IMY Data

What IMY Data does

IMY (Integritetsskyddsmyndigheten) is Sweden's national data protection authority, established in 2020 when the EU General Data Protection Regulation became applicable in Sweden, succeeding the prior authority Datainspektionen. Operating under the Ministry of Justice, IMY is the sole supervisory authority (tillsynsmyndighet) with statutory responsibility to enforce GDPR, the Law on Credit Information Companies, and the Camera Surveillance Act within Sweden. The agency's mandate spans supervising compliance, investigating incidents, handling complaints from individuals, issuing binding regulatory guidance, and coordinating with European peers through the EDPB and Nordic data protection authorities.

IMY's product surface is digital rather than commercial. It consists of two public-facing web portals — Privatperson for citizens and Verksamhet for businesses — that publish guidance on data protection, camera surveillance, AI regulation, and credit reporting. Operational sub-products include the Innovationsportalen regulatory sandbox (which provides pre-market guidance for AI and data-intensive projects), IMY Play (educational video platform), e-services for incident reporting, data protection officer registration and credit-reporting license applications, and a public registry of supervision decisions and enforcement actions (Tillsyner och beslut). The agency publishes guidance documents, legal positions, and consultation responses under the Publikationer umbrella. No proprietary technology platform, APIs, or SDKs are offered; the underlying capability is regulatory interpretation, enforcement, and stakeholder education rather than product engineering.

IMY is a publicly funded Swedish government authority and does not operate a commercial revenue model. Funding flows through state budget appropriations, with no fees charged to individuals or businesses for guidance, complaint handling, or sandbox participation (some licensing-related fees may apply for credit-reporting permits but these are not commercially motivated). Customer segments are statutory rather than commercial: Swedish citizens seeking data protection rights enforcement, Swedish businesses and public-sector bodies requiring GDPR compliance oversight, and a secondary segment of AI developers and innovators participating in the Innovationsportalen sandbox. The agency has no private shareholders, no parent company, and no subsidiaries; it is accountable to the Swedish government. Geographic scope is domestic (Sweden), with influence extending through EDPB participation to EU/EEA-wide policy coordination.

Name

IMY Data

Legal name

Integritetsskyddsmyndigheten

Website

https://imy.se

Company type

Public

Founded year

2020

Operating status

Operating

Short description

IMY (Integritetsskyddsmyndigheten) is Sweden's national data protection authority, enforcing GDPR, supervising camera surveillance and credit reporting, and issuing regulatory guidance to citizens and businesses.

Ownership category

akta.pro rank

Product category

Privacy and Data Protection Regulatory Services

NAICS

Public Administration (92), International Affairs (92812)

akta.pro primary industry

Regulatory Readiness & Audit Automation (e.g., EU AI Act, NIST AI RMF, ISO/IEC 42001) (HDAAAMAE)

akta.pro secondary industries

AI Privacy Engineering & Data Governance (PII, consent, retention) (HDAAAKAB), Responsible AI, Security & Privacy Platforms (Safety, Guardrails, PII) (HDAEANAG)

Keywords

• Data protection regulation
• GDPR enforcement
• Privacy supervisory authority
• Regulatory sandbox
• Data protection oversight

Headquarters

HQ city

Stockholm

HQ country

Sweden

HQ region

Europe

Markets served

GTM type

B2B and B2C

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Others, Marketing or Sales

Distribution channels3 records

Marketing channels6 records

Core offering

IMY is Sweden's national data protection authority (Integritetsskyddsmyndigheten) that supervises and enforces GDPR, the Camera Surveillance Act, and the Credit Reporting Act. The agency provides regulatory guidance, investigates complaints, issues binding decisions, manages the Innovationsportalen regulatory sandbox for AI and data-driven innovations, and educates both citizens and organizations on privacy rights and compliance obligations. It is funded by the Swedish state and operates under the Ministry of Justice with no commercial offerings.

Product overview

IMY (Integritetsskyddsmyndigheten) is the Swedish Privacy Protection Authority, a government regulatory agency that works to protect individuals' personal data. The organization does not offer a commercial product in the traditional sense but provides public services including: the IMY Web Portals for individuals (Privatperson) and businesses (Verksamhet) offering guidance on data protection, camera surveillance, AI regulation, and credit reporting; Innovationsportalen (Regulatory Sandbox) providing a framework for testing innovative projects with personal data under regulatory guidance; IMY Play educational video platform; E-tjänster och blanketter (E-services and Forms) for submitting complaints and reports; Tillsyner och beslut (Supervisions and Decisions) public registry; and Publikationer (Publications) containing guidance documents and reports. These services collectively form IMY's regulatory oversight and public guidance offerings rather than a commercial product portfolio.

