth watching closely. 3 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Sweden's data protection authority, IMY, sharpened its enforcement posture materially across several fronts this cycle. The clearest single marker is IMY's decision against data processor Sportadmin, dated 28 January 2026, imposing a SEK 6 million fine for inadequate security measures — including the absence of real-time intrusion detection and adequate procedures to identify security gaps — following a 2025 cyberattack that exposed personal data belonging to more than 2.1 million individuals. The Sportadmin decision is notable because it targets a processor directly rather than the controllers whose data the processor handled, a comparatively rare enforcement pattern under GDPR that signals IMY is prepared to pursue processors independently where technical and organisational security measures are found wanting. Taken together with the adtech and cross-border enforcement themes below, the Sportadmin decision forms part of a broader tightening pattern across 2026 that spans processor liability, tracking-technology transfers, and cross-border data flows, rather than sitting as an isolated case. #### Other Developments AdTech tracking-pixel enforcement. IMY imposed administrative fines of SEK 37 million on Apoteket AB and SEK 8 million on Apohem AB for transferring sensitive personal data to Meta via the Meta Pixel tracking tool, among the largest fines IMY has issued and squarely targeting adtech tracking infrastructure rather than a conventional data-security lapse. Cross-border transfer scrutiny. IMY's 2026 enforcement has focused heavily on international data transfers to third countries, with businesses that have not updated Standard Contractual Clauses or completed Transfer Impact Assessments understood to face materially elevated investigation risk; this is a live enforcement theme rather than a discrete case. Data subject rights deadlines enforced strictly. IMY has sanctioned mid-sized organisations for failing to respond to subject access requests within the statutory one-month period, with the response clock running from the date of receipt and no grace period allowed for internal routing or identity verification. Employment-context lawful processing clarified. Recent amendments to Sweden's Dataskyddslagen clarified the legal basis for processing personal data in employment contexts, a national-level clarification sitting alongside the settled GDPR lawful-basis framework. AI in the public sector designated a supervisory priority. IMY has named AI use in the public sector as one of its three guidance-and-supervision priority areas for 2026, building on the January 2025 Digg/IMY generative-AI guidelines; this is a designated priority rather than a concluded investigation or new binding rule. Children and vulnerable groups. The Sportadmin breach involved a sports-club data environment handling children's data, and IMY has separately designated children and young people as a 2026 supervisory priority, though the interpreter's evidence base for this module beyond the Sportadmin context was not independently re-verified this cycle. #### Cross-Monitor Connections The Sportadmin processor-liability decision and the broader security-measures finding it establishes have relevance to the financial-integrity monitor's compliance-technology coverage, insofar as inadequate intrusion-detection and security-gap-identification procedures are a control-adequacy theme that recurs across both data-protection and financial-crime-compliance contexts; this brief does not extend into that adjacent analysis. The AI-in-the-public-sector supervisory priority also intersects with the artificial-intelligence monitor's own coverage of Swedish public-sector AI governance, and readers tracking that theme in depth should consult that monitor's Sweden coverage rather than this one. #### Outlook The Sportadmin decision is likely to be watched closely as a precedent for direct processor liability beyond Sweden, and its practical effect on how processors budget for security investment is a reasonable marker to track in the coming cycle. On cross-border transfers, continued IMY investigation activity tied to outdated Standard Contractual Clauses or missing Transfer Impact Assessments would confirm this cycle's enforcement-focus reading as a sustained theme rather than a temporary emphasis. The AI-in-the-public-sector priority designation is still at the guidance-and-supervision stage rather than a concluded rulemaking, and its translation into concrete supervisory action, if any, is the clearest open item to track next. Read full brief · 1041 words ###### Latest update · 4 November 2026 #### Regulatory Status Sweden's data protection authority remains active on two distinct fronts this period. First, it has issued a corrective order against Polismyndigheten, the national police, after finding that camera-surveillance signage at Gothenburg Central Station was insufficient, with travellers arriving by train singled out as inadequately warned; remediation has been ordered within three months of the decision, published 27 October 2026. Second, the authority continues to carry an interim designation, dated 15 June 2026, as one of five bodies responsible for AI Act market-surveillance in Sweden, with its particular remit covering AI systems used in law enforcement and credit assessment; that designation runs only until 31 December 2026, pending a permanent structure expected from the government inquiry report SOU 2025:101. #### Outlook The camera-signage remediation deadline in late January 2027 and the AI Act interim designation's year-end expiry both fall within the coming months, making this a period in which two separate strands of the authority's current remit are due to be tested or resolved. