Complain about incorrect processing of your personal data
If you think that someone is processing your personal data incorrectly you can file a complaint to the Swedish Authority for Privacy Protection (IMY) using our e-service.
In order to ensure that your submitted material is considered a complaint, it is required that
your complaint relates to a violation of processing of personal data according to the General Data Protection Regulation or the Criminal Data Act
the processing that you complain about relates to personal data about you
the data controller is identifiable
you provide information about who you are
you provide contact details so that we can reach you.
You will always get a reply from us if your complaint meets the requirements above. If we initiate an inspection to investigate the subject matter of your complaint you will also get a copy of the decision in the inspection case.
Complaints that do not meet the requirements above will be handled as tips, please see the information on tips below. This applies, for example, if you do not name a data controller, if the complaint concerns processing of someone else’s personal data or if you choose to remain anonymous.
Do not use this e-service if
Do not use this e-service if you want to:
If you suspect that someone is using camera surveillance in a way that violates the rules of the GDPR or the Camera Surveillance Act you can report it to us using another e-service.
When you blow the whistle, your identity is protected by strong confidentiality. As a whistleblower, you are also protected in other ways. The same protection is not offered if you choose to leave a complaint instead of blowing the whistle.
You can call our whistleblowing function on 08-657 61 53 to get more information. Our normal opening hours are Thursdays between 9.30 am and 11.30 am. Do not use e-mail.
Complaints on debt recovery measures that violate the Debt Recovery Act (inkassolagen) or accepted debt recovery practices can be filed to Finansinspektionen.
On January 1, 2024, the responsibility for licensing and supervision of debt collection operations was passed from the Swedish Authority for Privacy Protection (IMY) to Finansinspektionen.
If you find that a credit reference agency has inaccurate or misleading information about you in their credit information register you should contact them and ask for rectification. If your request is turned down, you can file a complaint to us.
If you are dissatisfied with a processing of personal data but the requirements for complaint according to the data protection rules are not met, for example that it isn’t your personal data that is being processed or that you wish to be anonymous, it is possible to submit a tip to us instead. You can provide us with information about a violation of the GDPR or draw our attention to a certain data protection issue. Tips that are submitted to us may be used as a basis when we decide on future actions.
Submit your tip by e-mail or letter. Indicate clearly that it is a tip and what you would like to inform us about.
IMY can investigate if a law enforcement authority processes your personal data in accordance with the law. If the authority cannot provide you with information because of secrecy rules, you can request us to carry out a so-called lawfulness check.
Start by contacting the organisation that processes your personal data
Before you file a complaint, we recommend that you contact the organisation that processes your data and explain what you think is incorrect. This is particularly important if your complaint concerns your rights under the data protection rules, such as the right of access, erasure or rectification. In many cases, data protection complaints can be resolved quickly and easily with the organisation. Many organisations have a data protection officer you can contact. If you do not get help, you can file a complaint using our e-service.
It is not possible to use our e-service if you have denied the use or the storage of cookies in your web browser. Please file your complaint by letter or e-mail instead. Remember to give us all necessary information, please see the list of requirements above.
If a Swedish authority has denied you the right to, for example, erasure, access or rectification, you can appeal that decision to the administrative court. Contact the authority again and request a written decision that can be appealed. The authority’s data protection officer can inform you about how to get an appealable decision and how to appeal.
Everything you submit to us becomes an official document. If someone requests access to the document, we will make a confidentiality assessment to determine whether the information is to be classified as confidential or not and if the information can be disclosed in whole or in part. An official document must, as a main rule, be archived in its entirety.
If you want to complain about a processing of your personal data, you can choose which national data protection authority to turn to. For example, if you have asked for information about how a company in France is handling your personal data and they do not give you the required information, you can choose whether you want to file a complaint to the national data protection authority in France, Sweden or any other EEA-country. The national data protection authority you turn to will be your contact point for your complaint, regardless of where the case subsequently will be handled.
This is how your complaint will be handled
We review each complaint
We review each complaint.
Some complaints lead to inspections
A complaint may lead us to send a letter to the controller with information about rules and practices. If we find reasons to take further action, we can initiate an inspection to investigate the subject matter of a complaint.
You will receive a reply from us
You will always receive a reply from us so that you know what actions we have taken. If we carry out an inspection, you will also receive a copy of our decision in the inspection case.
About the information on this page
If the information in English is different from the Swedish version of this page, the Swedish version applies.