Swedish DPA fines Miljödata approx EUR 160,000 for insufficient security measures

What happened

The Swedish Data Protection Authority (IMY) issued an administrative fine of SEK 1,800,000 (≈ EUR 160,000) to IT service provider Miljödata after a cyberattack exposed personal and sensitive data of 2.2 million individuals. The authority found Miljödata failed to implement adequate technical and organisational safeguards, including software installation checks and real‑time intrusion monitoring. The decision was dated 22/09/2026.

Penalty

administrative fine of SEK 1 800 000 (approximately EUR 160 000)

Why it matters for trust and compliance

• Its status is decided. The case has an outcome that others may cite.
• The fine highlights enforcement of GDPR Article 32 security obligations for processors handling large volumes of personal data.
• Penalty: administrative fine of SEK 1 800 000 (approximately EUR 160 000).
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Map the security requirements to existing controls and close gaps.
2. Check breach-notification procedures and timelines against the requirement.
3. Confirm handling of sensitive data categories meets the stricter rules.