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Sweden's data protection regulatory picture tightened across multiple fronts this cycle under IMY's supervision. Enforcement highlights include a SEK 6 million fine against data processor Sportadmin (28 January 2026) for inadequate security measures following a 2025 breach exposing over 2.1 million individuals' data, and Meta Pixel tracking-fines against Apoteket AB (SEK 37 million) and Apohem AB (SEK 8 million) for sensitive-data transfers to Meta. IMY's enforcement focus on cross-border data transfers has materially elevated investigation risk for businesses relying on outdated Standard Contractual Clauses or lacking Transfer Impact Assessments, and IMY has sanctioned organisations for missing the statutory one-month subject-access-request response window. On the guidance side, IMY has designated AI use in the public sector and the protection of children and young people as 2026 supervisory priorities, and recent Dataskyddslagen amendments clarified the lawful basis for processing personal data in employment contexts. #### Outlook The Sportadmin decision's processor-liability precedent, the scale of the adtech tracking-pixel fines, and the cross-border-transfer enforcement focus together point to a sustained, broadly tightening IMY supervisory posture into the next cycle; continued enforcement activity across these fronts, together with any concrete output from IMY's AI-in-the-public-sector and children-and-vulnerable-groups priority designations, are the clearest markers to track. Read full brief · 393 words Key regulatory facts for Sweden Regulatory Dimension Sweden Standing Position Jurisdiction Sweden (SE) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 89 sourced findings) Regulator & Framework Comprehensive omnibus regime in force with an active, well-resourced supervisory authority and clear statutory architecture. Lawful Processing & Special Data Core lawful-basis and special-category framework is GDPR-aligned with active national derogations exercised and enforced. Data Subject Rights Full GDPR rights suite in force with demonstrated enforcement of the objection-to-erasure pathway. Controller/Processor Duties Framework is comprehensive and enforced robustly, but repeated large fines (SEK 6m, 37m, 8m) indicate ongoing systemic security-measure compliance gaps among controllers. Primary Instruments Cited IMY, Government of Sweden / hosted via DataGuidance, IMY, IMY, Lawgent Last Confirmed / Updated 2026-11-04 (41 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Sweden: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive omnibus regime in force with an active, well-resourced supervisory authority and clear statutory architecture. Primary framework GDPR (Regulation (EU) 2016/679) as supplemented by the Act with Supplementary Provisions to the GDPR (SFS 2018:218) Supervisory authority [Integritetsskyddsmyndigheten (IMY) — Swedish Authority for Privacy Protection](https://www.imy.se/en/) Traffic-light rationale — Green Comprehensive omnibus regime in force with an active, well-resourced supervisory authority and clear statutory architecture. #### Sub-modules (5) #### Regulator And AuthorityGreen IMY is Sweden's data protection authority responsible for GDPR compliance oversight. Claims (6): - IMY is Sweden's data protection authority whose mission is to work to ensure that individuals' fundamental rights and freedoms are protected in connection with the processing of personal data. - IMY (formerly Datainspektionen) is Sweden's single national GDPR supervisory authority and has been designated under government decision Fi2026/01365 (12 June 2026) as one of five national market-surveillance authorities for the EU AI Act, covering Article 5 prohibited-practice enforcement not allocated to PTS or Finansinspektionen - A Swedish government decision (Fi2026/01365, 15 June 2026) designated five regulators, including IMY, as interim AI Act market-surveillance authorities until 31 December 2026. - Integritetsskyddsmyndigheten (IMY) — IMY is Sweden's GDPR supervisory authority (renamed from Datainspektionen in 2021), subordinate to the Ministry of Justice, with an approximate 2026 budget of SEK 250 million and ~160 employees; PTS separately supervises cookie/ePrivacy rules with an approximate 2026 budget of SEK 318 million and ~530 employees. - IMY — Dataskyddsmyndigheten, citing recurring confusion with other authorities; request pending with government - Integritetsskyddsmyndigheten (IMY) — Sweden's single national GDPR supervisory authority, renamed from Datainspektionen in 2021; PTS separately supervises ePrivacy/cookies #### Act And InstrumentsGreen SFS 2018:218 supplements the GDPR at national level; sectoral instruments (Criminal Data Act, Camera Surveillance Act, Credit Information Act) sit alongside it. Claims (4): - The Act with Supplementary Provisions to the EU General Data Protection Regulation (SFS 2018:218) supplements Regulation (EU) 2016/679 within Sweden. - IMY supervises that the provisions in the Criminal Data Act and the Camera Surveillance Act are complied with, in addition to GDPR compliance. - Swedish Data Protection Act (2018:218) — Sweden's supplementary data protection law is Act (2018:218) with supplementary provisions to the EU Data Protection Regulation (GDPR). - IMY introduced a new internal organisational structure effective 1 January 2026, following a sustained rise in complaint volume that had reduced own-initiative investigation capacity #### Material ScopeGreen Material scope follows GDPR Art 2/4 definitions as applied by IMY guidance for organisations and individuals. #### Territorial ScopeGreen GDPR Art 3 territorial scope applies directly in Sweden as an EU Member State; no SE-specific derogation identified in this research pass. #### Regulator Registration And FilingAmber No general controller registration regime exists, but sector permits/notifications apply: credit information activity requires an IMY licence, and DPO appointments must be notified to IMY under Art 37. Claims (2): - IMY is the supervisory authority for the Credit Information Act and issues licences for those who wish to conduct credit information activity. - IMY handles personal data concerning appointed data protection officers to be able to administrate notifications of data protection officers received in accordance with Article 37 of the GDPR. Sweden is an EU Member State and applies the GDPR directly, supplemented nationally by the Act with