Personuppgiftslag

Personuppgiftslag, often abbreviated as PUL, was a Swedish law that governed the processing of personal data. It was enacted in 1998 and implemented the EU's Data Protection Directive 95/46/EC. The primary purpose of PUL was to protect individuals' privacy and ensure that their personal information was handled responsibly and securely.

The law applied to any processing of personal data, whether automated or manual, by private individuals or public authorities. It established several key principles for data processing, including that data must be collected for specified, explicit, and legitimate purposes, and not further processed in a way incompatible with those purposes. Data processing also had to be adequate, relevant, and not excessive in relation to the purposes for which it was collected. Furthermore, data had to be accurate and, where necessary, kept up to date, with inaccurate data being erased or rectified without delay.

PUL granted individuals certain rights regarding their personal data. These included the right to be informed about the processing of their data, the right to access their data, the right to rectification of incorrect data, and the right to object to processing under certain circumstances.

In May 2018, PUL was replaced by the General Data Protection Regulation (GDPR) and a supplementary Swedish Data Protection Act. While the principles of PUL were largely carried over into the GDPR, the new regulation introduced stricter rules, enhanced individual rights, and introduced significant penalties for non-compliance. The transition from PUL to GDPR marked a significant update in Swedish and European data protection law, aligning it with a more comprehensive and harmonized framework.