Handling Confidential & Classified Information in Sweden: IT Infrastructure, Export Controls & Key Considerations
What are the requirements for handling and transferring confidential and classified information in Sweden?
The handling of confidential or classified information in Sweden is governed primarily by trade compliance legislation and the Protective Security Act and its ordinance, requiring operators to conduct a protective security analysis to identify classified information, assess threats and vulnerabilities, and determine appropriate safeguards. Only security‑vetted and authorized personnel may access classified information, and the regulatory framework also interacts with GDPR when information may be stored or accessible outside the EU or EEA. Transfers to third countries require adequate safeguards, and for items or technology with both civilian and military uses, the dual‑use and war‑materiel regulatory frameworks apply. This means that digital sharing, technical assistance or enabling access to such information can require authorization from the Inspectorate of Strategic Products.
Another area is where export controlled (classified) information is stored on IT systems, this is highly complicated in Sweden as the authorities are considering all cloud solutions with servers outside Sweden as an export of the information, irrespective of access rights etc.
In practical terms, organizations should begin by performing a structured protective security and export control analysis to determine what information is classified, where it resides and what risks exist. Technical and organizational controls such as access restrictions, logging, encryption and segregated environments should be implemented, and when using cloud services or external providers, server locations and potential third‑country access must be evaluated under export control rules and GDPR. Entities handling dual‑use or military
related information must also assess whether any transfer or access constitutes an export requiring ISP authorization. Establishing clear processes for evaluating new systems, limiting cross‑border access and maintaining documented oversight of information flows helps ensure compliance and reduces the risk of unauthorized exposure.
The Expert
Lawyer & Partner, Head of the International Commercial & Trade Group Baker McKenzie