Supplementary Provisions to the GDPR (SFS 2018:218). The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) is the competent supervisory authority under GDPR Art 51, and also supervises sector-specific instruments (Criminal Data Act, Camera Surveillance Act, Credit Information Act). No periodic updates recorded in this cycle Sources and claims (12) - [IMY](https://www.imy.se/en/) — IMY is Sweden's data protection authority whose mission is to work to ensure that individuals' fundamental rights and freedoms are protected in connection with the processing of personal data. - [Government of Sweden / hosted via DataGuidance](https://www.dataguidance.com/sites/default/files/swedish_code_of_statuses_2018218_pdf_1_1_0.pdf) — The Act with Supplementary Provisions to the EU General Data Protection Regulation (SFS 2018:218) supplements Regulation (EU) 2016/679 within Sweden. - [IMY](https://www.imy.se/en/about-us/swedish-authority-for-privacy-protections-assignment/) — IMY supervises that the provisions in the Criminal Data Act and the Camera Surveillance Act are complied with, in addition to GDPR compliance. - [IMY](https://www.imy.se/en/about-us/contact-us/telephone-guidance2/) — IMY is the supervisory authority for the Credit Information Act and issues licences for those who wish to conduct credit information activity. - [IMY](https://www.imy.se/en/about-us/swedish-authority-for-privacy-protections-assignment/) — IMY handles personal data concerning appointed data protection officers to be able to administrate notifications of data protection officers received in accordance with Article 37 of the GDPR. - [Lawgent](https://lawgent.se/ai-act-enforcement-sweden-authorities/) — IMY (formerly Datainspektionen) is Sweden's single national GDPR supervisory authority and has been designated under government decision Fi2026/01365 (12 June 2026) as one of five national market-surveillance authorities for the EU AI Act, covering Article 5 prohibited-practice enforcement not allocated to PTS or Finansinspektionen - [Complipath](https://www.complipath.io/eu-ai-act-sweden/) — A Swedish government decision (Fi2026/01365, 15 June 2026) designated five regulators, including IMY, as interim AI Act market-surveillance authorities until 31 December 2026. - [IMY (Integritetsskyddsmyndigheten)](https://www.imy.se/en/news/) — Integritetsskyddsmyndigheten (IMY) — IMY is Sweden's GDPR supervisory authority (renamed from Datainspektionen in 2021), subordinate to the Ministry of Justice, with an approximate 2026 budget of SEK 250 million and ~160 employees; PTS separately supervises cookie/ePrivacy rules with an approximate 2026 budget of SEK 318 million and ~530 employees. - [Complipath](https://www.complipath.io/eu-ai-act-sweden/) — Swedish Data Protection Act (2018:218) — Sweden's supplementary data protection law is Act (2018:218) with supplementary provisions to the EU Data Protection Regulation (GDPR). - [Altinget](https://www.altinget.se/artikel/myndighet-vill-byta-namn-aaterkommande-missforstaand) — IMY — Dataskyddsmyndigheten, citing recurring confusion with other authorities; request pending with government - [IMY (Integritetsskyddsmyndigheten)](https://www.imy.se/en/news/) — Integritetsskyddsmyndigheten (IMY) — Sweden's single national GDPR supervisory authority, renamed from Datainspektionen in 2021; PTS separately supervises ePrivacy/cookies - [Complipath](https://www.complipath.io/eu-ai-act-sweden/) — IMY introduced a new internal organisational structure effective 1 January 2026, following a sustained rise in complaint volume that had reduced own-initiative investigation capacity ### Sweden: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core lawful-basis and special-category framework is GDPR-aligned with active national derogations exercised and enforced. Primary framework GDPR Arts 6-9, as supplemented by SFS 2018:218 Supervisory authority [IMY](https://www.imy.se/en/) Traffic-light rationale — Green Core lawful-basis and special-category framework is GDPR-aligned with active national derogations exercised and enforced. D2 · Lawful Processing — Full Module Record 4 sub-modules · 55 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sweden: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Full GDPR rights suite in force with demonstrated enforcement of the objection-to-erasure pathway. Primary framework GDPR Arts 12-22 Supervisory authority [IMY](https://www.imy.se/en/) Traffic-light rationale — Green Full GDPR rights suite in force with demonstrated enforcement of the objection-to-erasure pathway. #### Sub-modules (5) #### Access RightGreen Data subjects may request confirmation of processing and a free copy of their data plus contextual information. Claims (1): - The right of access means individuals can contact companies, authorities or other organisations to find out whether they are processing their personal data and, if so, receive a copy of it and information about how it is used. #### Rectification And ErasureGreen Erasure available where data is no longer needed, consent withdrawn, unlawfully processed, or (for minors) collected via a childhood social-media profile. Claims (2): - Data subjects have the right to contact a company or authority processing their personal data and request erasure where, among other grounds, the data is no longer needed for the purposes for which it was collected. - Erasure is required if the personal data is about a child and was collected when the child created a profile on a social media platform. #### Restriction And ObjectionAmber Objection to direct marketing triggers mandatory erasure; IMY has fined a company for obstructing exercise of this right. Claims (2): - Erasure must occur if the processing is carried out for direct marketing and the data subject objects to the data being processed. - IMY reviewed complaints and found that a company did not have sufficient systems and routines to make it easier for those who complained to exercise their right to object to direct marketing, issuing a fine of SEK 350,000. #### Data PortabilityGreen Portability right applies per GDPR Art 20; no SE-specific derogation identified. #### Deadlines And Response WindowsAmber GDPR's one-month standard response window applies; no SE-specific shortening/extension found in this pass. GDPR Arts 12-22 rights apply directly, with IMY publishing consumer-facing guidance on access, rectification, erasure and objection. Enforcement activity (H&M direct-marketing case) shows IMY actively polices the objection/erasure interface. