🇸🇪Data Protection Act (2018:218)

← Back to laws in Sweden

Act (2018:218) with Supplementary Provisions to the EU GDPR

Sweden applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Act supplements the GDPR, extends parts of it outside EU-law scope and supplies Swedish rules on expression, children, sensitive and criminal data, identifiers, research and enforcement.

National additions and variations

• Chapter 2 section 4 sets 13 as the Article 8 consent age for children resident in Sweden and applies regardless of where the controller or processor is established.
• Chapter 1 section 7 protects constitutional press and expression rules and disapplies specified GDPR and national provisions for journalistic, academic, artistic and literary purposes.
• Chapter 3 regulates sensitive employment, social-protection, health, archive and statistical data, and restricts private-sector criminal-data processing unless authorised by regulation or decision.
• Personal identity and coordination numbers may be processed without consent only where clearly justified by purpose, secure identification or another substantial reason.
• Chapter 4 limits decisions or measures against people using data held solely for archives, statistics or research; Chapter 5 creates secrecy and unfinished-text access restrictions.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.