The Importance of Technical and Organisational Measures in Data Protection

The Swedish Data Protection Authority (IMY) has fined Miljödata i Karlskrona AB, an IT service provider whose customers include most of Sweden’s municipalities, SEK 1,800,000 (approximately EUR 160,000) for insufficient technical and organisational measures. The decision, dated 22 September 2026, finds a breach of Article 32(1) of the GDPR. This enforcement action highlights the critical importance of implementing robust data protection measures to safeguard personal data and ensure compliance with the GDPR.

The facts are uncomfortable because they are ordinary. In August 2025 the company was hit by a cyberattack. The attacker gained access to a large volume of personal data and later published it on the darknet. According to the company, 2.2 million individuals were affected, and the data included personal identity numbers, contact details and sensitive data on sick leave, rehabilitation and student-related incidents in schools. IMY found that the company had not carried out adequate checks when installing new software, and had no automated real-time monitoring to detect intrusions or suspicious activity. Given the kind of data it processed, that fell short of the level of security the GDPR requires, and IMY assessed that the company acted negligently. IMY has also opened reviews of two municipalities and one region connected to the attack.

Technical and organisational measures are essential components of a comprehensive data protection strategy. Article 32 asks for a level of security appropriate to the risk, judged against the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing, and it names pseudonymisation and encryption, the resilience of systems, the ability to restore data after an incident and regular testing as the kinds of measure it has in mind. Technical measures may involve encryption, access controls and regular security audits, while organisational measures focus on policies, training and incident response planning.

The fine serves as a reminder that inadequate data protection measures can lead to significant financial penalties and reputational damage. Businesses must proactively assess their data protection strategies and implement best practices to mitigate risks. Key practices include conducting regular risk assessments to identify vulnerabilities, implementing data encryption and pseudonymisation, and ensuring that access to personal data is restricted to authorised personnel only. The two failures IMY singled out — unchecked software installs and no live monitoring — belong on that list for every organisation that holds sensitive data about other people. Additionally, organisations should establish clear policies and provide ongoing training to employees to foster a culture of data protection awareness.

In the event of a data breach, having a well-defined incident response plan is crucial. This plan should outline the steps to be taken to contain the breach, assess its impact and meet the GDPR’s notification duties: the supervisory authority within 72 hours where feasible, unless the breach is unlikely to result in a risk to individuals (Article 33), and the individuals themselves without undue delay where the risk to them is high (Article 34).

For businesses seeking to enhance their data protection measures, appointing an outsourced Data Protection Officer (DPO) can provide valuable guidance and support. Privacy Core Services offers outsourced DPO appointments to help organisations navigate the complexities of data protection compliance and safeguard personal data effectively.