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (5) - [IMY](https://www.imy.se/en/individuals/data-protection/your-rights-as-a-data-subject/) — The right of access means individuals can contact companies, authorities or other organisations to find out whether they are processing their personal data and, if so, receive a copy of it and information about how it is used. - [IMY](https://www.imy.se/en/individuals/data-protection/your-rights-as-a-data-subject/) — Data subjects have the right to contact a company or authority processing their personal data and request erasure where, among other grounds, the data is no longer needed for the purposes for which it was collected. - [IMY](https://www.imy.se/en/individuals/data-protection/your-rights-as-a-data-subject/) — Erasure must occur if the processing is carried out for direct marketing and the data subject objects to the data being processed. - [EDPB / IMY](https://www.edpb.europa.eu/news/national-news/2023/sweden-sa-imy-issues-administrative-fine-against-hm-making-it-difficult_en) — IMY reviewed complaints and found that a company did not have sufficient systems and routines to make it easier for those who complained to exercise their right to object to direct marketing, issuing a fine of SEK 350,000. - [IMY](https://www.imy.se/en/individuals/data-protection/your-rights-as-a-data-subject/) — Erasure is required if the personal data is about a child and was collected when the child created a profile on a social media platform. ### Sweden: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Framework is comprehensive and enforced robustly, but repeated large fines (SEK 6m, 37m, 8m) indicate ongoing systemic security-measure compliance gaps among controllers. Primary framework GDPR Arts 5, 24-43; SFS 2018:218 Ch.1 §8 Supervisory authority [IMY](https://www.imy.se/en/) Traffic-light rationale — Amber Framework is comprehensive and enforced robustly, but repeated large fines (SEK 6m, 37m, 8m) indicate ongoing systemic security-measure compliance gaps among controllers. Periodic update · new data 2026-10-25 #### Controller/Processor Duties IMY imposed a SEK 1.8 million administrative sanction fee on Miljödata i Karlskrona AB, published 22 September 2026, for violation of Article 32(1) GDPR. The decision follows a major data breach resulting from a cyberattack against the company, and IMYs investigation found that the controller had failed to implement sufficient technical and organisational measures to ensure a level of security appropriate to the risk, the core requirement of Article 32(1). This is a confirmed, named enforcement decision anchored directly to IMYs own published materials, making it the clearest and most material data protection finding of this cycle. The fine confirms that IMY continues to treat security-of-processing failures, particularly those that culminate in or are exposed by an actual breach, as warranting substantial administrative sanctions rather than warnings or lesser remedial measures alone. A SEK 1.8 million fee, while below the very largest sanctions IMY has issued in prior years, is nonetheless a material amount for a controller of Miljödatas scale and signals that the authority continues to scrutinise the adequacy of security measures closely once a breach has occurred and come to its attention. The decision reinforces a now well-established enforcement pattern in which IMY works backward from an actual breach event to assess whether the underlying technical and organisational measures were, in fact, adequate under Article 32(1) at the time of the incident, rather than treating the occurrence of a breach alone as proof of inadequate security. The specific technical findings underlying the SEK 1.8 million figure, beyond the general characterisation of insufficient security measures, have not been independently itemised within this cycles review. #### Outlook The Miljödata decision is likely to continue informing how Swedish controllers prioritise security-of-processing investment, particularly around incident response and breach-prevention measures, given IMYs demonstrated willingness to impose material fines following breaches. Whether IMY publishes further detail on the specific technical and organisational deficiencies identified in the Miljödata case, which would offer controllers more concrete guidance on what IMY considers an appropriate security standard under Article 32(1), is a relevant development to watch for in coming cycles. Periodic update · new data 2026-10-18 #### Controller/Processor Duties IMY opened a supervisory review on 7 October 2026 into how the controller responsible for the Abybadet public swimming facility in Molndal municipality processes personal data belonging to children who use the facility. This is reported as a newly opened review rather than a concluded enforcement matter, and no outcome has been reported within this window. The review falls under controller/processor duties because it concerns security and processing-practice scrutiny of a specific controller, the municipal operator of the facility, rather than a sector-wide rule change. No other controller/processor development, whether concerning security-measure standards, processing-record obligations, or data-protection-impact-assessment practice, was evidenced this cycle beyond this single opened review. #### Outlook The outcome of IMY's review into Abybadet's data-processing practices is the key item to watch for this module: a published finding would clarify what security and processing standard IMY expects of municipal facility operators handling children's data, and whether any corrective or enforcement measure follows the review. Until that outcome is published, the practical content of the obligation at issue is confirmed only at the level that