Can I see what data a company holds about me in Sweden?
Yes — under GDPR (Article 15) you have a right to know what personal data a company or authority holds about you, and to get a copy of it. You request it directly from the organisation — not from IMY, which is the most common misunderstanding. The first copy is free, and the answer must come within one month; for complex requests the time can be extended by two months, but they must tell you within that first month. The extract must show what data exists, why it is processed, who has accessed it and how long it is kept. Data about a third person can be redacted, and statutory secrecy can limit what you receive. If they do not respond, you can complain to the Swedish Authority for Privacy Protection (IMY).
📋 The rules
- Right to a copy of your personal data (GDPR art. 15)
- Request directly from the organisation, not from IMY
- First copy free
- Response within one month (extendable to three)
- Complain to IMY if they do not respond
🔓 Exceptions
- Manifestly unfounded or excessive requests can be charged for or refused
- Data about a third person can be redacted
- Statutory secrecy can limit what you receive
⚠️ Penalties & fines
The penalty does not hit you but whoever holds the data. IMY can impose a sanction charge on a company that breaches the rules: up to €10 million or 2% of turnover in the lower-tier cases, and €20 million or 4% in serious ones. The authority can also stop at a reprimand, which is common for smaller failings. For you as an individual the consequence is different: you simply do not get your data, and only once the month has passed can you file a complaint. A refusal is not always wrong — statutory secrecy can limit what you are entitled to receive.
📎 Official sources
- IMY · Access your personal data →
- IMY · File a complaint →
- General Data Protection Regulation · EUR-Lex →
❓ Frequently asked
How do I request my data?
You go directly to the company or authority and ask for a data extract under Article 15 of the GDPR. The request should not be sent to IMY, which only handles complaints once the organisation has failed to comply.
Does it cost anything?
No, the first copy of your personal data is free. For repeated copies a reasonable fee may be charged, and a manifestly unfounded or excessive request may be either charged for or refused outright.
How quickly must they respond?
Within one month of your request. For complex requests the time can be extended by two months, but they must then tell you about the extension within that first month, so simple silence is never a lawful answer.
What do I do if they do not respond?
Once a month has passed without an answer you can file a complaint with the Authority for Privacy Protection (IMY). IMY can issue the organisation a reprimand or impose a sanction charge.
What should the extract contain?
What data about you exists, why it is processed, who has accessed it and how long it is kept. Data about other people can be redacted, and statutory secrecy can limit what you receive.
🔎 Common searches
What people search to land here:
- “can I see my data gdpr sweden”
- “data access request company”
- “gdpr response within one month”
- “imy complaint”
- “first copy free gdpr”
- “right to my personal data”