Processing of personal data

What is personal data?

Personal data means any information relating to an identified or identifiable natural person who is alive. This means that if information directly or indirectly reveals the identity of the individual to whom it relates, it constitutes personal data. Examples of personal data include a person's name, address, personal identity number, photograph, or case reference number.

Processing personal data

Processing personal data means, in principle, any operation performed on personal data. This may include collecting, recording, storing, combining, accessing, reading, or printing the data.

Which laws govern how the Swedish Armed Forces may process personal data?

Several laws and associated ordinances regulate how the Swedish Armed Forces may process personal data. The purpose of these laws is to protect individuals against violations of their personal privacy when personal data is processed. The legislation provides that the Swedish Armed Forces may process personal data in order to perform the duties assigned to it by the Swedish Parliament or the Government, to fulfil legal obligations, or in connection with the exercise of official authority.

The processing of personal data within the activities of the Swedish Armed Forces relating to Sweden's defence and national security, as well as within the framework of international defence and security cooperation, is primarily governed by:

• the Defence Data Act (Försvarsdatalagen); 

• the Defence Data Ordinance (Försvarsdataförordningen); 

• the Act (2021:1171) on the Processing of Personal Data by the Swedish Armed Forces; and 

• the Ordinance (2021:1207) on the Processing of Personal Data by the Swedish Armed Forces. 

These legal instruments regulate the vast majority of the Swedish Armed Forces' processing of personal data. In the cases listed below, the processing of personal data by the Swedish Armed Forces is instead governed by the following legislation:

• the Patient Data Act (2008:355), for the processing of personal data by the Swedish 

Armed Forces in its capacity as a healthcare provider within the healthcare system; 

• the Criminal Data Act (2018:1177), for the processing of personal data when the 

Military Police performs duties pursuant to Section 1 of the Ordinance (1980:123) containing the Regulations for the Military Police (see Section 11 of that Ordinance); and 

• the Total Defence Data Act (2020:151), when the Swedish Armed Forces enters or amends information in the information system of the Swedish Defence Conscription and Assessment Agency, or processes special categories of personal data within the framework of other investigations pursuant to Chapter 2, Section 1 of the Total Defence Service Act (1994:1809). See Chapter 2, Section 2, second paragraph; Section 5, second paragraph; Section 14, first paragraph; and Section 8, second paragraph of the Total Defence Data Act. 

The Swedish Armed Forces is the data controller

The Swedish Armed Forces is the data controller for the processing of personal data carried out within its operations. This means that the Swedish Armed Forces bears ultimate responsibility for ensuring that your personal data is processed correctly.

You should contact the Swedish Armed Forces if you wish to exercise your rights or if you have any questions regarding its processing of personal data (see Your Rights below).

When does the Swedish Armed Forces process personal data?

The fundamental duties of the Swedish Armed Forces are set out in the Ordinance (2024:1333) containing Instructions for the Swedish Armed Forces.

The primary mission of the Swedish Armed Forces is to defend Sweden and allied states against armed attack based on NATO's system of collective defence. In addition to this primary mission, the Swedish Armed Forces is responsible for promoting Sweden's security in various ways and safeguarding Sweden's territorial integrity.

The sections below describe and provide examples of the various categories of purposes for which the Swedish Armed Forces processes personal data.

Tasks relating to the defence of Sweden

The principal task of the Swedish Armed Forces is to defend Sweden and its allies against armed attack (Section 1 of the Instructions for the Swedish Armed Forces).

To fulfil this task, the Swedish Armed Forces, for example:

• conducts military exercises; 

• organises wartime units; and 

• processes personal data relating to members of its various personnel categories. 

To ensure access to the resources required for its primary mission, the Swedish Armed Forces specifies requirements for, procures, and acquires defence materiel. In connection with these activities, it processes personal data relating to contractual partners and other individuals.

To ensure the supply of qualified personnel, the Swedish Armed Forces conducts, among other things, basic military training pursuant to the Total Defence Service Act (1994:1809) and assesses applicants for a wide range of educational programmes, including basic officer training. Consequently, it processes personal data relating to conscripts and other applicants.

Personal data is also processed in connection with recruitment and employment in order to ensure that the Swedish Armed Forces maintains personnel with the appropriate skills and qualifications in its capacity as a government employer. Furthermore, the Swedish Armed Forces makes decisions regarding the requisition of property pursuant to the Ordinance (1992:391) on the Requisition of Property for the Needs of the Total Defence, and processes personal data for this purpose.

Tasks to Promote Sweden's Security and Safeguard Territorial Integrity

The Swedish Armed Forces shall promote Sweden's security and safeguard Sweden's territorial integrity, and shall also be capable of contributing to the protection of the territorial integrity of allied states. The Swedish Armed Forces shall protect Sweden's sovereign rights and national interests and be able to prevent and manage conflicts and war both within Sweden and beyond Swedish territory. Within its area of responsibility and as part of NATO's collective defence and other assigned tasks, the Swedish Armed Forces shall also be capable of fulfilling Sweden's obligations as a NATO member. The Swedish Armed Forces shall be able to participate in NATO operations and other deterrence and defence activities. It shall also be capable of providing and receiving military support (Sections 3–4 of the Instructions for the Swedish Armed Forces).

