Course and certificate
GDPR for Employees (Sweden)
For people who work in Sweden and handle personal data about customers, patients, pupils or colleagues: administrators, retail and service staff, health care and school staff, and public sector employees. Eight short lessons in plain language on the General Data Protection Regulation (GDPR), the Swedish Data Protection Act (dataskyddslagen) and guidance from IMY (the Swedish Authority for Privacy Protection): personal data and the principles, lawful basis, special category data and personal identity numbers, data subjects' rights, security and phishing, personal data breaches and notification within 72 hours, the principle of public access to official documents (offentlighetsprincipen), and supervision and sanctions. Then a test with 25 questions.
- Jurisdiction
- 🇸🇪 Sweden
- Languages
- Svenska, Dansk, English, Norsk bokmål, Polski, Română, Українська
- Lessons
- 8
- Time needed
- About 45 minutes for the lessons and the test
- Assessment
- 25 questions, pass mark 80%
- Refresher
- Recommended after 2 years
- Content updated
- 27 October 2026
- Certificate fee
- kr 349.00, payable after passing
01Who this course is for
- Administrators, assistants and receptionists who handle details of customers and visitors
- Staff in shops, restaurants, services and customer support
- Employees in health care, social care, schools and preschools
- Staff in HR, finance and marketing
- Employees of government agencies, municipalities and regions who work with the principle of public access to official documents
- New employees who need to get started with their employer's data protection
02Syllabus
- 01What the GDPR is and who it applies to
- 02The principles for processing personal data
- 03Lawful basis, special category data and personal identity numbers
- 04Data subjects' rights
- 05Everyday security and phishing
- 06Personal data breaches and notification within 72 hours
- 07Sharing data, third countries and the principle of public access
- 08Supervision, sanctions and your role
03Assessment
25 multiple-choice questions drawn from the whole course. The pass mark is 80%. The test is free and can be retaken as often as needed; wrong answers point to the lesson to read again.
04The certificate
- With your name, your score and the date you passed.
- A unique number, recorded in our register.
- Your employer or an inspector scans it to see that it is genuine.
- Download it, print it or show it on your phone.
05Sources
The course follows the published guidance below. We are not affiliated with the bodies that publish it.
- Lag (2018
- Dataskyddsförordningen (EU 2016/679) artikel 32
- IMY — Informationssäkerhet
- Dataskyddsförordningen (EU 2016/679) artikel 12.3
- Dataskyddsförordningen (EU 2016/679) artikel 33
- Dataskyddsförordningen (EU 2016/679) artikel 5.1 e
06Questions
Do I have to take special data protection training?
The GDPR requires organisations to take appropriate organisational measures, and in practice training the people who handle personal data is part of that. However, the regulation does not name any particular course, number of hours or training provider. Your employer decides how the knowledge is provided and whether this course is enough for your duties.
Is the course certificate a regulated qualification?
No. The certificate shows that you have completed the course and passed the test. It is not a regulated qualification or one issued by an authority, and no authority has reviewed the course. Your employer decides whether the training is enough for your duties and can use the certificate as part of its records when it documents staff training.
Does the course replace the training my employer must give me?
No. The course gives you the general foundation that applies at every workplace. Your employer must still draw up its own guidelines and procedures for personal data, keep records of its processing where required, give instructions for the systems you use, control who has access, and have procedures for incidents and for requests from data subjects. Roles such as HR, health care, schools and marketing also need training tailored to the work.
Does the course apply if I work for a public authority?
Yes, the basics are the same. The course also briefly explains how the principle of public access to official documents and the data protection rules work side by side at authorities, municipalities and regions. Your authority also has its own rules, for example on secrecy and on how official documents are handled, and your employer should give you those.
How long does the course take?
Most people need about an hour for the lessons and the test with 25 questions. You can take breaks and carry on later on the same device.
What happens if I do not pass the test?
It costs nothing. You see which lessons to read again, and you can take the test as many times as you like.
When do I pay, and how much?
Only after you have passed the test: SEK 349 for the certificate. The course and the test are free.
How can my employer check the certificate?
Every certificate has a number and a QR code. When someone scans the code or enters the number on our verification page, it shows your name, the course and the date you passed the test.
How long is the certificate valid?
No law sets an expiry date for this kind of training. It is common to repeat data protection training every one to two years, so the certificate shows a renewal date 24 months after you passed the test. Ask your employer what applies where you work.
Is the course up to date with the latest rules?
The course is based on the GDPR, the Swedish Act (2018:218) and guidance from IMY. The rules and IMY's practice develop over time. So always read your employer's current guidelines, and check imy.se if you are unsure.
The certificate confirms that you completed this course and passed its test. It is not a regulated or accredited qualification; your employer decides whether this training meets their requirements.