Personuppgift

Personuppgift is a term used in Swedish law and the General Data Protection Regulation (GDPR) to describe any information relating to a natural person who can be identified directly or indirectly. Personal data may include obvious identifiers such as name, contact details and ID numbers, as well as online identifiers like IP addresses, location data, or a profile assembled from multiple data points. The concept covers both automated data processing and manually held data if they enable identification of a person.

Processing of personal data includes actions such as collection, organization, storage, use, transfer, disclosure, and deletion. The legality of processing depends on a lawful basis, such as consent, performance of a contract, legal obligation, protection of vital interests, public task, or legitimate interests. Certain categories of data, such as health information or racial origin, are considered special or sensitive and require stricter safeguards and usually explicit consent.

Data subjects have rights under GDPR: access to their data, rectification of inaccuracies, erasure (the right to be forgotten), restriction of processing, data portability, and the objection to processing or withdrawal of consent. They can usually contact the data controller or processor to exercise these rights and can lodge a complaint with the national supervisory authority if needed.

For organizations, the roles are the data controller or the data processor. Controllers determine the purposes and means of processing; processors act on behalf of controllers. Principles include data protection by design and by default, data minimization, accuracy, storage limitation, and security. Organizations must implement appropriate technical and organizational measures and document processing activities, especially for transfers outside the EEA.

In Sweden, the supervisory authority is IMY (Integritetsskyddsmyndigheten). GDPR rules apply across the EU and EEA, with national specifics. Processing personal data is common in employment, healthcare, marketing, and digital services, and compliance is essential to protect individuals’ privacy and avoid penalties.