INTRA/SESweden
What the record establishes for Sweden, measure by measure, and what each source requires of the measure it governs.
| Control | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|
| 15Mandatory | |||
| AW001/SEWorkforce awareness on insider riskMandatory | Cybersäkerhetslag (2025:1506)Riksdag · read 5 Oct 2026 | That operators in scope take appropriate and proportionate technical, operational, and organizational measures that include access control and asset management, personnel security, cryptography, and cyber hygiene and training, that the persons in an operator’s management undergo training on security measures, that a significant incident is notified within 24 hours of knowledge and reported within 72 hours with a final report within one month, and that the government designates the supervisory authority or authorities. | For operators in scope, the measures include basic cyber hygiene practices and cybersecurity training, and the persons in the management undergo training on security measures. |
| AW002/SETransparency notice on what is observedMandatory | Kamerabevakningslag (2018:1200), 15 §, 21 §, and 22 §Riksdag · read 5 Oct 2026Beslut efter tillsyn, H&M Hennes & Mauritz GBC AB, kamerabevakning i verksamhetslokaler i BoråsIntegritetsskyddsmyndigheten · read 5 Oct 2026Kontroll och övervakning av anställdaIntegritetsskyddsmyndigheten · read 5 Oct 2026 | That notice of camera surveillance is given by clear signage or in another effective way, with a separate notice for sound, that an employer’s decision on camera surveillance of a workplace is subject to the negotiation duty of 11-14 §§ MBL, and that the material is covered by confidentiality. | Employees have the right to clear information in advance of which controls may be made of them. Notice of camera surveillance is given by clear signage or in another effective way, with a separate notice where sound is recorded. Information under article 13 to the persons filmed is owed beside the signage, and a sign without the DPO’s contact details does not discharge it. |
| DP004/SEAccess control and least privilegeMandatory | Cybersäkerhetslag (2025:1506)Riksdag · read 5 Oct 2026MSBFS 2020:7, föreskrifter om säkerhetsåtgärder i informationssystem för statliga myndigheterMyndigheten för samhällsskydd och beredskap · read 5 Oct 2026 | That operators in scope take appropriate and proportionate technical, operational, and organizational measures that include access control and asset management, personnel security, cryptography, and cyber hygiene and training, that the persons in an operator’s management undergo training on security measures, that a significant incident is notified within 24 hours of knowledge and reported within 72 hours with a final report within one month, and that the government designates the supervisory authority or authorities. | For operators in scope, the measures taken include access control and asset management. For state authorities, only authorized users and systems reach the IT environment, and no digital identity holds more access than it needs. |
| DP005/SEPrivileged access managementMandatory | MSBFS 2020:7, föreskrifter om säkerhetsåtgärder i informationssystem för statliga myndigheterMyndigheten för samhällsskydd och beredskap · read 5 Oct 2026 | For state authorities, that only authorized users and systems reach the IT environment and that no digital identity has more access than it needs, that administrative identities are used for administration only and assigned restrictively, that security logs record failed access attempts, configuration changes, changes of privileges, and access to protected information, and that the logs are analysed to detect and handle incidents and deviations. | For state authorities, identities that give administrative privileges are used for administration only and assigned restrictively. |
| DP012/SERetention and disposal of program recordsMandatory | Lag (2021:890) om skydd för personer som rapporterar om missförhållandenRiksdag · read 5 Oct 2026 | That an operator with 50 or more workers at the start of the calendar year has internal reporting channels, run by independent and autonomous persons or units, that receipt is confirmed within seven days and feedback given within three months, that oral reports are documented and documentation kept no longer than two years after the follow-up case is closed, and that whoever handles a report may not disclose what reveals the reporter’s identity. | Oral reports are documented by recording or minutes, and written reports and documentation are kept no longer than two years after the follow-up case is closed. |