a review has been opened, not at the level of what standard was found to have been breached, if any. Periodic update · new data 2026-09-28 #### Controller/Processor Duties IMY fined Miljödata i Karlskrona AB SEK 1.8 million on 22 September 2026 for violating GDPR Article 32(1), the obligation to implement appropriate technical and organisational security measures. The decision cited inadequate controls over software installation and the absence of real-time intrusion monitoring as the specific deficiencies underlying the breach. The enforcement action followed a breach in August 2025 that exposed the personal data of 2.2 million people, a scale of exposure that places this among the more significant security-of-processing enforcement actions IMY has issued, and one directed at a supplier serving the municipal public sector rather than a single private controller. The Miljödata case illustrates a security-of-processing enforcement pattern that IMY has applied elsewhere: fines following demonstrated security failures after a breach has already occurred, rather than proactive audits absent an incident. This is consistent with the broader enforcement record IMY built through 2025 and into 2026, where security-failure fines following data breaches, at Apoteket AB, Apohem AB and Sportadmin among others, recur as a category of enforcement distinct from procedural or consent-related fines. For controllers and processors operating in or with the Swedish public sector, the Miljödata decision underscores that supplier-side security failures can generate direct IMY enforcement exposure even where the supplier, rather than the public-sector customer, is the immediate subject of the fine. #### Outlook The item to track is whether IMY's related investigations into the two municipalities and one region connected to the Miljödata breach progress to further enforcement findings, which would extend accountability for the security failure to the public-sector controllers that relied on Miljödata's processing, in addition to the processor-side fine already issued. D4 · Controller & Processor — Full Module Record 7 sub-modules · 43 words · 10 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sweden: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Framework is GDPR-standard, but enforcement record shows repeated transfer-related transparency and security failures involving US ad-tech processors. Primary framework GDPR Arts 44-49 Supervisory authority [IMY](https://www.imy.se/en/) Traffic-light rationale — Amber Framework is GDPR-standard, but enforcement record shows repeated transfer-related transparency and security failures involving US ad-tech processors. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 63 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sweden: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Multiple active sectoral overlays with demonstrated enforcement gaps, particularly in financial transparency and health-data security. Primary framework GDPR plus Credit Information Act, Criminal Data Act, Electronic Communications Act (LEK) Supervisory authority [IMY](https://www.imy.se/en/) Traffic-light rationale — Amber Multiple active sectoral overlays with demonstrated enforcement gaps, particularly in financial transparency and health-data security. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 45 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sweden: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Repeated, large enforcement actions (Google Analytics, Meta Pixel across two retailers) indicate systemic non-compliance in the adtech/commercial tracking space. Primary framework GDPR plus Electronic Communications Act (LEK) Ch.9 §28 Supervisory authority [IMY](https://www.imy.se/en/) Traffic-light rationale — Red Repeated, large enforcement actions (Google Analytics, Meta Pixel across two retailers) indicate systemic non-compliance in the adtech/commercial tracking space. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 40 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sweden: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Binding biometric/surveillance rules exist (Camera Surveillance Act, Criminal Data Act) but AI-specific governance remains largely soft-law/guidance stage pending fuller EU AI Act interface. Primary framework GDPR Art 22; Camera Surveillance Act; Criminal Data Act Supervisory authority [IMY](https://www.imy.se/en/) Traffic-light rationale — Amber Binding biometric/surveillance rules exist (Camera Surveillance Act, Criminal Data Act) but AI-specific governance remains largely soft-law/guidance stage pending fuller EU AI Act interface. Periodic update · new data 2026-11-04 #### Algorithmic, Biometric & Surveillance Governance Sweden's data protection authority has, in a decision published 27 October 2026, found that camera-surveillance signage operated by Polismyndigheten, the national police, at Gothenburg Central Station was insufficient. The finding noted specifically that travellers arriving by train lacked adequate signage warning them they were under surveillance, a gap the authority treated as a breach of the transparency obligations attached to camera surveillance by a public body. The authority has ordered remediation within three months of the decision. The order is notable less for its subject matter, which sits squarely within the authority's established camera-surveillance jurisdiction, than for its target: a corrective order issued against a fellow state authority rather than against a private or commercial operator, in an area where law-enforcement surveillance activity is often treated with greater deference. This sits alongside a separate and so far unchanged feature of the governance landscape: the interim allocation of market-surveillance responsibility under the EU AI Act. A government decision dated 15 June 2026 named the data protection authority as one of five bodies carrying AI Act market-surveillance responsibility, together with the telecoms regulator, the financial supervisor, the medical products agency and the national accreditation body. Within that allocation, the data protection authority's