Severity: Info Other, enforcement EU
Swedish DPA fines Miljödata EUR 160,000 for insufficient technical and organisational measures
Original title: Swedish DPA fines Miljödata i Karlskrona approximately EUR 160 000 for insufficient technical and organisational measures to ensure information security
- Published
- Source: edpb.europa.eu
- Effective
- Not stated
- Deadline
- Not stated
- Framework: GDPR
- Regulation (EU) 2016/679 (as corrected 2018) source
- in 14 days
- Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date source
Why it matters
The Swedish Data Protection Authority (IMY) has imposed an administrative fine of approximately EUR 160,000 against Miljödata, an IT service provider, for violating Article 32 GDPR following a cyberattack in August 2025. The company failed to maintain sufficient technical and organizational security measures, including inadequate software installation checks and absence of automated real-time system monitoring. Organizations processing large volumes of personal data must implement robust security controls including real-time intrusion detection and rigorous change management procedures to prevent unauthorized access and data breaches.
What changed
- Change from 'Website topics' to 'Key words' in the decision summary metadata, reflecting updated classification of the enforcement action details
Who is affected
IT service providers and organizations in Sweden, particularly those processing large volumes of sensitive personal data; municipalities, regions, government agencies, and private companies that rely on IT service providers for data processing
What to do
AI-assisted summary of the official document; the official text prevails. Not legal advice.