Differentiator

Problem solved

Functional benefit

Products and services

• IMY Web Portal (Privatperson)
• IMY Web Portal (Verksamhet)
• Innovationsportalen (Regulatory Sandbox)

Segments3 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Partnerships

Six partnerships are on record, tiered core and minor.

• Nordic Data Protection AuthoritiescoreStrategic or Co-development Partner · 26 May 2026IMY hosted a meeting of Nordic data protection authorities in Stockholm in May 2026. The meeting addressed EU Commission proposals for GDPR changes, AI regulations, and new rules for cross-border cases. Topics included AI oversight, GDPR amendments, and cross-border enforcement coordination.
• European Data Protection Board (EDPB)coreStrategic or Co-development PartnerIMY participates in the EDPB, which brings together data protection authorities from EU/EEA countries. EDPB issues guidelines and ensures consistent application of GDPR across the EU. In July 2026, IMY participated in a Dublin summit discussing efficiency and harmonized practices for cross-border supervision.
• European Data Protection Supervisor (EDPS)coreStrategic or Co-development PartnerIMY collaborates with EDPS on matters of EU-wide data protection oversight and policy alignment.
• Media Authority (Mediemyndigheten)minorOthersIMY works with the Media Authority on matters related to publishing certificates (utgivningsbevis) and political advertising regulations. The Media Authority has primary responsibility for political advertising compliance while IMY oversees data protection aspects.
• Danish Data Protection Authority (Datatilsynet)minorStrategic or Co-development PartnerNordic collaboration partner. Danish authority published a report on speech recognition and classification as support tools for healthcare and social care staff, relevant for AI transcription guidance.
• Norwegian Data Protection Authority (Datatilsynet)minorStrategic or Co-development PartnerNordic collaboration partner. Norwegian authority is working on a regulatory sandbox report expected summer 2026. Collaboration includes sharing experiences on AI governance and innovation sandbox approaches.

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• EDPB (European Data Protection Board): EU-level body composed of national DPAs including IMY. Issues pan-EU guidelines and ensures consistent GDPR application. Operates at a broader geographic scope than IMY but performs overlapping coordination and guidance functions.
• EDPS (European Data Protection Supervisor): EU's independent data protection authority supervising EU institutions. Collaborates directly with IMY on EU-wide oversight and policy alignment, operating at a wider institutional scope with overlapping supervisory themes.

Direct peers

• ICO (Information Commissioner's Office): UK's data protection authority. Comparable as a national supervisory authority enforcing data protection rules with guidance, complaint handling, and innovation services, although operating outside the EU post-Brexit.
• Datatilsynet (Denmark): Danish data protection authority and listed Nordic collaboration partner. Direct peer in both EDPB and Nordic coordination with IMY, with parallel guidance and enforcement functions in Denmark.
• Autoriteit Persoonsgegevens (AP): Dutch data protection authority. Comparable national GDPR supervisory authority with enforcement powers, published guidance, and innovation engagement, serving the same role in the Netherlands that IMY serves in Sweden.
• AEPD (Agencia Española de Protección de Datos): Spanish data protection authority. Direct peer in the EDPB network performing the same GDPR supervisory, guidance, and enforcement functions within Spain as IMY does within Sweden.
• CNIL (Commission Nationale de l'Informatique et des Libertés): French data protection authority, directly comparable as a national GDPR supervisory authority with enforcement powers, guidance publications, and a regulatory sandbox for AI. IMY and CNIL are both members of the EDPB and serve similar functions in their respective jurisdictions.
• BfDI (Federal Commissioner for Data Protection and Freedom of Information): Germany's federal data protection authority. Direct peer as a national GDPR supervisory body with comparable enforcement and guidance functions, operating under a federal structure that mirrors IMY's role at the national level.
• Garante per la protezione dei dati personali: Italian data protection authority. Comparable national DPA with GDPR enforcement, AI guidance development, and EDPB participation, paralleling IMY's mandate and operational scope in Italy.
• Datatilsynet (Norway): Norwegian data protection authority and named Nordic collaboration partner. Comparable national supervisory body operating under EEA-aligned rules, sharing AI governance experience with IMY.

Market position

Strengths4 records

Weaknesses2 records

Competitive moat3 records

Key risks4 records

Key highlights6 records

Customer concentration

• Xx.com/IMYse
• LinkedInlinkedin.com/company/integritetsskyddsmyndigheten

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about IMY Data