To fulfil these responsibilities, the Swedish Armed Forces processes personal data, for example:

• in connection with responses to violations of Swedish territory; 

• when granting foreign states access to Swedish territory pursuant to the Access Ordinance (1992:118); and 

• when processing matters concerning visits under the Ordinance (1996:442) on Foreign Visits to Certain Authorities within the Ministry of Defence's Area of Responsibility. 

In order to fulfil Sweden's obligations as a NATO member, the Swedish Armed Forces may also transfer personal data to NATO. See Tasks Involving Cooperation with Other Parties below.

Tasks Involving Cooperation with Other Parties

The Swedish Armed Forces shall be capable of carrying out its duties independently and in cooperation with other government agencies, states, international organisations, and under NATO command. In cooperation with relevant authorities and other stakeholders, the Swedish Armed Forces shall also be able to provide support to NATO and allied states when they participate together with Sweden in joint operations, activities, and exercises on Swedish territory (Sections 10 and 19 of the Instructions for the Swedish Armed Forces).

The Swedish Armed Forces shall also be able to support civilian activities using its existing capabilities and resources (Section 12 of the Instructions for the Swedish Armed Forces). When providing such support, the Swedish Armed Forces may act as a data processor on behalf of the data controller receiving the assistance. Any personal data processed in this context is handled in accordance with the legislation applicable to that data controller.

The Swedish Armed Forces may also transfer personal data to NATO in connection with staffing NATO structures (see, for example, Section 4 of the Government Decision of 19 December 2024 containing the current Framework Instructions Instructions for Government Agencies' Activities within NATO, Ref. No. Fö2024/02069), or otherwise to fulfil Sweden's obligations towards NATO in accordance with assignments entrusted to the Swedish Armed Forces (see, inter alia, Section 4 of the Instructions for the Swedish Armed Forces).

Similarly, personal data may be transferred to other countries and international organisations as part of the fulfilment of other defence cooperation assignments issued by the Government.

The legal basis under the Defence Data Act and the Defence Data Ordinance for transferring personal data to another country or an international organisation is set out in Chapter 2, Section 22 of the Defence Data Act and Chapter 2, Sections 1–2 of the Defence Data Ordinance.

Tasks Relating to Defence Intelligence, Military Security Services, and Communications Security

The Swedish Armed Forces conducts defence intelligence activities pursuant to the Defence Intelligence Activities Act (2000:130) (Section 6 of the Instructions for the Swedish Armed Forces).

The Swedish Armed Forces shall also direct and conduct military security activities for the purpose of protecting security interests relating to the Swedish Armed Forces and the entities under its supervisory responsibility, in accordance with the Protective Security Act (2018:585) and the Protective Security Ordinance (2021:955) (Section 7 of the Instructions for the Swedish Armed Forces).

This means that the Swedish Armed Forces processes personal data relating, for example, to:

• individuals engaged in security-threatening activities directed against Sweden; and 

• foreign military personnel. 

The Swedish Armed Forces also processes personal data:

• in connection with security vetting prior to employment; 

• during security-sensitive procurement procedures; and 

• when individuals request access to one of the Swedish Armed Forces' protected sites. 

Furthermore, the Swedish Armed Forces processes personal data in its capacity as the coordinating and supervisory authority under the protective security legislation.

The Swedish Armed Forces is also responsible for directing and coordinating the communications security services of Sweden's total defence, including work relating to secure cryptographic functions, and for assisting the Government Offices in matters concerning cryptographic operations and other communications security activities (Section 8 of the Instructions for the Swedish Armed Forces).

As part of these responsibilities, the Swedish Armed Forces processes personal data, for example, to prevent unauthorised access to, or interference with, telecommunications systems and information systems.

Tasks Relating to Research, Studies, and Experimental Activities

Maintaining and developing Sweden's military defence requires continuous advances in technology and methodology.

The Swedish Armed Forces shall therefore commission research and conduct its own studies and experimental activities to support the planning and development of the military defence and to ensure access to knowledge of critical importance to national security.

The Swedish Armed Forces shall also commission research and produce statistics to support the development of services for military veterans and their families (Section 15 of the Instructions for the Swedish Armed Forces).

Personal data is processed as part of these activities.

Contact Information Regarding the Processing of Personal Data

You may always contact the Swedish Armed Forces if any personal data concerning you is incorrect or incomplete, or if you have any other questions regarding the processing of your personal data.

Swedish Armed Forces
Organisation Number: 202100-4615

Postal address:
107 85 Stockholm
Sweden

Telephone: +46 (0)8 788 75 00
Fax: +46 (0)8 788 77 78
Email: exp-hkv@mil.se

If you are dissatisfied with the processing of your personal data, you may lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Email: imy@imy.se

________________________________________

Data Protection Officer

The Swedish Armed Forces has appointed a Data Protection Officer (DPO).

The Data Protection Officer is responsible, among other things, for monitoring that the Swedish Armed Forces processes personal data lawfully and correctly.

If you have any questions regarding the Swedish Armed Forces' processing of personal data, you may contact the Data Protection Officer, who will assist you in obtaining the information you require.

Email: dataskyddsombud@mil.se (monitored during normal office hours)

Postal address:

Swedish Armed Forces
Legal Department – Data Protection Officer
107 85 Stockholm
Sweden