Sweden: Privacy

Swedish cybersecurity regulations stemming from NIS 2 have transitioned from implementation to practical application during summer 2026. The National Cybersecurity Centre (NCSC) within the Swedish Defence Radio Establishment (FRA) has assumed responsibility for cyber operations, while new incident reporting requirements and security measures are being phased in.

The Swedish government has initiated an inquiry to review existing regulations on personal data processing in healthcare. The investigation will analyze how current provisions can be updated to meet technological developments while facilitating patient-centered research and maintaining individual privacy protection.

The transfer of personal data from the EU to the USA faces renewed scrutiny following a US Supreme Court ruling that grants the President authority to remove Federal Trade Commission members. This development challenges the independence requirements underlying the EU-US Data Privacy Framework and its adequacy decision, potentially jeopardizing the legal basis for transatlantic data transfers that thousands of organizations rely upon.