datainsyn

Datainsyn refers to an individual’s right to obtain information about the personal data that is processed about them by a data controller. In Sweden this right is rooted in the EU General Data Protection Regulation (GDPR) and national data protection law. The rights include a copy of the data, details about processing purposes, data categories, recipients, sources, and the intended retention period. It is distinct from the public-records principle (offentlighetsprincipen), which covers public documents.

Legal basis and authorities: The GDPR Article 15 provides the standard right of access. In Sweden the supervisory authority is the Integritetsskyddsmyndigheten (IMY), formerly Datainspektionen, which oversees privacy rules and handles complaints. Data controllers, whether public authorities or private companies, must respond to valid requests and facilitate access to the data.

Process and limitations: Requests may be made in writing or electronically. The controller must verify the requester’s identity and respond without undue delay, usually within one month; extensions of up to two months are allowed for complex cases with notice. The response should include a copy of the data and information about processing activities, recipients, and retention. Some information may be redacted to protect others; fees may apply for excessive requests.

Impact and context: Datainsyn is a central instrument for privacy rights in Sweden and is used to verify data accuracy and exercise data portability. In digital processing, data can often be provided in machine-readable formats if requested. The concept continues to adapt to evolving data practices and cross-border transfers within the EU.