remit covers AI systems used in law enforcement and in credit assessment. The arrangement is explicit about its own limits: it runs only until 31 December 2026, pending the permanent structure expected to follow the government inquiry report SOU 2025:101. Nothing in the available material points to any change in that allocation or to the content of the anticipated permanent structure. #### Outlook The Polismyndigheten remediation window runs to late January 2027. Whether the force meets that deadline, and whether a missed deadline draws a further or sharper response from the authority, will indicate how firmly the authority is prepared to hold a law-enforcement body to the same transparency standard applied to commercial camera operators. On the AI Act allocation, the interim designation's year-end expiry means the shape of the permanent market-surveillance structure should become clearer within roughly two months; whether the authority's current law-enforcement and credit-assessment remit survives that transition intact, is narrowed, or is reallocated elsewhere among the five designated bodies, is the principal open question going into the new structure. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance IMY has designated AI in the public sector as one of three formal supervisory and guidance priority areas for 2026, with a stated focus on how public bodies use artificial intelligence in ways that support privacy-safe deployment. This institutional priority is settled and confirmed through IMYs own published mission and supervision materials, though no new binding rule specific to this area has been identified strictly within this cycles search window. This priority designation should be read alongside IMYs separate, newly confirmed designation as one of five national market-surveillance authorities for the EU AI Act, covering Article 5 prohibited-practice enforcement not otherwise allocated to the Swedish Post and Telecom Authority or Finansinspektionen. Taken together, these two developments, a formal 2026 supervisory priority on public-sector AI and a confirmed AI Act enforcement designation, indicate that algorithmic governance is increasingly occupying a central position within IMYs institutional priorities, rather than being treated as a peripheral or emerging concern. The specific focus on public-sector AI use, as distinct from private-sector or commercial AI deployment, reflects a recognition that government bodies processing personal data through AI systems carry particular privacy-safety considerations given the scale and sensitivity of data typically involved in public administration, and given the more limited ability of residents to opt out of interacting with public-sector systems compared with commercial alternatives. #### Outlook The convergence between IMYs data protection mandate and its AI Act market-surveillance role is the central dynamic to watch in this area going forward. Specific guidance, decisions or enforcement actions emerging from either the public-sector AI priority or the Article 5 AI Act designation would mark a transition from stated institutional priority to concrete supervisory practice, and would be the clearest signal of how IMY intends to exercise its expanding algorithmic-governance remit in practice. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Two developments mark this module this cycle. First, Sweden's interim national competent-authority structure under the AI Regulation, designated 12 June 2026, comprises PTS as lead coordinator alongside IMY, Finansinspektionen, Lakemedelsverket and Swedac. This designation is explicitly interim, valid until 31 December 2026, pending final implementing legislation that had been targeted for commencement on 2 August 2026. Whether that implementing legislation has in fact commenced as targeted, and whether it supersedes the interim designation before its 31 December 2026 lapse date, is not confirmed from the sources retrieved this window; this is a live gap in the record rather than a settled fact. Second, the European Data Protection Board issued a statement on smart glasses, emphasising that such devices need to clearly indicate to bystanders when recording is taking place. This is an EU-level statement rather than a Sweden-specific instrument, but it was reported through IMY's own news channel on 14 October 2026, placing the issue within the set of matters the Swedish regulator is currently amplifying to its public audience. Device-makers and users of recording-capable biometric-adjacent wearables in the Swedish market should treat this as a live transparency expectation at EU level, pending any Sweden-specific implementation or guidance. #### Outlook The principal item to watch is whether Sweden's AI Act national implementing legislation commences on or near its targeted 2 August 2026 date and what it does to the current multi-authority interim structure, which is due to lapse on 31 December 2026 regardless. A second item is whether IMY, as one of the designated AI Act authorities, issues any Sweden-specific follow-through on the EDPB's smart-glasses statement, which currently stands as an EU-level position reported but not yet transposed into domestic guidance. Periodic update · new data 2026-09-28 #### Algorithmic, Biometric & Surveillance Governance Sweden's approach to surveillance governance moved in a liberalising direction on 1 April 2025, when the permit requirement for public-space camera surveillance was removed. Organisations deploying public-space cameras now rely on documented legitimate-interest assessments rather than obtaining prior approval from IMY, representing a material deregulation of what had previously functioned as a surveillance-permit gate. This shift places greater responsibility on deploying organisations to conduct and document their own legitimate-interest analysis, with IMY's ex-ante gatekeeping role removed from the process. At the same time, IMY has signalled a sharpened focus on a different category of algorithmic governance: the regulator named artificial intelligence in the public sector as one of three guidance-and-supervision priority areas