1.1 What is the GDPR?

GDPR stands for General Data Protection Regulation, which came into force on 25 May 2018 throughout the EU. The GDPR regulates how personal data must and may be processed.

1.2 Why was the GDPR introduced?

The objective of the GDPR is to protect fundamental rights and freedoms of natural persons, particularly in respect of how their personal data must and may be processed, and to facilitate the exchange of personal data within the EU. The same rules apply throughout the EU.

1.3 What are the ramifications of the GDPR?

The GDPR places strict demands on whoever processes personal data and applies to every member state regardless of where the data are processed. A National Swedish legislation, the Data Protect Act, containing supplementary provisions to the GDPR, has also been enacted. The GDPR states that all processing of personal data must be lawful, have a clear purpose and be properly documented.

1.4 What happens in the event of non-compliance?

A public authority failing to comply with the GDPR when processing personal data risks administrative sanctions of up to SEK 10 million. For companies, this sum is much higher – up to EUR 20 million or 4% of the company’s or its parent company’s global turnover.