Six areas. All of them apply from your first employee.
Your first colleague brings personal data, a working environment and an employment contract into the company. Fire safety comes with the premises you sit in. A few of the requirements wait until you grow. Most do not.
We would rather talk about the everyday than about regulations.
These six areas rest on law that reaches almost every Swedish employer. At that point it is better to say so plainly.
GDPR and personal data
Which version of your data processing agreement applies today?
See what is includedSystematic work environment management
Is it written down who runs the safety inspection, and how often?
See what is includedInformation security
What do you answer when the next customer sends a security questionnaire?
See what is includedHR and employment law
When was the Employee Handbook last updated?
See what is includedDiscrimination and active measures
Where is it written how you work on active measures?
See what is includedSystematic fire protection work
Who took over fire safety when the last person responsible left?
See what is included
The whole scope at a glance
Search for what compliance covers and you get the list written for listed companies: corporate governance, internal control, anti-corruption. That list is not wrong, it is just not yours. The list below is the one you actually live with. With a listed company anywhere in your value chain, the contract carries their requirements down to you. The law does not have to point at you for you to have to answer.
| Area | Statute | Documents |
|---|---|---|
| GDPR and personal data | GDPR Articles 28, 30, 32, 33 and 34 | 4 |
| Systematic work environment management | AFS 2023:1 sections 7, 8, 9, 11 and 14 | 5 |
| Information security | GDPR Article 32 | 4 |
| HR and employment law | The Employment Protection Act (1982:80) section 6 c | 3 |
| Discrimination and active measures | The Discrimination Act chapter 3 sections 2, 5, 6, 8, 13 and 14 | 3 |
| Systematic fire protection work | The Civil Protection Act (2003:778) chapter 2 section 2, SRVFS 2004:3 and the Insurance Contracts Act (2005:104) chapter 8 section 12 | 3 |
Twenty-two documents, each with its statute on it, written for your company and kept consistent with one another.
The statutes were checked against the source on 10 October 2026. Every document carries its statute, so you can see what the requirement comes from rather than only that it exists.
Three requirements that are not law for you and can still reach you. A whistleblowing channel applies from fifty employees. The Swedish cybersecurity act covers eighteen designated sectors. A code of conduct against corruption has no basis in Swedish law at all. All three turn up in customer contracts and tenders anyway. When the requirement arrives that way, it is the contract that binds you.
Who owns what in your company?
The six areas are how the law divides things up. Inside a company the division is different: somebody owns the people, somebody owns the systems, somebody owns the contracts. Start where you stand.
- The whole company The board, the owners, the whole picture See what applies to you
- People and workplace Employee Handbook, work environment, fire safety See what applies to you
- IT and security Security questionnaires, access, suppliers See what applies to you
- Finance and contracts Contracts, supplier requirements, tenders See what applies to you