Personuppgifts

Personuppgifts is the Swedish term for personal data, defined as information about an identified or identifiable natural person. This includes obvious identifiers such as name or contact details, as well as data like online identifiers (for example IP addresses), location data, or any combination of data that could reasonably identify someone.

In the European Union, the processing of personuppgifts is governed by the General Data Protection Regulation (GDPR). In Sweden, the GDPR is complemented by national legislation and overseen by Integritetsskyddsmyndigheten (IMY). A data controller determines the purposes and means of processing, while a data processor handles data on behalf of the controller. Processing must have a lawful basis, such as consent, performance of a contract, compliance with a legal obligation, protection of vital interests, public task, or legitimate interests.

Personal data may include ordinary data and special categories requiring heightened safeguards, such as health information or biometric data. Data minimization and purpose limitation apply, and appropriate security measures must be used. Data should be accurate and stored no longer than necessary.

Individuals have rights regarding their personuppgifts: access to their data, rectification, erasure (the right to be forgotten), restriction of processing, objection to processing, and data portability, along with rights related to automated decision-making in certain circumstances. Organizations must provide information about processing and implement measures to protect data, including data protection by design and by default.

This framework aims to balance individuals’ privacy with the legitimate needs of organizations for lawful data processing.