SWEDEN Trends and Developments Contributed by: Niclas Rockborn, Astrid Svensson and Ivan Sivik, Gernandt & Danielsson
( Lag (2010:751) om betaltjänster ). The disclosure obli - gation overrides the duty of confidentiality and pro - vides a legal basis for the processing of personal data relating to criminal offences. The government has also introduced the same disclosure obligation for e-iden - tification companies and crypto service providers, proposed to enter into force in May 2026. The EU Digital Operational Resilience Act The EU Digital Operational Resilience Act (DORA) (Regulation 2022/2554) establishes requirements to address ICT-related risks for most financial undertak - ings operating in Sweden. DORA aims to mitigate ICT vulnerabilities and establish uniform rules across the EU. It introduces, inter alia, requirements for cyberse - curity information, continuity planning, managing risks from outsourcing ICT to third parties, resilience test - ing, and frameworks for information sharing. Effective from January 2025, DORA and supple - mented technical standards apply to banks, invest - ment firms, insurance companies, and other financial undertakings, such as managers of alternative invest - ment funds and crypto service providers. As the finan - cial sector has become predominantly digital and reli - ant on third-party infrastructure and service providers, such ICT providers fall within the scope of DORA. The Swedish Act ( Lag (2024:1278) med kompletterande bestämmelser till EU:s förordning om digital opera- tiv motståndskraft för finanssektorn ), supplementing DORA and regulations from the SFSA, set out pro - visions on threat-led penetration testing, fees, sanc - tions, and supervision by the SFSA. Additionally, DORA poses certain data protection requirements that must be fulfilled. Financial enti - ties must assess ICT risks and discontinuation provi - sions to ensure appropriate data protection prior to entering into a contractual arrangement on the use of ICT services. This includes provisions on availability, authenticity, integrity, and confidentiality in relation to the protection of data, including personal data. The EU NIS 2 Directive The NIS 2 Directive (NIS 2), adopted by the EU in December 2022, aims to achieve a higher level of cybersecurity within the EU by significantly expand - ing the scope of covered sectors, enhancing require -
ments for security measures and incident reporting, strengthening management responsibilities, and intro - ducing stricter sanctions. NIS 2 was implemented into Swedish law through a new Cybersecurity Act ( Cyber- säkerhetslag (2025:1506) ) that entered into force in January 2026. It should be noted that financial institu - tions shall for certain provisions adhere to the DORA as lex specialis. In addition, the Critical Entities Resilience Directive Directive (CER) (CER Directive 2022/2557), adopted by the EU in December 2022, aims to strengthen the resilience of critical entities against disruptions to their operations. With few exceptions, NIS 2 and CER cover entities operating in the same sectors, such as the energy and transport sectors. However, entities in the banking, financial market infrastructure, and digital infrastructure sectors are to some extent exempt from certain provisions of the new law transposing CER into Swedish law as similar obligations are already covered by NIS 2 and the Cybersecurity Act. The final legislative proposal for the implementation of CER into Swedish law is preliminary scheduled for publication in March 2026, and is preliminary set to enter into force during spring/summer 2026. It should be noted that the Commission proposed the Digital Omnibus Package in November 2025, which aims to provide a solution for streamlining cyberse - curity incident reporting under several laws, includ - ing the GDPR, NIS 2 and CER, bringing them under the umbrella of a single reporting mechanism for all related reporting obligations. The new Consumer Credit Directive To strengthen consumer protection, the EU has adopt - ed a new Consumer Credit Directive (CCD 2). The directive is expected to be implemented into Swed - ish law through a proposed new Consumer Credit Act ( Konsumentkreditlag ), with a government bill antici - pated in March 2026 (although currently delayed) with entry into force in November 2026. CCD 2 affects data protection in several ways. Firstly, the Swedish government proposes to intro - duce an obligation for creditors and credit intermedi - aries to inform consumers in a clear manner that they are providing them with a personalised offer based on
471 CHAMBERS.COM
Powered by FlippingBook