On 22 September 2026 the Swedish Authority for Privacy Protection imposed an administrative fine of SEK 1.8 million on Miljödata i Karlskrona AB. The August 2025 intrusion reached personal identity numbers, contact details, sickness absence records, rehabilitation files and school incident reports belonging to around 2.2 million people, across most Swedish municipalities, several regions, state agencies and a long list of private companies.
The day before, on 21 September, the European Data Protection Board adopted guidelines on how supervisory authorities should decide whether to impose a fine at all. IMY led that work. Read together, the two tell you more about how the next few years of enforcement will run than either does alone.
What IMY decided, and what it did not
The decision concerns Miljödata as a processor, and it rests on Article 32(1): the duty to implement appropriate technical and organisational measures given the risks involved. IMY found two concrete shortcomings. The company lacked sufficient controls when installing new software, and it had no automatic real-time monitoring capable of detecting intrusions and suspicious activity.
IMY concluded that the company had acted negligently rather than deliberately.
What the decision does not do is settle the position of the organisations whose data it was. In November 2025 IMY opened reviews of three controllers alongside the processor — the City of Gothenburg, Älmhult Municipality and Region Västmanland — looking at what information had been processed in Miljödata’s systems and about whom, including protected identities, former employees and children. That is a separate track from the decision published this week.
Why 1.8 million is lower than it sounds
Set against 2.2 million affected people, the figure looks small, and it is worth understanding why rather than assuming the authority went easy.
A fine under the GDPR is not calculated per affected individual. It starts from the seriousness of the infringement and the turnover of the undertaking, and it is adjusted by aggravating and mitigating circumstances. A finding of negligence rather than intent moves the assessment downwards. So does cooperation, remediation, and the absence of a pattern of earlier breaches. The ceiling in Article 83 is a ceiling, not a target.
The practical lesson is the opposite of reassuring, though. The size of a fine is a poor proxy for how much damage a breach does, and for what it costs the organisations that have to notify, remediate and explain themselves to the people affected.
The five steps behind a fine
The EDPB guidelines adopted on 21 September set out the method supervisory authorities should follow when deciding whether a fine is the right corrective measure. They complement the existing Guidelines 04/2022 on calculating the amount, and replace the older Article 29 Working Party guidance.
The method runs in five steps: confirm that the infringement can attract a fine at all; identify which entity bears responsibility; assess whether the conduct was intentional or negligent; weigh aggravating and mitigating circumstances, with minor infringements normally meeting a reprimand rather than a fine; and finally test the outcome against effectiveness, proportionality and deterrence, with room to depart from standard practice in a particular case.
The guidelines are open for public consultation until 13 November 2026, so the text may still change. The direction will not: the same reasoning, applied the same way, in every member state.
The controller is still the one answerable
This is the part that matters to a company that has never heard of Miljödata.
IMY has been explicit that while controllers and processors both carry duties, primary accountability rests with the controller. A controller must satisfy itself that any processor it uses provides sufficient guarantees to implement appropriate technical and organisational measures, and that obligation is continuing rather than a box ticked at signature.
IMY has also been careful about the other half of the point: the fact that an incident occurs does not by itself mean that either party has failed. Security has to be proportionate to the actual risk. An organisation that chose its supplier carefully, documented why, and checked periodically is in a very different position from one that signed a standard agreement and never looked again.
What sufficient guarantees means in a contract
A data processing agreement under Article 28 is necessary and not sufficient. It allocates duties; it does not demonstrate that you assessed anything.
What a supervisory authority will look for is evidence of a judgment: what you asked the supplier before engaging them, what they answered, what you did about the gaps, and when you last revisited it. Questions that would have been useful here are unglamorous. How is new software tested before it reaches production? Is there monitoring that detects an intrusion while it is happening rather than afterwards? Who is notified, and how fast? What categories of our data will actually sit in the system, and do they include children, protected identities or health information?
Practical example: the company that outsourced payroll
A mid-sized company in Sweden outsources payroll and absence management to a supplier. The system holds identity numbers, salary data and sickness absence — the last of which is health data.
The company remains the controller throughout. If the supplier is breached, the supplier may face its own exposure under Article 32, but the company is the one that must assess the risk to its employees, notify IMY where the threshold is met, and notify the employees themselves where the risk to their rights and freedoms is high. It is also the party whose choice of supplier and ongoing supervision will be examined.
The work that makes that survivable is done before anything happens: a record of what was asked and verified, a clear picture of which categories of data are in the system, and a notification routine someone has actually walked through.
Common mistakes
Treating a signed Article 28 agreement as the whole of the controller’s diligence.
Assuming that because the supplier was fined, the controller’s position has been settled.
Reading a modest fine as a measure of how serious a breach was, or of what it will cost you.
Never revisiting a supplier assessment after onboarding, even as the categories of data in the system grow.
Discovering at the point of a breach that nobody knows exactly whose data, and which categories, sit in the supplier’s system.
Recommended actions
List the processors that hold personal data for you, and mark which of them hold health data, children’s data or protected identities.
For each, find the evidence that you assessed their security before engaging them. If there is none, create it now rather than after an incident.
Ask your most critical suppliers two questions in writing: how changes reach production, and whether intrusions are detected in real time.
Check that your breach notification routine names a person, a deadline and a decision-maker, and that someone has tested it.
Review the EDPB guidelines before the consultation closes on 13 November 2026 if fines are something your organisation models.
Frequently asked questions
If our supplier is breached, are we fined too?
Not automatically. The processor answers for its own security duties, and the controller answers for its own — choosing a processor that offers sufficient guarantees, supervising the arrangement, and notifying correctly. IMY has said plainly that an incident does not in itself establish that either party fell short.
Does a data processing agreement protect us?
It is required, and it is the starting point rather than the defence. Article 28 sets out what must be agreed. What a supervisory authority asks about is whether you formed a judgment about the supplier’s security and can show it.
The guidelines are still in consultation. Do they apply now?
They set out how authorities should apply rules that already exist, so the underlying law is unchanged. The text may be adjusted before it is final; the consultation runs to 13 November 2026. Treating the five-step method as a description of current practice is the safe reading.
Conclusion
The Miljödata decision will be remembered for the number, which is the least informative thing about it. The useful parts are that the failures were ordinary — software reaching production without sufficient control, no monitoring that would catch an intrusion as it happened — and that they were found to be negligent rather than deliberate.
For most companies the question is not whether they would be fined. It is whether, on the day a supplier calls, they could show what they asked, what they were told, and what they did about it. That record is built now or not at all.
If you want a clear picture of which of your suppliers hold what, and what your own documentation would look like to a supervisory authority, we will go through it with you. The first hour is on us.
