IMY Sweden: GDPR Anonymization and the Nordic Standard
Sweden's Integritetsskyddsmyndigheten (IMY) enforces GDPR. It also sets technical standards. Its 2023 anonymization guide is the most detailed DPA document on the topic in the EU. Twelve other EU DPAs cite it as a key reference. IMY issued 28 enforcement decisions in 2024, totaling €8.5 million.
IMY's Anonymization Framework
IMY's guide states one core rule: anonymization is a technical test. Policy and contracts alone do not make records anonymous. IMY uses four tests to judge whether records are truly anonymous.
k-anonymity: Each person must look the same as at least k-1 others on all key fields. IMY sets k≥5 for research records.
l-diversity: Within each group, sensitive fields must hold at least l distinct values. This blocks inference attacks even when k-anonymity holds.
Differential privacy: Noise is added to query results. No one person's presence can be detected from the output.
Pseudonymization vs. anonymization: Pseudonymization swaps identifiers for codes but keeps a recovery key. It stays GDPR-regulated. Only records that pass these four tests are truly anonymous.
See our GDPR-compliant ML training anonymization guide for how these tests apply to AI work.
The Swedish Rights Exercise Rate
79% of Swedish adults use their GDPR rights each year. That is the top rate in the EU. In most EU states, rights requests come from complaints. In Sweden, they are a normal part of daily life.
Firms with Swedish users must handle many access requests. Each one must be answered within one month. Late replies lead to IMY follow-up. Current personal records across all systems are required.
Personnummer: The Swedish Identifier Challenge
The Swedish personnummer is in almost every official Swedish document. The format is 10 or 12 digits (YYMMDD-XXXX). IMY's review found that 45% of generic NLP tools fail to detect personnummer.
Format variation: The number may appear with or without a hyphen. It can be 10 or 12 digits. Tools built for one format miss the other.
Luhn check: Without a Luhn check, tools flag any 10-digit string as a false positive. They also miss numbers in odd formats.
Samordningsnummer: This number is used for foreign residents in Sweden. It follows the same pattern but adds 60 to the birth-day digits (61–91 instead of 01–31). Tools that only detect the standard personnummer miss samordningsnummer. This gap matters for firms with non-Swedish staff or clients.
IMY's Position on AI Training
IMY published guidance on personal records in AI training in 2024. Three points matter for firms with Swedish users.
First, "AI training" is not a valid GDPR purpose on its own. It must link to a clear and specific end goal.
Second, pseudonymized records used for AI training stay GDPR-regulated. Only records that pass IMY's tests can be used without a legal basis.
Third, firms fine-tuning AI models on Swedish records must prove true anonymization. Or they must document a clear legal basis.
See our EU AI Act training anonymization guide for how EU bodies treat AI training across the bloc.
What Swedish Compliance Costs
Swedish enterprise GDPR compliance averages €85,000 per year. Access rights work and anonymization audits drive this cost. Automating PII detection to IMY's standards cuts it. Manual checks cannot keep pace with Sweden's rights exercise rate.
IMY's framework is cited across the EU. Meeting its standards puts firms in a strong position for broader EU review.