| GV007/SELawful basis registerMandatory | Beslut efter tillsyn, Apotea AB, kamerabevakning vid logistikcenter i MorgongåvaIntegritetsskyddsmyndigheten · read 5 Oct 2026Kontroll och övervakning av anställdaIntegritetsskyddsmyndigheten · read 5 Oct 2026 | That surveillance to direct work and check how employees perform their tasks normally has no legal basis under article 6, that the balancing is made purpose by purpose, that the integrity interest at a workplace weighs heavily as a starting point since an employee does not usually expect to be watched, and that surveillance to handle medicine incidents prevailed because it was limited to relevant areas, access was limited to three post-holders, logged, and used as a last resort, and the activity was one where employees could expect cameras more than usual. | The bases for processing to control employees are the balancing of interests or, for a public authority, public interest; consent is not one an employer can use. In the balancing, security reasons weigh more than efficiency reasons. Where cameras serve several purposes the legal basis is examined purpose by purpose, and surveillance to direct work and check how employees perform their tasks normally has none. |
| GV010/SEWorker representative engagementMandatory | Lag (1976:580) om medbestämmande i arbetslivet, 11 §, 12 §, and 19 §Riksdag · read 5 Oct 2026Kamerabevakningslag (2018:1200), 15 §, 21 §, and 22 §Riksdag · read 5 Oct 2026Så får du som arbetsgivare använda platstjänster (GPS)Integritetsskyddsmyndigheten · read 5 Oct 2026Så får du som arbetsgivare kamerabevaka på arbetsplatsenIntegritetsskyddsmyndigheten · read 5 Oct 2026 | That an employer bound by a collective agreement negotiates on its own initiative, before deciding, with the organization it is bound to, on an important change of its operations or of the work or employment conditions of the organization’s members, that it may decide first only where special reasons require it, that the organization may call negotiation on other matters, and that the employer keeps the organization informed of how its operations develop. | An employer bound by a collective agreement negotiates with the organization on its own initiative before deciding an important change of its operations or of the work or employment conditions of the organization’s members; where special reasons require it, the decision may precede the negotiation. An employer’s decision on camera surveillance of a workplace is subject to the negotiation duty of 11-14 §§ of the Co-determination Act. The employer usually negotiates with the union before switching on location services, and negotiates before cameras are installed. |
| IR006/SENotification to a supervisory authorityMandatory | Cybersäkerhetslag (2025:1506)Riksdag · read 5 Oct 2026 | That operators in scope take appropriate and proportionate technical, operational, and organizational measures that include access control and asset management, personnel security, cryptography, and cyber hygiene and training, that the persons in an operator’s management undergo training on security measures, that a significant incident is notified within 24 hours of knowledge and reported within 72 hours with a final report within one month, and that the government designates the supervisory authority or authorities. | For operators in scope, a significant incident is notified to the supervisory authority within 24 hours of knowledge, reported within 72 hours, and closed by a final report within one month of the notification. |
| IV001/SEInternal reporting channelMandatory | Lag (2021:890) om skydd för personer som rapporterar om missförhållandenRiksdag · read 5 Oct 2026 | That an operator with 50 or more workers at the start of the calendar year has internal reporting channels, run by independent and autonomous persons or units, that receipt is confirmed within seven days and feedback given within three months, that oral reports are documented and documentation kept no longer than two years after the follow-up case is closed, and that whoever handles a report may not disclose what reveals the reporter’s identity. | An operator with 50 or more workers at the start of the calendar year has internal reporting channels run by independent and autonomous persons or units; receipt is confirmed within seven days and feedback given within three months; private operators of 50 to 249 were reached from 17 December 2023 and others from 17 July 2022. |
| MD013/SEPhysical access monitoringMandatory | Beslut efter tillsyn, Apotea AB, kamerabevakning vid logistikcenter i MorgongåvaIntegritetsskyddsmyndigheten · read 5 Oct 2026 | That surveillance to direct work and check how employees perform their tasks normally has no legal basis under article 6, that the balancing is made purpose by purpose, that the integrity interest at a workplace weighs heavily as a starting point since an employee does not usually expect to be watched, and that surveillance to handle medicine incidents prevailed because it was limited to relevant areas, access was limited to three post-holders, logged, and used as a last resort, and the activity was one where employees could expect cameras more than usual. | Access to recordings limited to three post-holders, logged in the software and checkable afterwards, used only where other ways of tracing a loss have failed, is what made a surveillance of a dispensing area proportionate. |
