Last review date: 17 December 2025
Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide data privacy and other data-related legislation applicable across all EU Member States, such as the EU GDPR and the EU AI Act.
- Swedish Personal Data Protection Act
- Swedish Personal Data Protection Regulation
- Swedish Criminal Data Act
The Swedish Criminal Data Act (implementing the EU Data Protection Law Enforcement Directive) applies to personal data processing in law enforcement activities, such as the Swedish Police Authority and hospitals, if someone is sentenced to compulsory psychiatric care.
The Swedish Camera Surveillance Act supplements the EU GDPR and applies to the processing of personal data in connection with camera surveillance.
The Swedish Patient Data Act stipulates requirements for public and private healthcare providers' personal data processing in relation to healthcare activities, including the obligation to keep medical records.
The Swedish Police Data Act supplements the Swedish Criminal Data Act in relation to personal data processing carried out by the Swedish Police Authority, the Swedish Economic Crime Authority, and the Swedish Security Service.
The Swedish Electronic Communications Act regulates electronic communications network services and imposes additional legal requirements on companies with significant market power. The act contains provisions aimed at strengthening the security and integrity of electronic communications, requiring operators to take appropriate measures to manage and mitigate risks. The act also sets out the responsibilities of the Swedish Post and Telecom Authority, which is the supervising authority.
The act further regulates the use of cookies. Operators must obtain user consent before storing or accessing information on a user’s device, including through cookies, and must inform users about the purpose of the data collection, while providing the user the option to refuse. Consent is not required, however, where the storage or access of data is strictly necessary for the transmission of electronic messages or for providing a service explicitly requested by the user.
Last review date: 17 December 2025
Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide cybersecurity and other data-related legislation applicable across all EU Member States, including the Cybersecurity Act, DORA, and the NIS 2 Directive.
The Swedish Act on Information Security for Essential Services and Digital Services (Swedish Act), which implements the EU Directive on Security of Network and Information Systems (NIS Directive), sets out cybersecurity requirements for essential services and digital services. The Swedish Act applies to providers of essential transport services with primary establishments in Sweden, as well as to providers of digital services, such as online marketplaces, search engines, and cloud services, with primary establishments in Sweden.
Sweden’s implementation of the NIS2 Directive, known as the Cyber Security Act, entered into force on 15 January 2026. Please refer to the EU chapter of the Global Data & Cyber Handbook for information on the NIS2 Directive.
Note that the EU Dual-Use Regulation may apply to cybersecurity solutions. If a cybersecurity solution falls within the scope of the Dual-Use Regulation and is subject to export controls, an export license would be required before the solution can be transferred outside the EU.
Last review date: 17 December 2025
Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide legislation related to non-personal data, also applicable in all EU Member States, such as the Regulation on the free flow of non-personal data, the Data Governance Act, the Data Act, etc.
- The Swedish Accounting Act (1999:1078)
The Swedish Accounting Act regulates accounting, financial record keeping and reporting in Sweden. The act mandates an accurate collection and systematic recording of all business transactions. The act also requires companies to share relevant accounting information with auditors and relevant authorities.