personuppgiftsbehandlingens

Personuppgifter, or personal data, are any information relating to an identified or identifiable natural person. Examples include a name, contact details, an online identifier like an IP address, location data, or health and biometric information. The concept covers data that can directly reveal who someone is or can become identifiable when combined with other information.

The term is central to data protection law in the European Union, primarily under the General Data Protection Regulation (GDPR). In many Nordic countries, including Sweden, national provisions complement the GDPR. In processing personal data, two common roles exist: the data controller, who determines purposes and means of processing, and the data processor, who handles data on behalf of the controller.

Processing personal data must comply with fundamental principles. These include lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Processing requires a lawful basis, such as consent, necessity for performing a contract, legal obligation, vital interests, a public task, or legitimate interests balanced against individuals’ rights.

Data subjects have rights including access to their data, rectification, erasure (the right to be forgotten), restriction of processing, data portability, and objection to certain processing, including automated decision-making. Special categories of data (sensitive data) require higher protection and stricter safeguards.

Transfers of personal data to third countries or international organizations are subject to transfer restrictions and safeguards, such as adequacy decisions or appropriate safeguards. Organizations must implement appropriate security measures, maintain documentation, and, in some cases, appoint a data protection officer. Understanding personal data is essential for privacy, compliance, and individual rights in modern information handling.