for 2026, alongside data protection for children and young people and law-enforcement tools. This priority-area designation is forward-looking and does not yet reflect a substantive rule change or enforcement action; it indicates where IMY intends to direct supervisory attention rather than a new binding obligation. Read together, the camera-permit removal and the AI supervisory priority suggest a regulator stepping back from one older form of ex-ante technology gatekeeping while positioning to scrutinise a newer one. #### Outlook The item to watch is whether IMY's 2026 focus on AI in the public sector produces concrete guidance or the first enforcement action under that priority, which would give the currently forward-looking supervisory signal a substantive regulatory shape. Separately, monitoring whether the removal of the camera-surveillance permit requirement leads to any documented increase in public-space surveillance deployments would clarify the practical effect of the deregulation. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 70 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sweden: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Clear statutory age-of-consent rule exists and is actively supervised, but a major 2026 breach affecting children's data shows continuing real-world exposure risk. Primary framework GDPR Art 8, as implemented by SFS 2018:218 Supervisory authority [IMY](https://www.imy.se/en/) Traffic-light rationale — Amber Clear statutory age-of-consent rule exists and is actively supervised, but a major 2026 breach affecting children's data shows continuing real-world exposure risk. Periodic update · new data 2026-10-25 #### Children & Vulnerable Groups IMY launched FantomApp, an application designed to help young people in Sweden manage their social-media security and privacy settings. The launch forms part of the authoritys 2026 priority area focused on children and young people, confirming that this remains an active area of institutional attention for IMY this year. The underlying legal thresholds and specific regulatory basis informing the apps design and functionality were not independently re-verified within this cycles review. The launch of a practical consumer-facing tool, rather than guidance or enforcement action alone, is a notable departure in form from IMYs more typical outputs in this area, which have historically tended toward published guidance documents or enforcement decisions. A tool explicitly aimed at helping young people configure their own privacy and security settings suggests an approach oriented toward empowering individual users directly, in addition to any parallel regulatory or supervisory activity targeting the platforms themselves. This development should be read as confirming the priority focus area itself, children and young people, as an active and resourced strand of IMYs 2026 work programme, rather than as evidence of any specific new legal obligation or enforcement standard applicable to social-media platforms or other controllers processing childrens data in Sweden. #### Outlook Whether FantomApp is accompanied by, or followed by, any parallel guidance or enforcement activity targeting social-media platforms themselves regarding their handling of young users data is a relevant development to watch for in coming cycles. The uptake and reception of the tool among its intended young-person user base may also inform whether IMY expands this direct-to-consumer tooling approach to other priority areas in the future. Periodic update · new data 2026-10-18 #### Children & Vulnerable Groups IMY opened a supervisory review on 7 October 2026 into how personal data belonging to children is processed at the Abybadet public swimming facility in Molndal municipality. This is the same underlying review referenced under controller/processor duties, filed here under the children-specific module because its subject matter concerns the processing of children's personal data specifically, rather than a general security-practice question. The review's outcome remains pending; no finding, corrective order, or enforcement decision has been reported within this window. This review sits alongside the European Data Protection Board's statement on smart glasses, which, while not children-specific, bears on a related theme of surveillance and recording transparency that affects bystanders broadly, including children present in public spaces. IMY's attention to children's data in a public-facility context, combined with the EDPB's broader recording-transparency statement reported via IMY's own channel, together indicate continued regulator focus on vulnerable-groups and surveillance-adjacent issues even though neither matter has yet produced a concluded enforcement decision. #### Outlook The outcome of the Abybadet review is the item to watch for this module: a published finding will establish what standard IMY expects for processing children's personal data at municipally operated public facilities, and whether Molndal's facility operator is found to have met or fallen short of that standard. Given that the review was only opened on 7 October 2026, resolution may not fall within the next immediate window, but any interim guidance or preliminary findings would be a material development for operators of similar public facilities handling children's data elsewhere in Sweden. D9 · Children's Privacy — Full Module Record 5 sub-modules · 59 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Sweden: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong, well-documented enforcement powers and activity, but no confirmed Swedish-specific collective-redress/class-action mechanism was located. Primary framework GDPR Arts 58, 83-84; SFS 2018:218 Supervisory authority [IMY](https://www.imy.se/en/) Traffic-light rationale — Amber Strong, well-documented enforcement powers and activity, but no confirmed Swedish-specific collective-redress/class-action mechanism was located. Periodic update · new data 2026-11-04 #### Enforcement & Redress The clearest enforcement signal from Sweden this period is a corrective order rather than a financial