Who it applies to
The GDPR applies to any site that collects personal data from people in Sweden, from contact forms and newsletters to analytics and booking tools. The supervisory authority is the Swedish Authority for Privacy Protection (IMY).
The checklist
- Publish a clear privacy policy that names the controller, purposes, legal bases, recipients and retention periods
- Collect only the data you need and say why on every form
- Ask for consent before non-essential cookies and trackers, as the Swedish Electronic Communications Act requires
- Keep a record of processing and sign data-processing agreements with providers
- Use HTTPS, strong passwords, backups and timely security updates
- Have a simple way to handle access, correction and deletion requests
Transfers outside the EU
If your tools or developers are outside the EU or EEA, you need a lawful transfer mechanism such as an adequacy decision or standard contractual clauses, and it should be documented in your policy.
How we build
Globalsoft builds forms with clear consent text, minimal data collection, encrypted connections and sensible retention, and can help you document processing for your site.
Globalsoft TeamGlobalsoft · Erbil · Istanbul