| MD014/SEVideo surveillance of the workplaceMandatory | Beslut efter tillsyn, H&M Hennes & Mauritz GBC AB, kamerabevakning i verksamhetslokaler i BoråsIntegritetsskyddsmyndigheten · read 5 Oct 2026Beslut efter tillsyn, Apotea AB, kamerabevakning vid logistikcenter i MorgongåvaIntegritetsskyddsmyndigheten · read 5 Oct 2026Kamerabevakning av anställdaIntegritetsskyddsmyndigheten · read 5 Oct 2026Så får du som arbetsgivare kamerabevaka på arbetsplatsenIntegritetsskyddsmyndigheten · read 5 Oct 2026 | That camera surveillance of a staff room over five nights without a legal basis breached article 6(1), that the absence of clear signage or other effective notice breached 15 § kamerabevakningslagen, that the absence of information to the persons filmed breached article 13, and that the three together cost SEK 300,000; and that signs at staff entrances without the DPO’s contact details breached article 13 and were ordered corrected within four weeks. | Cameras at work serve the prevention of accidents, theft, sabotage, or crime, limited to the areas and times the purpose needs; filming employees to check how they perform is not allowed; toilets, changing rooms, hidden cameras, and sound are excluded or rarely permitted; notice is given by clear signage or in another effective way, the sign showing the purpose and the controller’s contact details. Camera surveillance of a staff room for five nights without a legal basis, without signage or other effective notice, and without information to the persons filmed breached article 6(1), 15 § of the camera surveillance act, and article 13, and cost SEK 300,000; signs at staff entrances without the DPO’s contact details breached article 13. At a workplace the integrity interest weighs heavily as a starting point, since an employee does not usually expect to be watched; it is outweighed where the surveillance is limited to relevant areas, access is limited, logged, and a last resort, and the activity is one where cameras are to be expected. |
| MD016/SEMeasurement of pace and performanceMandatory | Beslut efter tillsyn, Apotea AB, kamerabevakning vid logistikcenter i MorgongåvaIntegritetsskyddsmyndigheten · read 5 Oct 2026Så får du som arbetsgivare kamerabevaka på arbetsplatsenIntegritetsskyddsmyndigheten · read 5 Oct 2026Kamerabevakning av anställdaIntegritetsskyddsmyndigheten · read 5 Oct 2026 | That surveillance to direct work and check how employees perform their tasks normally has no legal basis under article 6, that the balancing is made purpose by purpose, that the integrity interest at a workplace weighs heavily as a starting point since an employee does not usually expect to be watched, and that surveillance to handle medicine incidents prevailed because it was limited to relevant areas, access was limited to three post-holders, logged, and used as a last resort, and the activity was one where employees could expect cameras more than usual. | Cameras are not used to check how employees perform. Surveillance to direct work and check how employees perform their tasks normally has no legal basis under article 6. |
| MD018/SECovert monitoring on prior suspicionMandatory | Beslut efter tillsyn, H&M Hennes & Mauritz GBC AB, kamerabevakning i verksamhetslokaler i BoråsIntegritetsskyddsmyndigheten · read 5 Oct 2026Så får du som arbetsgivare kamerabevaka på arbetsplatsenIntegritetsskyddsmyndigheten · read 5 Oct 2026 | That camera surveillance of a staff room over five nights without a legal basis breached article 6(1), that the absence of clear signage or other effective notice breached 15 § kamerabevakningslagen, that the absence of information to the persons filmed breached article 13, and that the three together cost SEK 300,000; and that signs at staff entrances without the DPO’s contact details breached article 13 and were ordered corrected within four weeks. | A hidden camera with sound and image in a room staff were permitted to use, run for five nights, had no legal basis. Hidden cameras are excluded. |
| PS001/SEPre-employment screeningMandatory | Säkerhetsskyddslag (2018:585), 2 kap. 4 § and 3 kap.Riksdag · read 5 Oct 2026 | For security-sensitive activities, that personnel security prevents persons who are not reliable from a security standpoint from taking part, that vetting is made before participation begins and followed up for as long as it lasts, that it rests on a basic investigation, register checks, and where required a special personal investigation, that posts are placed in security classes 1 to 3, and that register data are drawn continuously during participation. | For security-sensitive activities, vetting precedes participation and rests on a basic investigation, a register check, and where required a special personal investigation, with the post placed in one of three security classes. |
| PS004/SEScreening during employmentMandatory | Säkerhetsskyddslag (2018:585), 2 kap. 4 § and 3 kap.Riksdag · read 5 Oct 2026 | For security-sensitive activities, that personnel security prevents persons who are not reliable from a security standpoint from taking part, that vetting is made before participation begins and followed up for as long as it lasts, that it rests on a basic investigation, register checks, and where required a special personal investigation, that posts are placed in security classes 1 to 3, and that register data are drawn continuously during participation. | For security-sensitive activities, the vetting is followed up for as long as participation lasts, and register data are drawn continuously during it; the Act sets no interval. |