penalty. The data protection authority found, in a decision published 27 October 2026, that camera-surveillance signage maintained by Polismyndigheten at Gothenburg Central Station was insufficient, with the specific deficiency being a lack of adequate warning signage for travellers arriving by train. The authority has ordered that the deficiency be remedied within three months. No administrative fine decision under the general penalty provisions has been located in connection with this matter; the remedy sought is corrective rather than punitive, consistent with the authority's practice of pairing a finding of inadequate compliance with a defined timetable for remediation rather than moving directly to a monetary sanction, at least on a first finding of this kind. The redress dimension here is institutional rather than individual: the order runs against a state authority exercising a law-enforcement function, and its practical effect is to require Polismyndigheten to improve public notice of surveillance at a major transport hub, rather than to compensate any identified individual complainant. The authority's willingness to issue this kind of order against a fellow arm of the state, in an area as sensitive as police surveillance in a public transport setting, indicates that the general transparency obligations attached to camera surveillance are being applied without a carve-out for law-enforcement operators. #### Outlook The three-month compliance window places the relevant deadline in late January 2027. The principal question for the redress track is what happens if that deadline passes without full remediation: whether the authority treats a missed deadline as warranting escalation toward a formal penalty, or continues to rely on corrective dialogue with Polismyndigheten. Either outcome will be informative as a marker of how the authority calibrates enforcement intensity when the respondent is another state body rather than a private company. Periodic update · new data 2026-10-25 #### Enforcement & Redress The SEK 1.8 million administrative sanction fee imposed by IMY on Miljödata i Karlskrona AB, published 22 September 2026 for a violation of Article 32(1) GDPR, stands as the most recent and most material enforcement decision in Swedens data protection landscape. The decision followed a major data breach caused by a cyberattack, with IMYs investigation finding that the companys technical and organisational security measures had been insufficient given the risk involved. This decision is significant for what it confirms about IMYs enforcement posture more broadly: the authority continues to treat inadequate security-of-processing measures, particularly where a breach has actually materialised, as warranting formal administrative sanctions. The decision is well anchored to IMYs own primary publication, giving it a high degree of evidentiary confidence as the clearest enforcement signal available. No other named enforcement decisions were identified within this cycles review window. The Miljödata case therefore represents the single concrete enforcement data point available, though it is a materially significant one given both the confirmed Article 32(1) violation finding and the substantial fee amount relative to the scale of the underlying company. #### Outlook The Miljödata decision is likely to be referenced as a benchmark by Swedish controllers assessing their own security-of-processing adequacy, particularly those handling similarly sensitive categories of data to those involved in the Miljödata breach. Whether further enforcement decisions emerge in the coming cycles, and whether any such decisions reveal a broader thematic focus beyond security-of-processing specifically, such as unlawful processing bases or inadequate data subject rights handling, is the key development to watch for in assessing the overall direction of IMYs enforcement priorities. Periodic update · new data 2026-09-28 #### Enforcement & Redress IMY's enforcement activity in 2026 is anchored by the SEK 1.8 million fine against Miljödata i Karlskrona AB for GDPR Article 32(1) security-of-processing violations, issued 22 September 2026 following an August 2025 breach that exposed 2.2 million people's data. This sits within a broader enforcement-powers framework under which IMY may issue warnings for planned processing likely to violate the GDPR, reprimands for ongoing violations, and orders to bring processing into compliance or cease specific activities, in addition to administrative fines that can reach up to four percent of global turnover or twenty million euros; Sweden notably makes public authorities subject to such fines, unlike some other Member States. IMY's 2025 enforcement record shows a mix of scale: three smaller fines against SL, WÅAB and DO totalled only SEK 250,000, while separate, larger fines were issued against Apoteket AB at SEK 37 million, Apohem AB at SEK 8 million, and Sportadmin at SEK 6 million, each tied to security failures following data breaches. This pattern indicates that IMY's largest fines cluster specifically around post-breach security failures rather than other categories of GDPR violation, a pattern the Miljödata fine continues. Historically, IMY's enforcement practice has also been shaped by private-complaint pressure: a 2022 NOYB inaction complaint against IMY's four-year delay in handling a complaint against Spotify was decided in the complainants' favour, after which IMY imposed a GDPR fine of SEK 58 million on Spotify. #### Outlook The enforcement trend to track is whether IMY's investigations connected to the Miljödata breach, reportedly extending to two municipalities and one region, produce further fines against the public-sector controllers involved, which would indicate IMY is willing to pursue accountability up the data-processing chain rather than concluding enforcement at the processor level. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 67 words · 16 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 8 [Children & Vulnerable Groups](#sec-cat-children_and_vulnerable_groups) parental consent Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties