GDPR, what law is it?

GDPR is its own law, known as the Data Protection Regulation in Sweden. It applies to almost all companies and organizations in Sweden and the EU. It also applies to many who are active in other countries. It is the company's responsibility to determine whether they need to comply with the law.

What is GDPR?

GDPR is a law that came into effect in Sweden due to our EU membership. It regulates how personal data about individuals can be processed. Its primary purpose is to protect individuals. According to GDPR, you cannot store any personal information longer than necessary, and you must always be able to justify why you have the information. You can no longer store personal data just because "it might be useful."

What is the difference between GDPR and the Data Protection Regulation?

When talking about GDPR, we are referring to the Data Protection Regulation. GDPR is an abbreviation of the regulation's name in English, General Data Protection Regulation.

Who must comply with GDPR and who is affected by GDPR?

All companies and organizations that process personal data of individuals within the EU are required to comply with GDPR.

Which personal data is covered by GDPR?

Anything that can identify a person is considered personal data and must be handled according to GDPR.

What happens if I don't comply with GDPR?

If a company does not comply with GDPR, they may be required to pay so-called sanctions fees, which are similar to fines. The fees vary depending on the severity of the violation and the company's turnover. The maximum amount for serious violations is either 20 million euros or 4% of global turnover, whichever is higher. For less severe violations, the maximum is 10 million euros or 2% of global turnover, whichever is higher.

What are personal data?

Personal data is anything that can identify a person. Exactly what constitutes personal data may vary from case to case, but typically it includes names, phone numbers, email addresses, photos, addresses, etc. Typical sources of personal data are customer registers, personnel information, and details about a company’s own employees, contact details for suppliers when they include individual names (e.g., bengt.bengtsson@bilmekaniker.se could be personal data, while kundsupport@bilmekniker.se is probably not).

Are photographs personal data?

Yes, photos with identifiable individuals are personal data. Simply put, if a person can be recognized from the picture, it is personal data.

When can we keep personal data?

Personal data can be kept or retained when there is a so-called legal basis for it. This may be when you have received consent from the individual, are required by law to store personal data, have a legitimate interest in keeping the data, base it on a contract that allows processing, do it to protect vital interests, or perform public tasks or tasks of public interest. Regardless of which legal basis applies to the processing, you must be able to identify and justify why that particular basis is applicable.

How long can we keep personal data according to GDPR?

It depends on which personal data is collected and why it was gathered in the first place. For example, the Swedish Bookkeeping Act requires some information or documents to be stored for a few years, there may be obligations to store data for a certain warranty period, or a need to store data for a newsletter a customer has opted into. When the reason for storing the data has ceased (e.g., the customer relationship has ended), and there is no other legal reason to retain it, personal data can no longer be stored.

Do I need a "Privacy Policy"?

You are required to inform individuals whose personal data you process about what you do with the data, why you do it, and what their rights are. This is typically done through what many call a Privacy Policy or Personal Data Policy.

Do I need both a privacy policy and a cookie policy?

Yes, although they partially overlap, they cover different legislation. It is recommended that if you have a website that uses cookies (which most websites do today), you should have both a Privacy Policy and a Cookie Policy.

How often do I need to update the company’s GDPR work?

Working with GDPR compliance has been a requirement since the law's introduction in 2018. It should be an ongoing process that is updated regularly to address new circumstances and clarifications. During an inspection by supervisory authorities, they may review how you work with GDPR and how actively you maintain it.

No one has ever asked me about GDPR, do I really need to keep working on it?

Yes, this is a legal requirement, and both within the EU and in Sweden, it has been communicated that, unlike the initial years after GDPR's introduction, the focus on compliance in small and medium-sized companies will increase, along with greater awareness among individuals about their rights. Therefore, there is a higher likelihood that more and more people will inquire about GDPR. Furthermore, market trends and surveys show that GDPR compliance is increasingly sought after and assessed by potential investors and buyers when investing in or acquiring companies.