7.1 Report to the controller that you are processing personal data.
The controller is obliged to keep a record of processing activities (a register of the personal data processing carried out). To meet this obligation, every time personal data is processed at the higher education institution concerning staff, students, patients, study participants, suppliers, etc., a report is to be submitted to the controller. Note that personal data that have been stored and actively processed on a previous occasion also constitute an ongoing processing of personal data. Check that the current personal data processing has already been reported to the controller and, if so, whether anything in the register needs updating. The report shall contain such details as why the data are being processed (the purpose), which data are being processed, for how long the data will be stored, the legal ground on which they are being processed, if the data subjects have received adequate and sufficient information, and who the contact person for the register in question is.

7.2 What to do in the event of a personal data breach.
A personal data breach is an event that leads to the unintentional or unlawful destruction, loss or change of, or unauthorised disclosure or access to personal data. If you think you have discovered or are the object of such an incident, you must report it to the data protection officer for investigation. If, on investigation, it is judged unlikely that the incident will pose or has posed a risk to the data subject’s freedoms and rights, no report need be lodged with the Swedish Agency for Privacy Protection. If, however, the risk is considered real, the controller is required to report the incident to the Swedish Agency for Privacy Protection and, in some cases, notify the data subject(s).